Edit tour

Windows Analysis Report
PFW1cgN8EK.exe

Overview

General Information

Sample name:	PFW1cgN8EK.exe renamed because original name is a hash value
Original sample name:	65c2ecfc7938fbb0ae043f410d7422bc.exe
Analysis ID:	1528469
MD5:	65c2ecfc7938fbb0ae043f410d7422bc
SHA1:	7013a95813327647d05d8466588ee75f201d22a7
SHA256:	e87c74da1adce6cb579ab6091003234ff247a128fc5c5800338f114ef0ea66aa
Tags:	32exetrojan
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Sigma detected: Silenttrinity Stager Msbuild Activity

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

PFW1cgN8EK.exe (PID: 7348 cmdline: "C:\Users\user\Desktop\PFW1cgN8EK.exe" MD5: 65C2ECFC7938FBB0AE043F410D7422BC)

MSBuild.exe (PID: 7364 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

MSBuild.exe (PID: 7372 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

MSBuild.exe (PID: 7380 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

WerFault.exe (PID: 7468 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7348 -s 280 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["bathdoomgaz.stor", "clearancek.site", "studennotediw.stor", "dissapoiznw.stor", "mobbipenju.stor", "licendfilteo.site", "spirittunek.stor", "trustterwowqm.shop", "eaglepawnoy.stor"], "Build id": "tLYMe5--deli333"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Silenttrinity Stager Msbuild Activity

Source: Network Connection

Author: Kiran kumar s, oscd.community: Data: DestinationIp: 104.102.49.254, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 7380, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49730

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T23:30:00.382716+0200	2054653	1	A Network Trojan was detected	192.168.2.4	49733	172.67.206.204	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T23:30:00.382716+0200	2049836	1	A Network Trojan was detected	192.168.2.4	49733	172.67.206.204	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T23:29:57.820534+0200	2056477	1	Domain Observed Used for C2 Detected	192.168.2.4	60787	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T23:29:57.851495+0200	2056471	1	Domain Observed Used for C2 Detected	192.168.2.4	58952	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T23:29:57.788654+0200	2056481	1	Domain Observed Used for C2 Detected	192.168.2.4	64388	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T23:29:57.773353+0200	2056483	1	Domain Observed Used for C2 Detected	192.168.2.4	61276	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T23:29:57.841243+0200	2056473	1	Domain Observed Used for C2 Detected	192.168.2.4	62722	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T23:29:57.754557+0200	2056485	1	Domain Observed Used for C2 Detected	192.168.2.4	53602	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T23:29:57.831049+0200	2056475	1	Domain Observed Used for C2 Detected	192.168.2.4	63787	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T23:29:57.801572+0200	2056479	1	Domain Observed Used for C2 Detected	192.168.2.4	55644	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (trustterwowqm .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T23:29:57.625946+0200	2056174	1	Domain Observed Used for C2 Detected	192.168.2.4	54153	1.1.1.1	53	UDP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: PFW1cgN8EK.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://steamcommunity.com/profiles/76561199724331900	URL Reputation: Label: malware
Source: https://steamcommunity.com/profiles/76561199724331900/inventory/	URL Reputation: Label: malware
Source: https://steamcommunity.com/profiles/76561199724331900/badges	URL Reputation: Label: malware

Found malware configuration

Source: 0.2.PFW1cgN8EK.exe.600000.0.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["bathdoomgaz.stor", "clearancek.site", "studennotediw.stor", "dissapoiznw.stor", "mobbipenju.stor", "licendfilteo.site", "spirittunek.stor", "trustterwowqm.shop", "eaglepawnoy.stor"], "Build id": "tLYMe5--deli333"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: PFW1cgN8EK.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp	String decryptor: clearancek.site
Source: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp	String decryptor: licendfilteo.site
Source: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp	String decryptor: spirittunek.stor
Source: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp	String decryptor: bathdoomgaz.stor
Source: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp	String decryptor: studennotediw.stor
Source: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp	String decryptor: dissapoiznw.stor
Source: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp	String decryptor: eaglepawnoy.stor
Source: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp	String decryptor: mobbipenju.stor
Source: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp	String decryptor: trustterwowqm.shop
Source: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp	String decryptor: tLYMe5--deli333

Source: PFW1cgN8EK.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49918 version: TLS 1.2

Source: PFW1cgN8EK.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\PFW1cgN8EK.exe

Code function: 0_2_00619ABF FindFirstFileExW,

0_2_00619ABF

Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then jmp ecx	0_2_0067604C
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00676140
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	0_2_0065C198
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_0063A268
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then mov word ptr [esi], ax	0_2_00658278
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	0_2_0065C224
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_0065E2E8
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	0_2_006722A8
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then jmp eax	0_2_00676343
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	0_2_0063E3F3
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then mov edx, dword ptr [esp]	0_2_0062E3F7
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then cmp word ptr [eax+esi+02h], 0000h	0_2_0065C3AC
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	0_2_0065E388
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], C85F7986h	0_2_0065A438
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C85F7986h	0_2_0065A438
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then cmp byte ptr [esi], 00000000h	0_2_00656410
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then mov word ptr [ebx], ax	0_2_0065C568
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then push 00000000h	0_2_006305B8
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then mov eax, edi	0_2_006566E6
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then mov eax, dword ptr [esi+0Ch]	0_2_0066074E
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then cmp byte ptr [edi], 00000000h	0_2_00642702
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 7789B0CBh	0_2_006747F8
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then cmp byte ptr [esi+01h], 00000000h	0_2_0063C81B
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	0_2_00648948
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then movzx edx, byte ptr [ecx+eax]	0_2_0063C938
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	0_2_006749F8
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then mov byte ptr [ecx], al	0_2_00660AD4
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_00660AD4
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_00660AD4
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_00668B78
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	0_2_00632B08
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then lea eax, dword ptr [edi+04h]	0_2_0065ABBB
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_0064CB98
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_00676B98
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	0_2_00676B98
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	0_2_0066EC08
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00670C08
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then push ebx	0_2_00642D4B
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_00676D28
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	0_2_00676D28
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then cmp word ptr [ecx+edx+02h], 0000h	0_2_00676EA8
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 9ECF05EBh	0_2_00676EA8
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then mov word ptr [ebx], ax	0_2_0064EF70
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_0064AF2D
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00676FD8
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 62429966h	0_2_00671048
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_0065B175
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	0_2_00655108
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	0_2_00675288
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00655368
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then mov byte ptr [ecx], al	0_2_00661327
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_00661327
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_00661327
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then jmp ecx	0_2_0064338E
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then mov eax, dword ptr [esi+0Ch]	0_2_0066143A
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then mov byte ptr [ecx], al	0_2_0066143A
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_006774F8
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then inc edi	0_2_006434A4
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	0_2_00673642
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then jmp eax	0_2_0064165F
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	0_2_006736EE
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then push esi	0_2_0065D75B
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	0_2_00671798
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	0_2_006738E2
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_006618D8
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then mov eax, dword ptr [esi+40h]	0_2_00641920
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then mov eax, dword ptr [esp+000000C0h]	0_2_0063FA44
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	0_2_00631A58
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00673A08
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_0064FAE2
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+esi]	0_2_00639AE8
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then mov eax, dword ptr [ebp-18h]	0_2_0063BB58
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then mov byte ptr [esi+edx], bl	0_2_00639BF8
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then mov eax, dword ptr [esp+000001C0h]	0_2_0063FCD4
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_0063BCB9
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then mov dword ptr [esp+2Ch], ebp	0_2_00675EE8
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then cmp byte ptr [eax+01h], 00000000h	0_2_00655EC3
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+esi]	0_2_00673F68
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 4x nop then mov eax, dword ptr [esi+0Ch]	0_2_00661FF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	3_2_0040D390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	3_2_0044676A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	3_2_00446A0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+esi]	3_2_00447082
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 62429966h	3_2_00444170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	3_2_0044A100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+0Ch]	3_2_00435121
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	3_2_004491F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	3_2_004491F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	3_2_00428230
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	3_2_0042F2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	3_2_004453D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [esi], ax	3_2_0042B3A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	3_2_004483B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	3_2_0042F46A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	3_2_00431410
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp word ptr [eax+esi+02h], 0000h	3_2_0042F4D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_00428490
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	3_2_004314B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], C85F7986h	3_2_0042D560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C85F7986h	3_2_0042D560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+0Ch]	3_2_0043456A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [ecx], al	3_2_0043456A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	3_2_0041151B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov edx, dword ptr [esp]	3_2_0040151F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then inc edi	3_2_004165CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	3_2_0044A620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	3_2_0041463D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+40h]	3_2_0041463D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then push 00000000h	3_2_004036E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [ebx], ax	3_2_0042F690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+0Ch]	3_2_0043387B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	3_2_00446816
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp byte ptr [edi], 00000000h	3_2_0041582B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	3_2_004448C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then push esi	3_2_00430883
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp byte ptr [esi+01h], 00000000h	3_2_0040F943
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 7789B0CBh	3_2_00447920
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_0042D9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [ecx+eax]	3_2_0040FA60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	3_2_0041BA70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [edi], al	3_2_00434A00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then lea eax, dword ptr [edi+04h]	3_2_0042DB64
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+000000C0h]	3_2_00412B6C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [ebx], ax	3_2_00421B20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	3_2_00447B20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	3_2_00446B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [ecx], al	3_2_00433BD3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [ebx], al	3_2_00433BD3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [ebx], al	3_2_00433BD3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], dx	3_2_00422BEF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	3_2_00404B80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+esi]	3_2_0040CC10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	3_2_00405C30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [ebx], al	3_2_0041FCC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	3_2_00449CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	3_2_00449CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-18h]	3_2_0040EC80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [ebx], al	3_2_00434C90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [ebx], al	3_2_00434C90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	3_2_0043BCA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [esi+edx], bl	3_2_0040CD20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	3_2_00443D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	3_2_00441D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	3_2_0040EDE1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp ecx	3_2_00448DE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	3_2_00448DE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	3_2_00448DE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+000001C0h]	3_2_00412DFC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], dx	3_2_0041DD90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	3_2_00449E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	3_2_00449E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov dword ptr [esp+2Ch], ebp	3_2_00448ED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp ecx	3_2_00448ED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	3_2_00448ED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	3_2_00448ED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp word ptr [ecx+edx+02h], 0000h	3_2_00449FD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 9ECF05EBh	3_2_00449FD0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.4:60787 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056174 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (trustterwowqm .shop) : 192.168.2.4:54153 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.4:61276 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.4:53602 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.4:62722 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.4:55644 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.4:63787 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.4:64388 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.4:58952 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49733 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49733 -> 172.67.206.204:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: bathdoomgaz.stor
Source: Malware configuration extractor	URLs: clearancek.site
Source: Malware configuration extractor	URLs: studennotediw.stor
Source: Malware configuration extractor	URLs: dissapoiznw.stor
Source: Malware configuration extractor	URLs: mobbipenju.stor
Source: Malware configuration extractor	URLs: licendfilteo.site
Source: Malware configuration extractor	URLs: spirittunek.stor
Source: Malware configuration extractor	URLs: trustterwowqm.shop
Source: Malware configuration extractor	URLs: eaglepawnoy.stor

Source: Joe Sandbox View	IP Address: 104.102.49.254 104.102.49.254
Source: Joe Sandbox View	IP Address: 172.67.206.204 172.67.206.204

Source: Joe Sandbox View	ASN Name: AKAMAI-ASUS AKAMAI-ASUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: sergei-esenin.com

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: MSBuild.exe, 00000003.00000002.1713600019.0000000000C03000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://play equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: trustterwowqm.shop
Source: global traffic	DNS traffic detected: DNS query: mobbipenju.store
Source: global traffic	DNS traffic detected: DNS query: eaglepawnoy.store
Source: global traffic	DNS traffic detected: DNS query: dissapoiznw.store
Source: global traffic	DNS traffic detected: DNS query: studennotediw.store
Source: global traffic	DNS traffic detected: DNS query: bathdoomgaz.store
Source: global traffic	DNS traffic detected: DNS query: spirittunek.store
Source: global traffic	DNS traffic detected: DNS query: licendfilteo.site
Source: global traffic	DNS traffic detected: DNS query: clearancek.site
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: sergei-esenin.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: sergei-esenin.com

Source: MSBuild.exe, 00000003.00000002.1713600019.0000000000C03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: MSBuild.exe, 00000003.00000002.1713600019.0000000000C03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.m;
Source: MSBuild.exe, 00000003.00000002.1713668732.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.1713523371.0000000000BBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: MSBuild.exe, 00000003.00000002.1713668732.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.1713523371.0000000000BBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: MSBuild.exe, 00000003.00000002.1713668732.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.1713523371.0000000000BBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: Amcache.hve.6.dr	String found in binary or memory: http://upx.sf.net
Source: MSBuild.exe, 00000003.00000002.1713523371.0000000000BBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: MSBuild.exe, 00000003.00000002.1713600019.0000000000C03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bathdoomgaz.store/api
Source: MSBuild.exe, 00000003.00000002.1713600019.0000000000C03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: MSBuild.exe, 00000003.00000002.1713600019.0000000000C03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/
Source: MSBuild.exe, 00000003.00000002.1713600019.0000000000C03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/
Source: MSBuild.exe, 00000003.00000002.1713523371.0000000000BBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=Ev2sBLgkgyWJ&a
Source: MSBuild.exe, 00000003.00000002.1713523371.0000000000BBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: MSBuild.exe, 00000003.00000002.1713668732.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.1713523371.0000000000BBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: MSBuild.exe, 00000003.00000002.1713523371.0000000000BBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: MSBuild.exe, 00000003.00000002.1713523371.0000000000BBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=10oP_O2R
Source: MSBuild.exe, 00000003.00000002.1713523371.0000000000BBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=cdfm
Source: MSBuild.exe, 00000003.00000002.1713600019.0000000000C03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: MSBuild.exe, 00000003.00000002.1713600019.0000000000C03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: MSBuild.exe, 00000003.00000002.1713600019.0000000000C03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: MSBuild.exe, 00000003.00000002.1713600019.0000000000C03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: MSBuild.exe, 00000003.00000002.1713600019.0000000000C03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: MSBuild.exe, 00000003.00000002.1713600019.0000000000C03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: MSBuild.exe, 00000003.00000002.1713600019.0000000000C03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/
Source: MSBuild.exe, 00000003.00000002.1713600019.0000000000C03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/api
Source: MSBuild.exe, 00000003.00000002.1713600019.0000000000C03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/apik
Source: MSBuild.exe, 00000003.00000002.1713523371.0000000000BCD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com:443/apifiles/76561199724331900
Source: MSBuild.exe, 00000003.00000002.1713600019.0000000000C03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: MSBuild.exe, 00000003.00000002.1713600019.0000000000C03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: MSBuild.exe, 00000003.00000002.1713600019.0000000000C03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: MSBuild.exe, 00000003.00000002.1713600019.0000000000C03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: MSBuild.exe, 00000003.00000002.1713600019.0000000000C03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: MSBuild.exe, 00000003.00000002.1713600019.0000000000C03000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.1713600019.0000000000BE5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: MSBuild.exe, 00000003.00000002.1713668732.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.1713523371.0000000000BBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: MSBuild.exe, 00000003.00000002.1713600019.0000000000BE5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: MSBuild.exe, 00000003.00000002.1713523371.0000000000BBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: MSBuild.exe, 00000003.00000002.1713523371.0000000000BBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: MSBuild.exe, 00000003.00000002.1713600019.0000000000BE5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900r
Source: MSBuild.exe, 00000003.00000002.1713600019.0000000000C03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampower
Source: MSBuild.exe, 00000003.00000002.1713600019.0000000000C03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com
Source: MSBuild.exe, 00000003.00000002.1713600019.0000000000C03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/dj
Source: MSBuild.exe, 00000003.00000002.1713668732.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.1713523371.0000000000BBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: MSBuild.exe, 00000003.00000002.1713600019.0000000000C03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: MSBuild.exe, 00000003.00000002.1713600019.0000000000C03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: MSBuild.exe, 00000003.00000002.1713600019.0000000000C03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: MSBuild.exe, 00000003.00000002.1713600019.0000000000C03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: MSBuild.exe, 00000003.00000002.1713600019.0000000000C03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49918 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 3_2_004396A0 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

3_2_004396A0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 3_2_004396A0 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

3_2_004396A0

Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 0_2_00602021	0_2_00602021
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 0_2_00666078	0_2_00666078
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 0_2_0065A059	0_2_0065A059
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 0_2_0062E175	0_2_0062E175
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 0_2_00632268	0_2_00632268
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 0_2_00634278	0_2_00634278
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 0_2_0062E212	0_2_0062E212
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 0_2_0062E2D5	0_2_0062E2D5
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 0_2_00666378	0_2_00666378
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 0_2_00632302	0_2_00632302
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 0_2_00638428	0_2_00638428
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 0_2_0065A438	0_2_0065A438
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 0_2_006305B8	0_2_006305B8
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 0_2_0063E768	0_2_0063E768
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 0_2_00664858	0_2_00664858
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 0_2_0060CAF2	0_2_0060CAF2
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 0_2_00664A88	0_2_00664A88
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 0_2_0064CB98	0_2_0064CB98
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 0_2_00634C78	0_2_00634C78
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 0_2_00636C29	0_2_00636C29
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 0_2_00674DA8	0_2_00674DA8
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 0_2_00638F38	0_2_00638F38
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 0_2_0063F058	0_2_0063F058
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 0_2_0063B2D8	0_2_0063B2D8
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 0_2_00675288	0_2_00675288
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 0_2_0060729C	0_2_0060729C
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 0_2_00637338	0_2_00637338
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 0_2_0061D39B	0_2_0061D39B
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 0_2_0066D598	0_2_0066D598
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 0_2_0061572C	0_2_0061572C
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 0_2_00671798	0_2_00671798
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 0_2_00651908	0_2_00651908
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 0_2_0065BADA	0_2_0065BADA
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 0_2_0061BB36	0_2_0061BB36
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 0_2_0066BCB8	0_2_0066BCB8
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 0_2_00613C92	0_2_00613C92
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 0_2_00601D79	0_2_00601D79
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 0_2_0060FEF0	0_2_0060FEF0
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 0_2_0062DED8	0_2_0062DED8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0040FFE0	3_2_0040FFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0040C060	3_2_0040C060
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00401000	3_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00447082	3_2_00447082
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00409110	3_2_00409110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_004491F0	3_2_004491F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00412180	3_2_00412180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0042D181	3_2_0042D181
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_004391A0	3_2_004391A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0040129D	3_2_0040129D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00405340	3_2_00405340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0042D181	3_2_0042D181
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_004073A0	3_2_004073A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_004483B0	3_2_004483B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0040A460	3_2_0040A460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0040E400	3_2_0040E400
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_004394A0	3_2_004394A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0040B550	3_2_0040B550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0042D560	3_2_0042D560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_004305E0	3_2_004305E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_004406C0	3_2_004406C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_004036E0	3_2_004036E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0042B69D	3_2_0042B69D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_004448C0	3_2_004448C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_004298E2	3_2_004298E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00411890	3_2_00411890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0042E977	3_2_0042E977
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00409903	3_2_00409903
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_004489D7	3_2_004489D7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00437980	3_2_00437980
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0042D9A0	3_2_0042D9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0042FA20	3_2_0042FA20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00424A30	3_2_00424A30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0042CAF0	3_2_0042CAF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00406B60	3_2_00406B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0042DB64	3_2_0042DB64
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00448B00	3_2_00448B00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00409B1C	3_2_00409B1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00437BB0	3_2_00437BB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0042EC02	3_2_0042EC02
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0041FCC0	3_2_0041FCC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0043EDE0	3_2_0043EDE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00448DE0	3_2_00448DE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00407DA0	3_2_00407DA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00432E33	3_2_00432E33
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00448ED0	3_2_00448ED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00447ED0	3_2_00447ED0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 0040CB10 appears 45 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 0041D970 appears 155 times
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: String function: 0064A848 appears 155 times
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: String function: 006399E8 appears 96 times
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: String function: 00607B80 appears 49 times

Source: C:\Users\user\Desktop\PFW1cgN8EK.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7348 -s 280

Source: PFW1cgN8EK.exe, 00000000.00000000.1683897384.0000000000688000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameproquota.exej% vs PFW1cgN8EK.exe
Source: PFW1cgN8EK.exe	Binary or memory string: OriginalFilenameproquota.exej% vs PFW1cgN8EK.exe

Source: PFW1cgN8EK.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: PFW1cgN8EK.exe

Static PE information: Section: .data ZLIB complexity 0.9910960477941176

Source: classification engine

Classification label: mal100.troj.evad.winEXE@8/5@11/2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 3_2_00428230 CoCreateInstance,

3_2_00428230

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7348

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\ca227de9-4879-4c61-8719-c82692f1a6f2

Jump to behavior

Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Command line argument: MZx	0_2_00602021
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Command line argument: MZx	0_2_00602021
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Command line argument: MZx	0_2_00602021

Source: PFW1cgN8EK.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\PFW1cgN8EK.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\PFW1cgN8EK.exe "C:\Users\user\Desktop\PFW1cgN8EK.exe"
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7348 -s 280
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior

Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll	Jump to behavior

Source: PFW1cgN8EK.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: PFW1cgN8EK.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: PFW1cgN8EK.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: PFW1cgN8EK.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: PFW1cgN8EK.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: PFW1cgN8EK.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: PFW1cgN8EK.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: PFW1cgN8EK.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: PFW1cgN8EK.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: PFW1cgN8EK.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: PFW1cgN8EK.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: PFW1cgN8EK.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: PFW1cgN8EK.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 0_2_00642722 push eax; retf	0_2_00642727
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 0_2_006071AD push ecx; ret	0_2_006071C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0041584A push eax; retf	3_2_0041584F

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\PFW1cgN8EK.exe

API coverage: 4.2 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7416

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\PFW1cgN8EK.exe

Code function: 0_2_00619ABF FindFirstFileExW,

0_2_00619ABF

Source: Amcache.hve.6.dr	Binary or memory string: VMware
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.6.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.6.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.6.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: MSBuild.exe, 00000003.00000002.1713600019.0000000000C03000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.6.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.6.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.6.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.6.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.6.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.6.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.6.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: MSBuild.exe, 00000003.00000002.1713523371.0000000000BBC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWH
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.6.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.6.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.6.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 3_2_004464F0 LdrInitializeThunk,

3_2_004464F0

Source: C:\Users\user\Desktop\PFW1cgN8EK.exe

Code function: 0_2_00607922 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00607922

Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 0_2_00602003 mov edi, dword ptr fs:[00000030h]	0_2_00602003
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 0_2_0061A64C mov eax, dword ptr fs:[00000030h]	0_2_0061A64C
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 0_2_00610F2E mov ecx, dword ptr fs:[00000030h]	0_2_00610F2E

Source: C:\Users\user\Desktop\PFW1cgN8EK.exe

Code function: 0_2_0061CC4B GetProcessHeap,

0_2_0061CC4B

Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 0_2_00607610 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00607610
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 0_2_00607922 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00607922
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 0_2_0060DA73 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0060DA73
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: 0_2_00607AAF SetUnhandledExceptionFilter,	0_2_00607AAF

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\PFW1cgN8EK.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\PFW1cgN8EK.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: PFW1cgN8EK.exe	String found in binary or memory: spirittunek.stor
Source: PFW1cgN8EK.exe	String found in binary or memory: bathdoomgaz.stor
Source: PFW1cgN8EK.exe	String found in binary or memory: studennotediw.stor
Source: PFW1cgN8EK.exe	String found in binary or memory: dissapoiznw.stor
Source: PFW1cgN8EK.exe	String found in binary or memory: eaglepawnoy.stor
Source: PFW1cgN8EK.exe	String found in binary or memory: mobbipenju.stor
Source: PFW1cgN8EK.exe	String found in binary or memory: trustterwowqm.shop
Source: PFW1cgN8EK.exe	String found in binary or memory: clearancek.site
Source: PFW1cgN8EK.exe	String found in binary or memory: licendfilteo.site

Writes to foreign memory regions

Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 44C000	Jump to behavior
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 44F000	Jump to behavior
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 45F000	Jump to behavior
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 9A0008	Jump to behavior

Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior

Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_0061C085
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: GetLocaleInfoW,	0_2_0061622B
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: EnumSystemLocalesW,	0_2_0061C372
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: EnumSystemLocalesW,	0_2_0061C327
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: EnumSystemLocalesW,	0_2_0061C40D
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_0061C498
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: GetLocaleInfoW,	0_2_0061C6EB
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_0061C814
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: GetLocaleInfoW,	0_2_0061C91A
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_0061C9E9
Source: C:\Users\user\Desktop\PFW1cgN8EK.exe	Code function: EnumSystemLocalesW,	0_2_00615D7F

Source: C:\Users\user\Desktop\PFW1cgN8EK.exe

Code function: 0_2_00607815 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00607815

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	311 Process Injection	2 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	311 Process Injection	LSASS Memory	41 Security Software Discovery	Remote Desktop Protocol	2 Clipboard Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	2 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	13 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
PFW1cgN8EK.exe	100%	Avira	HEUR/AGEN.1310458
PFW1cgN8EK.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://community.akamai.steamstatic.com/	0%	URL Reputation	safe
https://www.gstatic.cn/recaptcha/	0%	URL Reputation	safe
http://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	0%	URL Reputation	safe
https://recaptcha.net/recaptcha/;	0%	URL Reputation	safe
https://medal.tv	0%	URL Reputation	safe
https://broadcast.st.dl.eccdnx.com	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	0%	URL Reputation	safe
https://login.steampowered.com/	0%	URL Reputation	safe
https://store.steampowered.com/legal/	0%	URL Reputation	safe
https://steam.tv/	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900	100%	URL Reputation	malware
http://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://recaptcha.net	0%	URL Reputation	safe
http://upx.sf.net	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900/inventory/	100%	URL Reputation	malware
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	0%	URL Reputation	safe
https://help.steampowered.com/	0%	URL Reputation	safe
http://store.steampowered.com/account/cookiepreferences/	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900/badges	100%	URL Reputation	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
steamcommunity.com	104.102.49.254	true	true	unknown
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	unknown
sergei-esenin.com	172.67.206.204	true	true	unknown
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.18	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown
trustterwowqm.shop	unknown	unknown	true	unknown
eaglepawnoy.store	unknown	unknown	false	unknown
bathdoomgaz.store	unknown	unknown	false	unknown
spirittunek.store	unknown	unknown	false	unknown
licendfilteo.site	unknown	unknown	true	unknown
studennotediw.store	unknown	unknown	false	unknown
mobbipenju.store	unknown	unknown	false	unknown
clearancek.site	unknown	unknown	true	unknown
dissapoiznw.store	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
studennotediw.stor	true		unknown
spirittunek.stor	true		unknown
trustterwowqm.shop	true		unknown
eaglepawnoy.stor	true		unknown
clearancek.site	true		unknown
mobbipenju.stor	true		unknown
https://steamcommunity.com/profiles/76561199724331900	true	URL Reputation: malware	unknown
licendfilteo.site	true		unknown
bathdoomgaz.stor	true		unknown
dissapoiznw.stor	true		unknown
https://sergei-esenin.com/api	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=cdfm	MSBuild.exe, 00000003.00000002.1713523371.0000000000BBC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sergei-esenin.com/apik	MSBuild.exe, 00000003.00000002.1713600019.0000000000C03000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/	MSBuild.exe, 00000003.00000002.1713600019.0000000000C03000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/	MSBuild.exe, 00000003.00000002.1713600019.0000000000C03000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sergei-esenin.com/	MSBuild.exe, 00000003.00000002.1713600019.0000000000C03000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.gstatic.cn/recaptcha/	MSBuild.exe, 00000003.00000002.1713600019.0000000000C03000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://store.steampowered.com/subscriber_agreement/	MSBuild.exe, 00000003.00000002.1713668732.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.1713523371.0000000000BBC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	MSBuild.exe, 00000003.00000002.1713668732.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.1713523371.0000000000BBC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	MSBuild.exe, 00000003.00000002.1713523371.0000000000BBC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://recaptcha.net/recaptcha/;	MSBuild.exe, 00000003.00000002.1713600019.0000000000C03000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com	MSBuild.exe, 00000003.00000002.1713600019.0000000000C03000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.youtube.com	MSBuild.exe, 00000003.00000002.1713600019.0000000000C03000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com	MSBuild.exe, 00000003.00000002.1713600019.0000000000C03000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://medal.tv	MSBuild.exe, 00000003.00000002.1713600019.0000000000C03000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://broadcast.st.dl.eccdnx.com	MSBuild.exe, 00000003.00000002.1713600019.0000000000C03000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	MSBuild.exe, 00000003.00000002.1713668732.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.1713523371.0000000000BBC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.m;	MSBuild.exe, 00000003.00000002.1713600019.0000000000C03000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://s.ytimg.com;	MSBuild.exe, 00000003.00000002.1713600019.0000000000C03000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://login.steampowered.com/	MSBuild.exe, 00000003.00000002.1713600019.0000000000C03000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/legal/	MSBuild.exe, 00000003.00000002.1713668732.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.1713523371.0000000000BBC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steam.tv/	MSBuild.exe, 00000003.00000002.1713600019.0000000000C03000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199724331900r	MSBuild.exe, 00000003.00000002.1713600019.0000000000BE5000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://store.steampower	MSBuild.exe, 00000003.00000002.1713600019.0000000000C03000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/dj	MSBuild.exe, 00000003.00000002.1713600019.0000000000C03000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://store.steampowered.com/privacy_agreement/	MSBuild.exe, 00000003.00000002.1713668732.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.1713523371.0000000000BBC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://recaptcha.net	MSBuild.exe, 00000003.00000002.1713600019.0000000000C03000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://upx.sf.net	Amcache.hve.6.dr	false	URL Reputation: safe	unknown
https://sketchfab.com	MSBuild.exe, 00000003.00000002.1713600019.0000000000C03000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	MSBuild.exe, 00000003.00000002.1713523371.0000000000BBC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199724331900/inventory/	MSBuild.exe, 00000003.00000002.1713523371.0000000000BBC000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://127.0.0.1:27060	MSBuild.exe, 00000003.00000002.1713600019.0000000000C03000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=Ev2sBLgkgyWJ&a	MSBuild.exe, 00000003.00000002.1713523371.0000000000BBC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sergei-esenin.com:443/apifiles/76561199724331900	MSBuild.exe, 00000003.00000002.1713523371.0000000000BCD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	MSBuild.exe, 00000003.00000002.1713523371.0000000000BBC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=10oP_O2R	MSBuild.exe, 00000003.00000002.1713523371.0000000000BBC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bathdoomgaz.store/api	MSBuild.exe, 00000003.00000002.1713600019.0000000000C03000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com/recaptcha/	MSBuild.exe, 00000003.00000002.1713600019.0000000000C03000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://help.steampowered.com/	MSBuild.exe, 00000003.00000002.1713600019.0000000000C03000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://store.steampowered.com/account/cookiepreferences/	MSBuild.exe, 00000003.00000002.1713668732.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.1713523371.0000000000BBC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/	MSBuild.exe, 00000003.00000002.1713600019.0000000000C03000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.1713600019.0000000000BE5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com/profiles/76561199724331900/badges	MSBuild.exe, 00000003.00000002.1713523371.0000000000BBC000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.102.49.254	steamcommunity.com	United States		16625	AKAMAI-ASUS	true
172.67.206.204	sergei-esenin.com	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528469
Start date and time:	2024-10-07 23:29:04 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PFW1cgN8EK.exe renamed because original name is a hash value
Original Sample Name:	65c2ecfc7938fbb0ae043f410d7422bc.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@8/5@11/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 70% Number of executed functions: 12 Number of non-executed functions: 155
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.190.160.14, 40.126.32.136, 20.190.160.22, 40.126.32.68, 40.126.32.133, 40.126.32.72, 20.190.160.20, 40.126.32.134, 217.20.57.18, 192.229.221.95, 20.189.173.22, 52.149.20.212, 13.85.23.206, 4.175.87.197, 52.165.164.15
Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, ctldl.windowsupdate.com.delivery.microsoft.com, slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, www.tm.v4.a.prd.aadg.trafficmanager.net, onedsblobprdwus17.westus.cloudapp.azure.com, ctldl.windowsupdate.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, ocsp.digicert.com, login.live.com, ocsp.edge.digicert.com, blobcollector.events.data.trafficmanager.net, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, azureedge-t-prod.trafficmanager.net, umwatson.events.data.microsoft.com, wu-b-net.trafficmanager.net, www.tm.lg.prod.aadmsa.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: PFW1cgN8EK.exe

Simulations

Behavior and APIs

Time	Type	Description
17:29:56	API Interceptor	3x Sleep call for process: MSBuild.exe modified
17:30:09	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.102.49.254	http://gtm-cn-j4g3qqvf603.steamproxy1.com/	Get hash	malicious	Unknown	Browse	www.valvesoftware.com/legal.htm
172.67.206.204	Bn7LPdQA1s.exe	Get hash	malicious	LummaC, Vidar	Browse
	SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	CatalogApp.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	xwZfYpo16i.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	p7SnjaA8NN.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
sergei-esenin.com	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	lihZ6gUU7V.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.53.8
	Bn7LPdQA1s.exe	Get hash	malicious	LummaC, Vidar	Browse	172.67.206.204
	SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	CSY6k9gpVb.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	TuQlz67byH.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	CatalogApp.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
s-part-0017.t-0009.t-msedge.net	https://url.avanan.click/v2/r01/___https://www.tiktok.com/qnspdA7?fni=6cbb&qfsl=js&xhjsj=gnt_zwq&yfwljy=myyux:ddBBB.lttlqj.ht.zpdzwq?v=frudxdBjlfmjfqymhfwj.ht.pjd.kwjsy___.YXAzOnNvdXRoZXJua2l0Y2hlbmFuZGdyaWxsOmE6bzpiNGZlZGFhNjcxOTBhYjU4MTE5MjBlZTRiYTAxZmUwMTo3OmIxYWM6MDg1ODNlNjljZDkwNThkM2ZiM2RjYTI4MzFjZGY4NGFmMTYyZTlhYmVjYWYxY2Q4MmNkZDhiNmFmOWVkOWUxOTpoOlQ6VA#Sm9hbi5LbmlwcGVuQEVsa2F5LkNvbQ==	Get hash	malicious	Unknown	Browse	13.107.246.45
	SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	https://login.stmarytx.edu/cas/logout?service=http%3A%2F%2Fgoogle.com%2Famp%2Fmatrikaengineeringworks.com/hebc/?#?m=bWVsaXNzYWdAd2Utd29ybGR3aWRlLmNvbQ==	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://dsdhie.org/dsjhem	Get hash	malicious	Unknown	Browse	13.107.246.45
	SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	+18365366724753456-83736-10244688.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	https://s.craft.me/yB5midhwwaHUPW	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	https://t.dripemail3.com/c/eyJhbGciOiJIUzI1NiJ9.eyJhdWQiOiJkZXRvdXIiLCJpc3MiOiJtb25vbGl0aCIsInN1YiI6ImRldG91cl9saW5rIiwiaWF0IjoxNzI4MzA1Mzk4LCJuYmYiOjE3MjgzMDUzOTgsImFjY291bnRfaWQiOiIyNzYyNjA5IiwiZGVsaXZlcnlfaWQiOiJpeHI5d3pqeGcwZnI2NGJjbGwycyIsInRva2VuIjoiaXhyOXd6anhnMGZyNjRiY2xsMnMiLCJzZW5kX2F0IjoxNzI4MzA0MzU0LCJlbWFpbF9pZCI6OTk2Mzg3MCwiZW1haWxhYmxlX3R5cGUiOiJCcm9hZGNhc3QiLCJlbWFpbGFibGVfaWQiOjM5NTM4MjUsInVybCI6Imh0dHBzOi8vZGFpbHlhbGFza2EuY29tL25ld3M_X19zPWw5bzljOTZzbG8xZjF3aGFiODZrJnV0bV9zb3VyY2U9ZHJpcCZ1dG1fbWVkaXVtPWVtYWlsJnV0bV9jYW1wYWlnbj1TcHJpbmcraGFzK3NwcnVuZyslRjAlOUYlOEMlQjEifQ.HIDfaWGNVn-TCtUT4qZNHq7EdymoLEqvVA8XxZBU8z8	Get hash	malicious	HtmlDropper	Browse	13.107.246.45
	https://entertaininmotionre.pro/IQCm/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	wULBz8VjH0.exe	Get hash	malicious	Vidar	Browse	13.107.246.45
steamcommunity.com	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	utmggBCMML.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	lihZ6gUU7V.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254
	Bn7LPdQA1s.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Get hash	malicious	LummaC	Browse	92.122.104.90
	WiTqtf1aiE.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	out.exe	Get hash	malicious	Vidar	Browse	104.102.49.254

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	https://url.avanan.click/v2/r01/___https://www.tiktok.com/qnspdA7?fni=6cbb&qfsl=js&xhjsj=gnt_zwq&yfwljy=myyux:ddBBB.lttlqj.ht.zpdzwq?v=frudxdBjlfmjfqymhfwj.ht.pjd.kwjsy___.YXAzOnNvdXRoZXJua2l0Y2hlbmFuZGdyaWxsOmE6bzpiNGZlZGFhNjcxOTBhYjU4MTE5MjBlZTRiYTAxZmUwMTo3OmIxYWM6MDg1ODNlNjljZDkwNThkM2ZiM2RjYTI4MzFjZGY4NGFmMTYyZTlhYmVjYWYxY2Q4MmNkZDhiNmFmOWVkOWUxOTpoOlQ6VA#Sm9hbi5LbmlwcGVuQEVsa2F5LkNvbQ==	Get hash	malicious	Unknown	Browse	188.114.96.3
	EUYIlr7uUX.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.65.255.143
	SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	lihZ6gUU7V.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.53.8
	Bn7LPdQA1s.exe	Get hash	malicious	LummaC, Vidar	Browse	172.67.206.204
	https://www.dropbox.com/scl/fi/qo6796ed7hlrt0v8k9nr6/Patagonia-Health-Barcode-Scanner-Setup-2024.exe?rlkey=5bmndvx8124ztopqewiogbnlt&st=yvxpokhf&dl=0	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://dsdhie.org/dsjhem	Get hash	malicious	Unknown	Browse	188.114.96.3
	L-tron_Payroll.docx	Get hash	malicious	Unknown	Browse	104.17.25.14
	SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
AKAMAI-ASUS	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	utmggBCMML.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	lihZ6gUU7V.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254
	Bn7LPdQA1s.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254
	https://www.dropbox.com/scl/fi/qo6796ed7hlrt0v8k9nr6/Patagonia-Health-Barcode-Scanner-Setup-2024.exe?rlkey=5bmndvx8124ztopqewiogbnlt&st=yvxpokhf&dl=0	Get hash	malicious	Unknown	Browse	184.28.90.27
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	https://dsdhie.org/dsjhem	Get hash	malicious	Unknown	Browse	88.221.169.152
	SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Get hash	malicious	LummaC	Browse	92.122.104.90
	https://statics.teams.cdn.office.net/evergreen-assets/safelinks/1/atp-safelinks.html?url=https%3A%2F%2Fphpstack-1335745-4931432.cloudwaysapps.com%2F%23%26%26%2B~XanJlZEBwcm9hZy5jb20=&locale=en-us&dest=https%3A%2F%2Fteams.microsoft.com%2Fapi%2Fmt%2Fpart%2Famer-03%2Fbeta%2Fatpsafelinks%2Fgeturlreputationsitev2%2F&pc=dqIG3sYngZE8N2eRBkF7CAkOWKg5g3tGjnQGJGQlc61U8QGlKCs5AzH6JKtW7FyetS1g5oEXSNBKJVlJbTCgrea0O041dBSjafsPfOc5KxbMkQRnpwalZQdhHfcjoeWL7rzuDGG%252fj2e7scaAUTCy2PY0WmBb87rgNNPdmEQne%252f00jq9aOpwCvhJrGkNK5f8MP5jaUwccFhr9IIoVaCOrXUhSnuRv%252fw%252bxhUGpneOsAgBs7CjJQbmepBIHfEqwCkqvDbYbxYB4Hm9sLVAOFaz9VFMFSXPJt4MqeWAChikWLAZATmvniptR3h97WVF%252fZtjtm3RxdNyPROzhUvL92w9fdWmSw%252bHBxn5rMHOUpaQU16ZpcfATiVaU51fqKaYO2v4ZnK7axAavLgOpgAJivuE6JO2sqksPH41Z6PVam5c4J%252bwwz5Z2pqrOSxPxEcPGeDff%252bxp9PApNxpvURRLl98WzRw%252ftZEOu%252foKPhjN0OiTGAQDLRWTF%252bMCzSQg37tk7ZYUYYc0Ycs4xDjchhFprJCCSfrZ8WyHq6cjqmnbgDKRQig28xGNFnSDEeWMDBQeeeVyNqDv0FAAxkSAMO%252b7t4Qu1y0h0MHJYEb5pxfOYe8Pyfcsn7pyR%252fkKEqziEQVGlIETrpjVMNyrhJrnX9S%252flWaxf0H3tD%252fqMhzPysO9QdPSJTG054WE4jq5GRqTKu8P25t4KJLY15Oz2j5iCg7Bd5lczhgv4PQevplLuCGckM%252fs5EPk2r2FkSOxHF51EB5FR2TgXQR5UAp2BbaWTm9irKwSSUK5z1MsGMDokVMEB4bQ9mpZrl1%252bDMixJ1mQyyLXpelmEyN8zw1nTsbXAvDQgIvPLPj0QUtphEMnmVEXMkQHiw2WHWUSxIxYcY%252fltyp6bnMrankPAnpChbWQmk95rKsUz8tqtLjNDclK1y1FLy%252fh7sed9duxDDFupXnhmXxGJOmUV6FG1arxXL8urm1F98thG8anfchv3DafKsyVHHgmdUFNH6Uhcu4sB8fo0kqm2y7IWS96w5BeG334JvnFDJPLDPvtK5ojeXfDXh%252boKJdBxXGC9NmPwgDp8XeOavQnNlJRfUAXkhukdjDg1EHGF%252b9luUuTH%252fEbKHniTzx4OvIWUnDvXcdpuEIAnW8mDJzMXpmxpl3nwtTqeQWMeSNzjute9yTZEU%252beQk498EMyU%252fuPUg%252fSOH5r%252fwjGCsPpm%252f%252bUA00SsNvWuDD0AbNIKYubFuNKQ3SX6N7M11wOksoUG%252fz9IheWtOawwl7F0lqN3xkTQhfiiHovdudAPiB%252fzt25Im27XxPQ9s1c%252bnOWOPh6m%252bvaCQcj6bcwkFbNl5Y1KL7XQvirYSFsNXnrYuQvTPMk1n5CRq6dxsl9FRGV9MMdrZduC%252bG4B0zxLA58d8fTW2zfEXnRcMTgQKLK%252fmeZT7K3wwAvQiA%253d%253d%3B%20expires%3DWed%2C%2009%20Oct%202024%2014%3A05%3A23%20GMT%3B%20path%3D%2F%3B%20SameSite%3DNone%3B%20secu	Get hash	malicious	HTMLPhisher	Browse	2.19.126.151

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://url.avanan.click/v2/r01/___https://www.tiktok.com/qnspdA7?fni=6cbb&qfsl=js&xhjsj=gnt_zwq&yfwljy=myyux:ddBBB.lttlqj.ht.zpdzwq?v=frudxdBjlfmjfqymhfwj.ht.pjd.kwjsy___.YXAzOnNvdXRoZXJua2l0Y2hlbmFuZGdyaWxsOmE6bzpiNGZlZGFhNjcxOTBhYjU4MTE5MjBlZTRiYTAxZmUwMTo3OmIxYWM6MDg1ODNlNjljZDkwNThkM2ZiM2RjYTI4MzFjZGY4NGFmMTYyZTlhYmVjYWYxY2Q4MmNkZDhiNmFmOWVkOWUxOTpoOlQ6VA#Sm9hbi5LbmlwcGVuQEVsa2F5LkNvbQ==	Get hash	malicious	Unknown	Browse	13.107.246.45
	SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	utmggBCMML.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	lihZ6gUU7V.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	13.107.246.45
	Bn7LPdQA1s.exe	Get hash	malicious	LummaC, Vidar	Browse	13.107.246.45
	https://login.stmarytx.edu/cas/logout?service=http%3A%2F%2Fgoogle.com%2Famp%2Fmatrikaengineeringworks.com/hebc/?#?m=bWVsaXNzYWdAd2Utd29ybGR3aWRlLmNvbQ==	Get hash	malicious	Unknown	Browse	13.107.246.45
	file.exe	Get hash	malicious	Credential Flusher	Browse	13.107.246.45
	L-tron_Payroll.docx	Get hash	malicious	Unknown	Browse	13.107.246.45
	SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	https://communications-chamber-confidentiality-limitation.trycloudflare.com/spec/#bWNhcnR3cmlnaHRAY2hlbXVuZ2NhbmFsLmNvbQ==	Get hash	malicious	Unknown	Browse	13.107.246.45
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	utmggBCMML.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	lihZ6gUU7V.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.102.49.254 172.67.206.204
	Bn7LPdQA1s.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254 172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	WiTqtf1aiE.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254 172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_PFW1cgN8EK.exe_24c51d7e9c7cc263e148c8bd21fb26a70761fdd_bb6d8bc3_70f64a5d-1e3c-4de4-ade7-ef42e76c9336\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6541553145248412
Encrypted:	false
SSDEEP:	96:U73nFdTwu40FPKHsRyFSDAF3f8QXIDcQvc6QcEVcw3cE//+HbHg/5hZAX/d5FMTL:ULnku4UyHl0BU/YjhzuiFpZ24IO8e
MD5:	B7A2092409F0D9BF513437F58FCE174F
SHA1:	5057BE3BADE6DA47597EAF2960FA49C60D4A6495
SHA-256:	987AFD516D2AEA3AE45025F5C2E78D11000EF27E3581D02A18E214E506E5153B
SHA-512:	C6A94740646931B0153C692647848A0923994DB7ECA66546A18AF11D48749A094C0D68F490E6AC5F43CB448A9B7429AD705F6B8D98A44DFD720D060522CD0334
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.8.1.0.1.9.6.7.5.0.1.0.9.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.8.1.0.1.9.7.0.7.8.2.3.9.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.0.f.6.4.a.5.d.-.1.e.3.c.-.4.d.e.4.-.a.d.e.7.-.e.f.4.2.e.7.6.c.9.3.3.6.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.6.e.6.4.7.8.9.-.a.5.b.6.-.4.1.3.1.-.b.a.9.1.-.c.4.8.f.3.6.8.d.2.4.0.0.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.P.F.W.1.c.g.N.8.E.K...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.p.r.o.q.u.o.t.a...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.b.4.-.0.0.0.1.-.0.0.1.4.-.6.b.6.a.-.f.3.0.d.0.0.1.9.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.7.d.0.3.f.6.a.1.a.a.4.5.0.5.0.f.7.b.e.5.5.f.8.7.6.f.e.a.2.d.c.0.0.0.0.0.9.0.4.!.0.0.0.0.7.0.1.3.a.9.5.8.1.3.3.2.7.6.4.7.d.0.5.d.8.4.6.6.5.8.8.e.e.7.5.f.2.0.1.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6B73.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Mon Oct 7 21:29:56 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	34080
Entropy (8bit):	1.7137885901979923
Encrypted:	false
SSDEEP:	96:5Y8D48XxXh6zJWsEbOGi77HQLW44ejTs5tcm2np9M3gerdq3odWIkWIpoI42ipHJ:ZDXxXYQOujgtcmDFdj2ipHCV986
MD5:	F433ACF55794BEF9B2D345C784A2D5F1
SHA1:	2E34907BE71CA042F27053A55438A9236C04A0D4
SHA-256:	0F573E410FA879CF48F30A091857F13BFA5BE2B25B6BF25D8E1A2EEDB2B5528B
SHA-512:	0CFFEEB4639B2B68EB00655302E9A77636A400114D430A16F9C23C1C89B4FDB1F20B21B39A4403718B681D63D7211AD4A648385B6BCDF8B1827DCB0F4C0E7E8A
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ........R.g........................d...........................T.......8...........T...........P....y......................................................................................................eJ..............GenuineIntel............T............R.g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6BF1.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8328
Entropy (8bit):	3.6988566357173593
Encrypted:	false
SSDEEP:	192:R6l7wVeJtA6Knse6Y9eSU9KwgmfzN7t2prr89bTesfXxm:R6lXJa6g6YESU9KwgmfzN7tvTdf8
MD5:	28F627BA1FAB705F10CC86FABA46B70C
SHA1:	9EE9926B65FD39F1BB06404C3ECA26756F098E3D
SHA-256:	D80348642AE31F650EF4AF65BF785590D0FB26D70B9346293C294A6AD24A0CF0
SHA-512:	F7F9CDF8D7B8C7E4AE64289C895CF2B62E55DE6DBB2F4B8033D73396B26031FD435946BC57343099581C1B0D1B0BDC9631CA32454E88E1034179DAEA09876C74
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.3.4.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6C21.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4678
Entropy (8bit):	4.498208457026126
Encrypted:	false
SSDEEP:	48:cvIwWl8zsRJg77aI9diWpW8VYdYm8M4JwTkFx+q88MZaREh9Nad:uIjfjI7bj7VxJw4Maih9Nad
MD5:	B584861D86AB4414328F059BBE332522
SHA1:	F0A8F459656D70B4D5E0060B924C4B88BA631110
SHA-256:	8D773C621E23503C07878AA41B378C5DF0E3A9597E43A3B821A4C94BD3E3EF7D
SHA-512:	9FA3E8241DCE32A4AC1D65E071F9E80C91C6036CFC3CA79ED2892DD884EC3CDBB9B1C4E3D1DB219550D24D8EE0E49FE8B4D7018C68C1F0DC8381B347BE441A3A
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="533552" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.466026708709536
Encrypted:	false
SSDEEP:	6144:7IXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uNDdwBCswSby:cXD94+WlLZMM6YFHR+y
MD5:	003BD4194CD35CE21D0CDD64A73F94AF
SHA1:	3641F895AD853728BFE4360C8148187185BDFF60
SHA-256:	DD03307E7990A199BDF922014CC5185ADA088FFB8C8F3F3BC23DA04D90D8B3BA
SHA-512:	225F48DE1FAABE0F1EFF30B54643C1DE05FAA742BDF35E2F8E8B47D1637EB01745D35E77F7A4DC7E1380B0E692EA3D0EE8757CF96EE68AF8175695778D48F3D8
Malicious:	false
Reputation:	low
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..:...................................................................................................................................................................................................................................................................................................................................................-:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.722804652614048
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	PFW1cgN8EK.exe
File size:	550'912 bytes
MD5:	65c2ecfc7938fbb0ae043f410d7422bc
SHA1:	7013a95813327647d05d8466588ee75f201d22a7
SHA256:	e87c74da1adce6cb579ab6091003234ff247a128fc5c5800338f114ef0ea66aa
SHA512:	4a951e78442f7eb802255d14a337b0d8422de44bcfbe6cfb4f2a7561b3a2bc67406a7e519f7ef5fd1242af15a5b3314018a2286e3f2f01dec44d2ddfa3e786f2
SSDEEP:	12288:/zwId78Ir0t/BW7tYn23Gn/6Grxp7OSB6tBAWlHbDWvfURB/4S:/t78p9XCurOSMAwPhBA
TLSH:	32C40116B5C08072C5B6153202F5EA754E3EBDB04E22AD9F27940F7F5F34291EB21A6B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=.9.y.WUy.WUy.WU..TTu.WU..RT..WU..STl.WU..VTz.WUy.VU!.WUilTTm.WUilSTk.WUilRT4.WU1m^Tx.WU1m.Ux.WU1mUTx.WURichy.WU...............

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x406f52
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x670450E1 [Mon Oct 7 21:21:37 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	d10af643340e1121562abe3e6bd5b0e1

Entrypoint Preview

Instruction
call 00007FA5490478A0h
jmp 00007FA549046E0Fh
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
cmp edx, esi
je 00007FA549046FABh
mov ecx, dword ptr [ebp+0Ch]
cmp ecx, dword ptr [edx+0Ch]
jc 00007FA549046F9Ch
mov eax, dword ptr [edx+08h]
add eax, dword ptr [edx+0Ch]
cmp ecx, eax
jc 00007FA549046F9Eh
add edx, 28h
cmp edx, esi
jne 00007FA549046F7Ch
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 00007FA549046F8Bh
push esi
call 00007FA549047BB4h
test eax, eax
je 00007FA549046FB2h
mov eax, dword ptr fs:[00000018h]
mov esi, 0048653Ch
mov edx, dword ptr [eax+04h]
jmp 00007FA549046F96h
cmp edx, eax
je 00007FA549046FA2h
xor eax, eax
mov ecx, edx
lock cmpxchg dword ptr [esi], ecx
test eax, eax
jne 00007FA549046F82h
xor al, al
pop esi
ret
mov al, 01h
pop esi
ret
push ebp
mov ebp, esp
cmp dword ptr [ebp+08h], 00000000h
jne 00007FA549046F99h
mov byte ptr [00486540h], 00000001h
call 00007FA54904724Ah
call 00007FA54904A167h
test al, al
jne 00007FA549046F96h
xor al, al
pop ebp
ret
call 00007FA549052BC9h
test al, al
jne 00007FA549046F9Ch
push 00000000h
call 00007FA54904A16Eh
pop ecx
jmp 00007FA549046F7Bh
mov al, 01h
pop ebp
ret
push ebp
mov ebp, esp
cmp byte ptr [00486541h], 00000000h
je 00007FA549046F96h
mov al, 01h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2c6c0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x88000	0x3d8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x89000	0x1ad4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2abc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2ab00	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x23000	0x12c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x210f0	0x21200	e947adb304569ae8d742bd74bc5dc86f	False	0.5865713443396227	data	6.668096792711382	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x23000	0x9d78	0x9e00	67adb08e07986a7883ab43c7dacf5598	False	0.4352254746835443	data	4.958474977458083	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2d000	0x5a168	0x59400	c89c8feb7d70dedf94a8c011561d034e	False	0.9910960477941176	DOS executable (block device driver \377\377\377\377,32-bit sector-support)	7.992424591785034	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x88000	0x3d8	0x400	c67ba8481d4e7c92e5fe9f152983a3f3	False	0.439453125	data	3.287044161603086	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x89000	0x1ad4	0x1c00	967ba517ef397629953a38a8cd3a3bb4	False	0.7269810267857143	data	6.390595201674471	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x88058	0x380	data	English	United States	0.46205357142857145

Imports

DLL

Import

KERNEL32.dll

AttachConsole, MultiByteToWideChar, GetStringTypeW, WideCharToMultiByte, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, LCMapStringEx, GetCPInfo, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, CreateFileW, RaiseException, RtlUnwind, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, HeapAlloc, HeapFree, GetFileType, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileSizeEx, SetFilePointerEx, CloseHandle, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, GetProcessHeap, ReadConsoleW, HeapSize, WriteConsoleW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-07T23:29:57.625946+0200	2056174	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (trustterwowqm .shop)	1	192.168.2.4	54153	1.1.1.1	53	UDP
2024-10-07T23:29:57.754557+0200	2056485	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)	1	192.168.2.4	53602	1.1.1.1	53	UDP
2024-10-07T23:29:57.773353+0200	2056483	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)	1	192.168.2.4	61276	1.1.1.1	53	UDP
2024-10-07T23:29:57.788654+0200	2056481	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)	1	192.168.2.4	64388	1.1.1.1	53	UDP
2024-10-07T23:29:57.801572+0200	2056479	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)	1	192.168.2.4	55644	1.1.1.1	53	UDP
2024-10-07T23:29:57.820534+0200	2056477	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)	1	192.168.2.4	60787	1.1.1.1	53	UDP
2024-10-07T23:29:57.831049+0200	2056475	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)	1	192.168.2.4	63787	1.1.1.1	53	UDP
2024-10-07T23:29:57.841243+0200	2056473	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)	1	192.168.2.4	62722	1.1.1.1	53	UDP
2024-10-07T23:29:57.851495+0200	2056471	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)	1	192.168.2.4	58952	1.1.1.1	53	UDP
2024-10-07T23:30:00.382716+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49733	172.67.206.204	443	TCP
2024-10-07T23:30:00.382716+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49733	172.67.206.204	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 23:29:57.877890110 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 7, 2024 23:29:57.877934933 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 7, 2024 23:29:57.878019094 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 7, 2024 23:29:57.881040096 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 7, 2024 23:29:57.881072998 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 7, 2024 23:29:58.485574007 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 7, 2024 23:29:58.485646009 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 7, 2024 23:29:58.489746094 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 7, 2024 23:29:58.489757061 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 7, 2024 23:29:58.490082026 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 7, 2024 23:29:58.545202017 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 7, 2024 23:29:58.595396996 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 7, 2024 23:29:58.639408112 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 7, 2024 23:29:58.979721069 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 7, 2024 23:29:58.979747057 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 7, 2024 23:29:58.979753971 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 7, 2024 23:29:58.979796886 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 7, 2024 23:29:58.979798079 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 7, 2024 23:29:58.979816914 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 7, 2024 23:29:58.979841948 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 7, 2024 23:29:58.979855061 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 7, 2024 23:29:58.979855061 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 7, 2024 23:29:58.979868889 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 7, 2024 23:29:58.979890108 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 7, 2024 23:29:59.072078943 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 7, 2024 23:29:59.072110891 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 7, 2024 23:29:59.072195053 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 7, 2024 23:29:59.072205067 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 7, 2024 23:29:59.072243929 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 7, 2024 23:29:59.076927900 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 7, 2024 23:29:59.076991081 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 7, 2024 23:29:59.076996088 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 7, 2024 23:29:59.077027082 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 7, 2024 23:29:59.077039957 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 7, 2024 23:29:59.077074051 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 7, 2024 23:29:59.200015068 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 7, 2024 23:29:59.200038910 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 7, 2024 23:29:59.200052023 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 7, 2024 23:29:59.200057983 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 7, 2024 23:29:59.443917036 CEST	49733	443	192.168.2.4	172.67.206.204
Oct 7, 2024 23:29:59.444009066 CEST	443	49733	172.67.206.204	192.168.2.4
Oct 7, 2024 23:29:59.444084883 CEST	49733	443	192.168.2.4	172.67.206.204
Oct 7, 2024 23:29:59.450854063 CEST	49733	443	192.168.2.4	172.67.206.204
Oct 7, 2024 23:29:59.450892925 CEST	443	49733	172.67.206.204	192.168.2.4
Oct 7, 2024 23:29:59.915915966 CEST	443	49733	172.67.206.204	192.168.2.4
Oct 7, 2024 23:29:59.916027069 CEST	49733	443	192.168.2.4	172.67.206.204
Oct 7, 2024 23:29:59.926707029 CEST	49733	443	192.168.2.4	172.67.206.204
Oct 7, 2024 23:29:59.926762104 CEST	443	49733	172.67.206.204	192.168.2.4
Oct 7, 2024 23:29:59.927031040 CEST	443	49733	172.67.206.204	192.168.2.4
Oct 7, 2024 23:29:59.932538986 CEST	49733	443	192.168.2.4	172.67.206.204
Oct 7, 2024 23:29:59.932590961 CEST	49733	443	192.168.2.4	172.67.206.204
Oct 7, 2024 23:29:59.932655096 CEST	443	49733	172.67.206.204	192.168.2.4
Oct 7, 2024 23:30:00.382729053 CEST	443	49733	172.67.206.204	192.168.2.4
Oct 7, 2024 23:30:00.382838011 CEST	443	49733	172.67.206.204	192.168.2.4
Oct 7, 2024 23:30:00.382924080 CEST	49733	443	192.168.2.4	172.67.206.204
Oct 7, 2024 23:30:00.383209944 CEST	49733	443	192.168.2.4	172.67.206.204
Oct 7, 2024 23:30:00.383230925 CEST	443	49733	172.67.206.204	192.168.2.4
Oct 7, 2024 23:30:00.383244991 CEST	49733	443	192.168.2.4	172.67.206.204
Oct 7, 2024 23:30:00.383250952 CEST	443	49733	172.67.206.204	192.168.2.4
Oct 7, 2024 23:30:00.592164993 CEST	49675	443	192.168.2.4	173.222.162.32
Oct 7, 2024 23:30:53.719458103 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:53.719520092 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:53.719613075 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:53.720438957 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:53.720470905 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:54.334470987 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:54.334568024 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:54.336148977 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:54.336169004 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:54.336479902 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:54.346565962 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:54.391395092 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:54.465477943 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:54.465539932 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:54.465583086 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:54.465610027 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:54.465631008 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:54.465775013 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:54.465775013 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:54.535895109 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:54.535953999 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:54.536005020 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:54.536024094 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:54.536055088 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:54.536073923 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:54.550369024 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:54.550421953 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:54.550498962 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:54.550525904 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:54.550550938 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:54.550594091 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:54.607177973 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:54.607202053 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:54.607419968 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:54.607455015 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:54.607523918 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:54.612163067 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:54.612181902 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:54.612261057 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:54.612277031 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:54.612345934 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:54.617153883 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:54.617172956 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:54.617248058 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:54.617260933 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:54.617325068 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:54.621963978 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:54.621983051 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:54.622051001 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:54.622065067 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:54.622123003 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:54.726314068 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:54.726387024 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:54.726455927 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:54.726512909 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:54.726619005 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:54.726648092 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:54.730916023 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:54.730974913 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:54.731004953 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:54.731019020 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:54.731048107 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:54.731082916 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:54.734256983 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:54.734303951 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:54.734338045 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:54.734350920 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:54.734378099 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:54.734401941 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:54.737966061 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:54.738008976 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:54.738049984 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:54.738063097 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:54.738090038 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:54.738229036 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:54.741396904 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:54.741411924 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:54.741481066 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:54.741496086 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:54.741556883 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:54.744462013 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:54.744477987 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:54.744541883 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:54.744556904 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:54.744622946 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:54.745449066 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:54.745517969 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:54.745523930 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:54.745572090 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:54.745619059 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:54.745655060 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:54.745680094 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:54.745695114 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:54.803772926 CEST	49746	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:54.803828001 CEST	443	49746	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:54.803936958 CEST	49746	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:54.804120064 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:54.804215908 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:54.804287910 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:54.804368973 CEST	49746	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:54.804399014 CEST	443	49746	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:54.804693937 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:54.804732084 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:54.805201054 CEST	49748	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:54.805246115 CEST	443	49748	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:54.805305004 CEST	49748	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:54.805412054 CEST	49748	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:54.805424929 CEST	443	49748	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:54.805850029 CEST	49749	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:54.805938959 CEST	443	49749	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:54.806016922 CEST	49749	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:54.806113005 CEST	49749	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:54.806133986 CEST	443	49749	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:54.806202888 CEST	49750	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:54.806226015 CEST	443	49750	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:54.806289911 CEST	49750	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:54.806365013 CEST	49750	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:54.806390047 CEST	443	49750	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:55.423554897 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:55.424314976 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:55.424365044 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:55.425003052 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:55.425015926 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:55.429748058 CEST	443	49746	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:55.430016994 CEST	49746	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:55.430043936 CEST	443	49746	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:55.430486917 CEST	443	49748	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:55.430542946 CEST	49746	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:55.430552006 CEST	443	49746	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:55.431267977 CEST	49748	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:55.431268930 CEST	49748	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:55.431303024 CEST	443	49748	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:55.431315899 CEST	443	49748	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:55.432917118 CEST	443	49750	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:55.433146954 CEST	49750	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:55.433178902 CEST	443	49750	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:55.433593988 CEST	49750	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:55.433600903 CEST	443	49750	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:55.446556091 CEST	443	49749	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:55.446885109 CEST	49749	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:55.446911097 CEST	443	49749	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:55.447257042 CEST	49749	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:55.447262049 CEST	443	49749	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:55.521599054 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:55.521650076 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:55.521725893 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:55.521943092 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:55.521944046 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:55.521992922 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:55.522022963 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:55.525923014 CEST	49751	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:55.525964022 CEST	443	49751	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:55.526222944 CEST	49751	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:55.526223898 CEST	49751	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:55.526261091 CEST	443	49751	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:55.528129101 CEST	443	49746	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:55.528191090 CEST	443	49746	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:55.528265953 CEST	49746	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:55.528307915 CEST	443	49746	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:55.528350115 CEST	443	49748	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:55.528368950 CEST	443	49748	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:55.528379917 CEST	49746	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:55.528398037 CEST	443	49746	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:55.528419018 CEST	443	49748	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:55.528423071 CEST	49748	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:55.528428078 CEST	443	49746	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:55.528480053 CEST	49746	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:55.528487921 CEST	49748	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:55.528528929 CEST	49746	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:55.528563976 CEST	443	49746	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:55.528588057 CEST	49748	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:55.528589010 CEST	49748	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:55.528592110 CEST	49746	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:55.528601885 CEST	443	49748	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:55.528606892 CEST	443	49746	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:55.528613091 CEST	443	49748	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:55.531685114 CEST	49752	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:55.531712055 CEST	443	49752	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:55.531771898 CEST	49752	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:55.531946898 CEST	49753	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:55.531976938 CEST	443	49753	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:55.532031059 CEST	49753	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:55.532162905 CEST	49753	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:55.532176971 CEST	443	49753	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:55.532252073 CEST	49752	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:55.532263994 CEST	443	49752	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:55.533319950 CEST	443	49750	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:55.533339024 CEST	443	49750	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:55.533406019 CEST	49750	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:55.533468962 CEST	443	49750	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:55.533570051 CEST	49750	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:55.533570051 CEST	49750	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:55.533597946 CEST	443	49750	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:55.533633947 CEST	443	49750	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:55.533670902 CEST	443	49750	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:55.533715010 CEST	49750	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:55.536045074 CEST	49754	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:55.536056042 CEST	443	49754	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:55.536111116 CEST	49754	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:55.536211967 CEST	49754	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:55.536225080 CEST	443	49754	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:55.548196077 CEST	443	49749	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:55.548252106 CEST	443	49749	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:55.548307896 CEST	49749	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:55.549884081 CEST	49749	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:55.549915075 CEST	443	49749	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:55.549940109 CEST	49749	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:55.549953938 CEST	443	49749	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:55.558298111 CEST	49755	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:55.558322906 CEST	443	49755	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:55.558372021 CEST	49755	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:55.558572054 CEST	49755	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:55.558582067 CEST	443	49755	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:56.534523964 CEST	443	49751	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:56.535238028 CEST	49751	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:56.535252094 CEST	443	49751	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:56.535546064 CEST	443	49754	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:56.535561085 CEST	443	49755	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:56.535845995 CEST	49754	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:56.535856009 CEST	49751	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:56.535862923 CEST	443	49751	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:56.535866976 CEST	443	49754	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:56.536015987 CEST	49755	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:56.536036968 CEST	443	49755	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:56.536242008 CEST	49754	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:56.536247969 CEST	443	49754	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:56.536467075 CEST	49755	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:56.536472082 CEST	443	49755	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:56.536672115 CEST	443	49753	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:56.536921024 CEST	443	49752	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:56.537029982 CEST	49753	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:56.537035942 CEST	443	49753	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:56.537146091 CEST	49752	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:56.537153006 CEST	443	49752	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:56.537364960 CEST	49753	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:56.537369013 CEST	443	49753	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:56.537544966 CEST	49752	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:56.537549019 CEST	443	49752	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:56.629899979 CEST	443	49751	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:56.629956961 CEST	443	49751	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:56.630049944 CEST	49751	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:56.630301952 CEST	49751	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:56.630316973 CEST	443	49751	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:56.630359888 CEST	49751	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:56.630366087 CEST	443	49751	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:56.631880045 CEST	443	49754	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:56.631953001 CEST	443	49754	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:56.632008076 CEST	49754	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:56.632100105 CEST	49754	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:56.632121086 CEST	443	49754	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:56.632132053 CEST	49754	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:56.632138014 CEST	443	49754	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:56.632649899 CEST	443	49752	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:56.632812023 CEST	443	49752	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:56.632882118 CEST	49752	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:56.633249998 CEST	49752	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:56.633291006 CEST	443	49752	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:56.633317947 CEST	49752	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:56.633332968 CEST	443	49752	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:56.633708000 CEST	49756	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:56.633740902 CEST	443	49756	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:56.633801937 CEST	49756	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:56.634085894 CEST	49756	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:56.634100914 CEST	443	49756	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:56.634309053 CEST	443	49755	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:56.634366989 CEST	443	49755	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:56.634438992 CEST	49755	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:56.634596109 CEST	49755	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:56.634613037 CEST	443	49755	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:56.634635925 CEST	49755	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:56.634646893 CEST	443	49755	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:56.635288000 CEST	49757	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:56.635404110 CEST	443	49757	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:56.635487080 CEST	49757	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:56.635724068 CEST	49757	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:56.635760069 CEST	443	49757	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:56.636332989 CEST	49758	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:56.636358023 CEST	443	49758	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:56.636439085 CEST	49758	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:56.636511087 CEST	49759	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:56.636528015 CEST	443	49759	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:56.636564016 CEST	49758	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:56.636580944 CEST	49759	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:56.636590958 CEST	443	49758	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:56.636719942 CEST	49759	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:56.636733055 CEST	443	49759	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:56.637444019 CEST	443	49753	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:56.637511969 CEST	443	49753	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:56.637552977 CEST	49753	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:56.637666941 CEST	49753	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:56.637666941 CEST	49753	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:56.637677908 CEST	443	49753	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:56.637686968 CEST	443	49753	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:56.639683008 CEST	49760	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:56.639694929 CEST	443	49760	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:56.639760971 CEST	49760	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:56.639867067 CEST	49760	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:56.639873981 CEST	443	49760	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:57.242790937 CEST	443	49759	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:57.243231058 CEST	49759	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:57.243254900 CEST	443	49759	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:57.243688107 CEST	49759	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:57.243704081 CEST	443	49759	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:57.256907940 CEST	443	49756	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:57.259392023 CEST	49756	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:57.259406090 CEST	443	49756	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:57.260036945 CEST	49756	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:57.260044098 CEST	443	49756	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:57.266921043 CEST	443	49757	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:57.273359060 CEST	49757	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:57.273418903 CEST	443	49757	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:57.274291039 CEST	49757	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:57.274306059 CEST	443	49757	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:57.281712055 CEST	443	49758	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:57.282099962 CEST	49758	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:57.282118082 CEST	443	49758	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:57.282478094 CEST	49758	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:57.282495022 CEST	443	49758	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:57.290216923 CEST	443	49760	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:57.290740967 CEST	49760	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:57.290759087 CEST	443	49760	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:57.291393042 CEST	49760	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:57.291398048 CEST	443	49760	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:57.338347912 CEST	443	49759	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:57.338408947 CEST	443	49759	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:57.338459015 CEST	49759	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:57.338680029 CEST	49759	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:57.338701963 CEST	443	49759	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:57.338711977 CEST	49759	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:57.338717937 CEST	443	49759	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:57.341519117 CEST	49761	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:57.341624975 CEST	443	49761	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:57.341728926 CEST	49761	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:57.341878891 CEST	49761	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:57.341903925 CEST	443	49761	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:57.356045008 CEST	443	49756	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:57.356210947 CEST	443	49756	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:57.356266975 CEST	49756	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:57.356308937 CEST	49756	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:57.356321096 CEST	443	49756	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:57.356333017 CEST	49756	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:57.356339931 CEST	443	49756	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:57.358481884 CEST	49762	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:57.358571053 CEST	443	49762	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:57.358664989 CEST	49762	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:57.358772993 CEST	49762	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:57.358813047 CEST	443	49762	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:57.372555017 CEST	443	49757	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:57.372611046 CEST	443	49757	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:57.372670889 CEST	49757	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:57.372740030 CEST	49757	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:57.372761965 CEST	443	49757	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:57.372816086 CEST	49757	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:57.372829914 CEST	443	49757	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:57.374627113 CEST	49763	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:57.374656916 CEST	443	49763	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:57.374727011 CEST	49763	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:57.374842882 CEST	49763	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:57.374855042 CEST	443	49763	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:57.380671024 CEST	443	49758	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:57.380757093 CEST	443	49758	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:57.380824089 CEST	49758	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:57.380889893 CEST	49758	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:57.380908012 CEST	443	49758	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:57.380932093 CEST	49758	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:57.380944014 CEST	443	49758	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:57.382608891 CEST	49764	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:57.382642984 CEST	443	49764	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:57.382704973 CEST	49764	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:57.382813931 CEST	49764	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:57.382826090 CEST	443	49764	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:57.397397995 CEST	443	49760	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:57.397459030 CEST	443	49760	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:57.397507906 CEST	49760	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:57.397633076 CEST	49760	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:57.397645950 CEST	443	49760	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:57.397656918 CEST	49760	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:57.397663116 CEST	443	49760	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:57.399523020 CEST	49765	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:57.399569988 CEST	443	49765	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:57.399650097 CEST	49765	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:57.399815083 CEST	49765	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:57.399890900 CEST	443	49765	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:57.951972961 CEST	443	49761	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:57.998564005 CEST	49761	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.004672050 CEST	443	49762	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.020406961 CEST	443	49763	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.024586916 CEST	49761	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.024625063 CEST	443	49761	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.025068998 CEST	49761	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.025083065 CEST	443	49761	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.025553942 CEST	49762	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.025583029 CEST	443	49762	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.025898933 CEST	49762	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.025909901 CEST	443	49762	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.026019096 CEST	49763	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.026042938 CEST	443	49763	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.026431084 CEST	49763	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.026436090 CEST	443	49763	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.034239054 CEST	443	49764	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.034792900 CEST	49764	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.034806013 CEST	443	49764	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.035203934 CEST	49764	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.035208941 CEST	443	49764	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.048856974 CEST	443	49765	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.049228907 CEST	49765	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.049276114 CEST	443	49765	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.049637079 CEST	49765	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.049649954 CEST	443	49765	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.117181063 CEST	443	49761	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.117244959 CEST	443	49761	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.117302895 CEST	49761	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.117517948 CEST	49761	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.117517948 CEST	49761	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.117554903 CEST	443	49761	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.117578030 CEST	443	49761	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.120176077 CEST	49766	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.120249987 CEST	443	49766	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.120331049 CEST	49766	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.120464087 CEST	49766	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.120480061 CEST	443	49766	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.121143103 CEST	443	49762	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.121289015 CEST	443	49762	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.121342897 CEST	49762	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.123971939 CEST	443	49763	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.124007940 CEST	443	49763	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.124053955 CEST	49763	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.124093056 CEST	49762	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.124109983 CEST	443	49762	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.124133110 CEST	49762	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.124146938 CEST	443	49762	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.124223948 CEST	49763	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.124243021 CEST	443	49763	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.124257088 CEST	49763	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.124263048 CEST	443	49763	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.135310888 CEST	443	49764	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.135493040 CEST	443	49764	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.135559082 CEST	49764	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.145220041 CEST	49764	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.145240068 CEST	443	49764	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.145279884 CEST	49764	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.145287037 CEST	443	49764	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.151164055 CEST	443	49765	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.151315928 CEST	443	49765	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.151374102 CEST	49765	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.153383017 CEST	49765	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.153403044 CEST	443	49765	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.153414011 CEST	49765	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.153419971 CEST	443	49765	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.157718897 CEST	49767	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.157768965 CEST	443	49767	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.157845020 CEST	49767	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.160769939 CEST	49767	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.160806894 CEST	443	49767	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.174467087 CEST	49768	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.174495935 CEST	443	49768	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.174571991 CEST	49768	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.181938887 CEST	49769	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.182025909 CEST	443	49769	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.182112932 CEST	49769	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.185661077 CEST	49770	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.185683966 CEST	443	49770	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.185760975 CEST	49770	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.185834885 CEST	49768	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.185854912 CEST	443	49768	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.188941956 CEST	49769	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.188972950 CEST	443	49769	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.189017057 CEST	49770	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.189040899 CEST	443	49770	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.730751991 CEST	443	49766	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.731306076 CEST	49766	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.731328011 CEST	443	49766	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.731904030 CEST	49766	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.731911898 CEST	443	49766	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.809736013 CEST	443	49769	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.810193062 CEST	49769	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.810237885 CEST	443	49769	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.810659885 CEST	49769	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.810674906 CEST	443	49769	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.814970016 CEST	443	49768	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.815279961 CEST	49768	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.815291882 CEST	443	49768	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.815622091 CEST	49768	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.815625906 CEST	443	49768	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.819542885 CEST	443	49770	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.819799900 CEST	49770	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.819817066 CEST	443	49770	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.820112944 CEST	49770	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.820122957 CEST	443	49770	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.821933985 CEST	443	49767	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.822161913 CEST	49767	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.822180033 CEST	443	49767	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.822454929 CEST	49767	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.822460890 CEST	443	49767	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.825815916 CEST	443	49766	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.825896978 CEST	443	49766	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.825951099 CEST	49766	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.826085091 CEST	49766	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.826112032 CEST	443	49766	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.826126099 CEST	49766	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.826133013 CEST	443	49766	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.829238892 CEST	49771	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.829277039 CEST	443	49771	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.829365969 CEST	49771	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.830229998 CEST	49771	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.830246925 CEST	443	49771	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.907507896 CEST	443	49769	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.907571077 CEST	443	49769	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.907638073 CEST	49769	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.907821894 CEST	49769	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.907850981 CEST	443	49769	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.907900095 CEST	49769	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.907915115 CEST	443	49769	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.910497904 CEST	49772	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.910538912 CEST	443	49772	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.910615921 CEST	49772	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.910774946 CEST	49772	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.910780907 CEST	443	49772	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.914721012 CEST	443	49768	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.914799929 CEST	443	49768	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.914858103 CEST	49768	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.914961100 CEST	49768	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.914977074 CEST	443	49768	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.914987087 CEST	49768	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.914992094 CEST	443	49768	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.917104006 CEST	49773	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.917160988 CEST	443	49773	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.917251110 CEST	49773	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.917393923 CEST	49773	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.917418957 CEST	443	49773	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.918646097 CEST	443	49767	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.918715954 CEST	443	49767	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.918768883 CEST	49767	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.918828964 CEST	49767	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.918847084 CEST	443	49767	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.918859005 CEST	49767	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.918864965 CEST	443	49767	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.920118093 CEST	443	49770	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.920270920 CEST	443	49770	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.920360088 CEST	49770	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.920393944 CEST	49770	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.920393944 CEST	49770	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.920413017 CEST	443	49770	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.920433998 CEST	443	49770	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.920783997 CEST	49774	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.920804024 CEST	443	49774	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.920886040 CEST	49774	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.921030045 CEST	49774	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.921053886 CEST	443	49774	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.922400951 CEST	49775	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.922416925 CEST	443	49775	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:58.922477961 CEST	49775	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.922594070 CEST	49775	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:58.922597885 CEST	443	49775	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:59.687151909 CEST	443	49772	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:59.687752962 CEST	49772	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:59.687827110 CEST	443	49772	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:59.688273907 CEST	49772	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:59.688292027 CEST	443	49772	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:59.768560886 CEST	443	49773	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:59.770206928 CEST	49773	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:59.770231009 CEST	443	49773	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:59.770742893 CEST	49773	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:59.770747900 CEST	443	49773	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:59.775923967 CEST	443	49771	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:59.776087046 CEST	443	49774	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:59.776422024 CEST	49771	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:59.776444912 CEST	443	49771	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:59.776834011 CEST	49771	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:59.776842117 CEST	443	49771	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:59.777159929 CEST	49774	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:59.777173996 CEST	443	49774	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:59.777554989 CEST	49774	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:59.777559996 CEST	443	49774	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:59.777734995 CEST	443	49775	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:59.778166056 CEST	49775	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:59.778176069 CEST	443	49775	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:59.778543949 CEST	49775	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:59.778548956 CEST	443	49775	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:59.782771111 CEST	443	49772	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:59.782831907 CEST	443	49772	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:59.782922983 CEST	49772	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:59.783086061 CEST	49772	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:59.783102036 CEST	443	49772	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:59.783113003 CEST	49772	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:59.783118010 CEST	443	49772	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:59.785943031 CEST	49776	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:59.785970926 CEST	443	49776	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:59.786053896 CEST	49776	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:59.786292076 CEST	49776	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:59.786312103 CEST	443	49776	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:59.863574028 CEST	443	49773	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:59.863635063 CEST	443	49773	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:59.863909006 CEST	49773	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:59.863971949 CEST	49773	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:59.863972902 CEST	49773	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:59.864013910 CEST	443	49773	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:59.864042044 CEST	443	49773	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:59.866610050 CEST	49777	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:59.866645098 CEST	443	49777	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:59.866724014 CEST	49777	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:59.866877079 CEST	49777	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:59.866889000 CEST	443	49777	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:59.878344059 CEST	443	49771	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:59.878385067 CEST	443	49771	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:59.878464937 CEST	443	49774	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:59.878515959 CEST	443	49774	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:59.878532887 CEST	49771	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:59.878566027 CEST	49774	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:59.878612995 CEST	49771	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:59.878616095 CEST	443	49775	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:59.878627062 CEST	443	49771	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:59.878643036 CEST	49771	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:59.878648996 CEST	443	49771	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:59.878675938 CEST	49774	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:59.878688097 CEST	443	49774	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:59.878711939 CEST	49774	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:59.878722906 CEST	443	49774	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:59.878761053 CEST	443	49775	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:59.878818989 CEST	49775	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:59.879566908 CEST	49775	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:59.879570961 CEST	443	49775	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:59.879580975 CEST	49775	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:59.879585981 CEST	443	49775	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:59.881449938 CEST	49778	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:59.881463051 CEST	443	49778	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:59.881534100 CEST	49778	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:59.881678104 CEST	49779	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:59.881686926 CEST	443	49779	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:59.881781101 CEST	49779	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:59.881899118 CEST	49778	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:59.881911993 CEST	443	49778	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:59.882003069 CEST	49780	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:59.882039070 CEST	49779	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:59.882041931 CEST	443	49780	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:59.882050991 CEST	443	49779	13.107.246.45	192.168.2.4
Oct 7, 2024 23:30:59.882111073 CEST	49780	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:59.882208109 CEST	49780	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:30:59.882217884 CEST	443	49780	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:00.426884890 CEST	443	49776	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:00.427362919 CEST	49776	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:00.427381992 CEST	443	49776	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:00.427825928 CEST	49776	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:00.427829981 CEST	443	49776	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:00.477966070 CEST	443	49777	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:00.478502035 CEST	49777	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:00.478519917 CEST	443	49777	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:00.479011059 CEST	49777	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:00.479017973 CEST	443	49777	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:00.491868019 CEST	443	49780	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:00.492218971 CEST	443	49778	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:00.492278099 CEST	49780	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:00.492327929 CEST	443	49780	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:00.492455959 CEST	49778	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:00.492477894 CEST	443	49778	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:00.492841959 CEST	49778	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:00.492850065 CEST	443	49778	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:00.492927074 CEST	49780	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:00.492945910 CEST	443	49780	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:00.507133961 CEST	443	49779	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:00.507476091 CEST	49779	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:00.507493019 CEST	443	49779	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:00.508008957 CEST	49779	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:00.508013964 CEST	443	49779	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:00.534210920 CEST	443	49776	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:00.534367085 CEST	443	49776	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:00.534543037 CEST	49776	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:00.534574032 CEST	49776	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:00.534588099 CEST	443	49776	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:00.534600973 CEST	49776	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:00.534605980 CEST	443	49776	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:00.538081884 CEST	49781	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:00.538121939 CEST	443	49781	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:00.538274050 CEST	49781	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:00.538393021 CEST	49781	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:00.538399935 CEST	443	49781	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:00.599468946 CEST	443	49777	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:00.599522114 CEST	443	49777	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:00.599590063 CEST	49777	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:00.599827051 CEST	49777	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:00.599848032 CEST	443	49777	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:00.599862099 CEST	49777	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:00.599869967 CEST	443	49777	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:00.602734089 CEST	443	49778	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:00.602799892 CEST	443	49778	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:00.602857113 CEST	49778	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:00.603221893 CEST	49782	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:00.603259087 CEST	443	49782	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:00.603319883 CEST	49782	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:00.603456974 CEST	49778	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:00.603463888 CEST	443	49778	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:00.603477955 CEST	49778	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:00.603485107 CEST	443	49778	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:00.603776932 CEST	443	49780	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:00.603851080 CEST	443	49780	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:00.603903055 CEST	49780	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:00.604605913 CEST	49780	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:00.604656935 CEST	443	49780	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:00.604688883 CEST	49780	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:00.604707956 CEST	443	49780	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:00.605645895 CEST	49782	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:00.605668068 CEST	443	49782	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:00.607321978 CEST	443	49779	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:00.607400894 CEST	443	49779	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:00.607459068 CEST	49779	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:00.607613087 CEST	49779	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:00.607618093 CEST	443	49779	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:00.607779026 CEST	49783	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:00.607839108 CEST	443	49783	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:00.607923031 CEST	49783	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:00.608294964 CEST	49783	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:00.608330011 CEST	443	49783	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:00.610553026 CEST	49784	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:00.610625982 CEST	443	49784	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:00.610708952 CEST	49784	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:00.611138105 CEST	49784	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:00.611170053 CEST	443	49784	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:00.611901045 CEST	49785	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:00.611938000 CEST	443	49785	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:00.612160921 CEST	49785	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:00.612351894 CEST	49785	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:00.612370014 CEST	443	49785	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:01.204461098 CEST	443	49781	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:01.207160950 CEST	49781	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:01.207174063 CEST	443	49781	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:01.207643986 CEST	49781	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:01.207649946 CEST	443	49781	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:01.212918997 CEST	443	49785	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:01.213334084 CEST	49785	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:01.213365078 CEST	443	49785	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:01.213757992 CEST	49785	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:01.213764906 CEST	443	49785	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:01.282377958 CEST	443	49782	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:01.283009052 CEST	443	49784	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:01.285123110 CEST	49782	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:01.285152912 CEST	443	49782	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:01.285471916 CEST	49782	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:01.285478115 CEST	443	49782	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:01.285691977 CEST	49784	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:01.285725117 CEST	443	49784	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:01.289918900 CEST	49784	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:01.289937973 CEST	443	49784	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:01.300632954 CEST	443	49781	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:01.300694942 CEST	443	49781	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:01.300764084 CEST	49781	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:01.301500082 CEST	49781	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:01.301517963 CEST	443	49781	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:01.301531076 CEST	49781	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:01.301536083 CEST	443	49781	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:01.305088997 CEST	443	49783	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:01.305295944 CEST	49786	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:01.305346012 CEST	443	49786	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:01.305421114 CEST	49786	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:01.305943012 CEST	49783	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:01.305963993 CEST	443	49783	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:01.306663036 CEST	49783	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:01.306668997 CEST	443	49783	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:01.306883097 CEST	49786	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:01.306901932 CEST	443	49786	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:01.312916994 CEST	443	49785	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:01.312984943 CEST	443	49785	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:01.313041925 CEST	49785	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:01.313175917 CEST	49785	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:01.313189983 CEST	443	49785	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:01.313203096 CEST	49785	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:01.313209057 CEST	443	49785	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:01.324987888 CEST	49787	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:01.325037956 CEST	443	49787	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:01.325220108 CEST	49787	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:01.327445030 CEST	49787	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:01.327472925 CEST	443	49787	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:01.379635096 CEST	443	49782	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:01.379704952 CEST	443	49782	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:01.379750013 CEST	49782	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:01.380017996 CEST	49782	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:01.380033016 CEST	443	49782	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:01.380045891 CEST	49782	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:01.380050898 CEST	443	49782	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:01.383276939 CEST	49788	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:01.383366108 CEST	443	49788	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:01.383454084 CEST	49788	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:01.383631945 CEST	49788	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:01.383666992 CEST	443	49788	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:01.384084940 CEST	443	49784	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:01.384244919 CEST	443	49784	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:01.384320021 CEST	49784	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:01.384385109 CEST	49784	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:01.384385109 CEST	49784	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:01.384424925 CEST	443	49784	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:01.384453058 CEST	443	49784	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:01.386418104 CEST	49789	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:01.386451960 CEST	443	49789	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:01.386531115 CEST	49789	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:01.386678934 CEST	49789	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:01.386693954 CEST	443	49789	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:01.406222105 CEST	443	49783	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:01.406299114 CEST	443	49783	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:01.406383038 CEST	49783	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:01.406548023 CEST	49783	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:01.406563997 CEST	443	49783	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:01.406601906 CEST	49783	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:01.406606913 CEST	443	49783	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:01.409214020 CEST	49790	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:01.409240961 CEST	443	49790	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:01.409306049 CEST	49790	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:01.409447908 CEST	49790	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:01.409463882 CEST	443	49790	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:01.988239050 CEST	443	49786	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:01.988925934 CEST	49786	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:01.988986969 CEST	443	49786	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:01.989392042 CEST	49786	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:01.989407063 CEST	443	49786	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:02.063162088 CEST	443	49788	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:02.063687086 CEST	49788	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:02.063754082 CEST	443	49788	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:02.064169884 CEST	49788	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:02.064186096 CEST	443	49788	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:02.068936110 CEST	443	49790	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:02.069468021 CEST	49790	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:02.069487095 CEST	443	49790	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:02.069912910 CEST	443	49787	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:02.070085049 CEST	49790	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:02.070094109 CEST	443	49790	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:02.070427895 CEST	49787	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:02.070465088 CEST	443	49787	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:02.070939064 CEST	49787	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:02.070950985 CEST	443	49787	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:02.072803020 CEST	443	49789	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:02.073097944 CEST	49789	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:02.073106050 CEST	443	49789	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:02.073613882 CEST	49789	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:02.073618889 CEST	443	49789	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:02.089644909 CEST	443	49786	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:02.089802980 CEST	443	49786	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:02.089886904 CEST	49786	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:02.091813087 CEST	49786	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:02.091833115 CEST	443	49786	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:02.091844082 CEST	49786	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:02.091849089 CEST	443	49786	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:02.096057892 CEST	49791	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:02.096126080 CEST	443	49791	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:02.096240044 CEST	49791	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:02.096400976 CEST	49791	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:02.096415997 CEST	443	49791	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:02.158541918 CEST	443	49788	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:02.158597946 CEST	443	49788	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:02.158682108 CEST	49788	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:02.158847094 CEST	49788	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:02.158878088 CEST	443	49788	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:02.158904076 CEST	49788	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:02.158919096 CEST	443	49788	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:02.161899090 CEST	49792	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:02.161926031 CEST	443	49792	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:02.161993027 CEST	49792	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:02.162195921 CEST	49792	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:02.162209034 CEST	443	49792	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:02.166171074 CEST	443	49790	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:02.166244984 CEST	443	49790	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:02.166301966 CEST	49790	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:02.166481018 CEST	49790	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:02.166481018 CEST	49790	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:02.166495085 CEST	443	49790	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:02.166503906 CEST	443	49790	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:02.168894053 CEST	443	49787	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:02.168943882 CEST	443	49787	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:02.169032097 CEST	49787	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:02.169260025 CEST	49793	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:02.169305086 CEST	443	49793	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:02.169378996 CEST	49793	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:02.169526100 CEST	49793	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:02.169554949 CEST	443	49793	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:02.169573069 CEST	49787	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:02.169573069 CEST	49787	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:02.169601917 CEST	443	49787	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:02.169626951 CEST	443	49787	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:02.171658039 CEST	49794	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:02.171677113 CEST	443	49794	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:02.171762943 CEST	49794	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:02.171843052 CEST	49794	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:02.171869040 CEST	443	49794	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:02.172332048 CEST	443	49789	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:02.172403097 CEST	443	49789	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:02.172458887 CEST	49789	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:02.172493935 CEST	49789	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:02.172498941 CEST	443	49789	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:02.172530890 CEST	49789	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:02.172535896 CEST	443	49789	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:02.174612045 CEST	49795	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:02.174623013 CEST	443	49795	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:02.174680948 CEST	49795	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:02.174844980 CEST	49795	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:02.174854040 CEST	443	49795	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:02.749820948 CEST	443	49791	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:02.750395060 CEST	49791	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:02.750423908 CEST	443	49791	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:02.750885010 CEST	49791	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:02.750890017 CEST	443	49791	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:02.777518988 CEST	443	49793	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:02.778068066 CEST	49793	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:02.778105974 CEST	443	49793	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:02.778505087 CEST	49793	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:02.778512955 CEST	443	49793	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:02.783833027 CEST	443	49792	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:02.784163952 CEST	49792	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:02.784185886 CEST	443	49792	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:02.784466028 CEST	49792	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:02.784471035 CEST	443	49792	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:03.840322971 CEST	443	49791	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:03.840368986 CEST	443	49792	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:03.840414047 CEST	443	49791	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:03.840425014 CEST	443	49792	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:03.840504885 CEST	443	49793	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:03.840514898 CEST	49792	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:03.840519905 CEST	49791	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:03.840605974 CEST	443	49793	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:03.840660095 CEST	49793	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:03.842091084 CEST	443	49795	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:03.842439890 CEST	443	49794	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:03.881910086 CEST	49723	80	192.168.2.4	199.232.214.172
Oct 7, 2024 23:31:03.886580944 CEST	49724	80	192.168.2.4	199.232.214.172
Oct 7, 2024 23:31:03.889137030 CEST	49795	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:03.889147997 CEST	49794	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:03.889744043 CEST	80	49723	199.232.214.172	192.168.2.4
Oct 7, 2024 23:31:03.889805079 CEST	49723	80	192.168.2.4	199.232.214.172
Oct 7, 2024 23:31:03.891661882 CEST	80	49724	199.232.214.172	192.168.2.4
Oct 7, 2024 23:31:03.891726971 CEST	49724	80	192.168.2.4	199.232.214.172
Oct 7, 2024 23:31:04.054279089 CEST	49794	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.054303885 CEST	443	49794	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.054766893 CEST	49794	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.054775953 CEST	443	49794	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.054979086 CEST	49795	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.055003881 CEST	443	49795	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.055319071 CEST	49795	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.055324078 CEST	443	49795	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.055514097 CEST	49791	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.055514097 CEST	49791	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.055568933 CEST	443	49791	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.055597067 CEST	443	49791	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.056886911 CEST	49792	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.056902885 CEST	443	49792	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.056915998 CEST	49792	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.056921005 CEST	443	49792	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.057986975 CEST	49793	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.058002949 CEST	443	49793	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.058017015 CEST	49793	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.058023930 CEST	443	49793	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.067914009 CEST	49796	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.067944050 CEST	443	49796	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.068226099 CEST	49796	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.068912983 CEST	49796	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.068927050 CEST	443	49796	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.069180965 CEST	49797	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.069216013 CEST	443	49797	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.069406986 CEST	49797	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.069406986 CEST	49797	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.069442034 CEST	443	49797	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.070795059 CEST	49798	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.070815086 CEST	443	49798	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.070972919 CEST	49798	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.071317911 CEST	49798	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.071332932 CEST	443	49798	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.147253036 CEST	443	49794	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.147559881 CEST	443	49794	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.147659063 CEST	49794	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.149672031 CEST	443	49795	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.149725914 CEST	49794	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.149739981 CEST	443	49794	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.149755001 CEST	49794	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.149761915 CEST	443	49794	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.150003910 CEST	443	49795	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.150048971 CEST	49795	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.152786970 CEST	49795	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.152803898 CEST	443	49795	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.152817965 CEST	49795	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.152823925 CEST	443	49795	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.155766010 CEST	49799	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.155798912 CEST	443	49799	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.155877113 CEST	49799	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.160972118 CEST	49799	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.161001921 CEST	443	49799	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.171160936 CEST	49800	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.171212912 CEST	443	49800	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.171288013 CEST	49800	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.175260067 CEST	49800	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.175283909 CEST	443	49800	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.679680109 CEST	443	49797	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.679729939 CEST	443	49796	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.680320978 CEST	49796	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.680336952 CEST	443	49796	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.680435896 CEST	49797	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.680452108 CEST	443	49797	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.680802107 CEST	49796	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.680807114 CEST	443	49796	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.681097984 CEST	49797	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.681107998 CEST	443	49797	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.686739922 CEST	443	49798	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.687073946 CEST	49798	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.687086105 CEST	443	49798	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.687403917 CEST	49798	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.687410116 CEST	443	49798	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.775547981 CEST	443	49796	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.775624037 CEST	443	49796	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.775701046 CEST	49796	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.776031017 CEST	49796	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.776046038 CEST	443	49796	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.776057005 CEST	49796	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.776062012 CEST	443	49796	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.777259111 CEST	443	49797	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.777317047 CEST	443	49797	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.777379990 CEST	49797	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.777546883 CEST	49797	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.777559996 CEST	443	49797	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.777584076 CEST	49797	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.777590036 CEST	443	49797	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.779859066 CEST	49801	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.779894114 CEST	443	49801	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.779975891 CEST	49801	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.780611038 CEST	49802	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.780620098 CEST	443	49802	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.780683041 CEST	49802	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.780869961 CEST	49801	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.780886889 CEST	443	49801	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.781001091 CEST	49802	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.781009912 CEST	443	49802	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.789664030 CEST	443	49798	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.789735079 CEST	443	49798	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.789784908 CEST	49798	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.789890051 CEST	49798	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.789890051 CEST	49798	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.789899111 CEST	443	49798	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.789906979 CEST	443	49798	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.792193890 CEST	49803	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.792227030 CEST	443	49803	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.792465925 CEST	49803	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.792515039 CEST	49803	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.792525053 CEST	443	49803	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.821157932 CEST	443	49800	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.821774006 CEST	49800	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.821795940 CEST	443	49800	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.822144985 CEST	49800	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.822150946 CEST	443	49800	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.828504086 CEST	443	49799	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.828922033 CEST	49799	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.828929901 CEST	443	49799	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.829325914 CEST	49799	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.829349041 CEST	443	49799	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.927367926 CEST	443	49800	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.927448988 CEST	443	49800	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.927570105 CEST	49800	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.927829981 CEST	49800	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.927829981 CEST	49800	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.927853107 CEST	443	49800	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.927864075 CEST	443	49800	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.931452990 CEST	49804	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.931498051 CEST	443	49804	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.931667089 CEST	49804	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.931969881 CEST	49804	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.931984901 CEST	443	49804	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.932212114 CEST	443	49799	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.932349920 CEST	443	49799	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.932420015 CEST	49799	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.932498932 CEST	49799	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.932516098 CEST	443	49799	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.932528019 CEST	49799	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.932533026 CEST	443	49799	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.934946060 CEST	49805	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.934983969 CEST	443	49805	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:04.935067892 CEST	49805	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.935255051 CEST	49805	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:04.935270071 CEST	443	49805	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:05.422982931 CEST	443	49802	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:05.423801899 CEST	49802	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:05.423827887 CEST	443	49802	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:05.424314976 CEST	49802	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:05.424320936 CEST	443	49802	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:05.445323944 CEST	443	49801	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:05.445717096 CEST	49801	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:05.445755005 CEST	443	49801	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:05.446187973 CEST	49801	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:05.446194887 CEST	443	49801	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:05.449516058 CEST	443	49803	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:05.449841022 CEST	49803	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:05.449870110 CEST	443	49803	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:05.450239897 CEST	49803	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:05.450247049 CEST	443	49803	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:05.519696951 CEST	443	49802	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:05.519762993 CEST	443	49802	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:05.519819975 CEST	49802	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:05.520003080 CEST	49802	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:05.520020008 CEST	443	49802	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:05.520031929 CEST	49802	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:05.520039082 CEST	443	49802	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:05.523063898 CEST	49806	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:05.523102045 CEST	443	49806	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:05.523186922 CEST	49806	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:05.523350000 CEST	49806	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:05.523365974 CEST	443	49806	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:05.540935040 CEST	443	49804	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:05.541290998 CEST	49804	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:05.541316032 CEST	443	49804	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:05.541697025 CEST	49804	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:05.541702032 CEST	443	49804	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:05.544476986 CEST	443	49801	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:05.544550896 CEST	443	49801	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:05.544611931 CEST	49801	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:05.544724941 CEST	49801	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:05.544724941 CEST	49801	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:05.544739008 CEST	443	49801	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:05.544749975 CEST	443	49801	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:05.546993971 CEST	49807	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:05.547012091 CEST	443	49807	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:05.547081947 CEST	49807	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:05.547194958 CEST	49807	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:05.547204018 CEST	443	49807	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:05.547646046 CEST	443	49805	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:05.547929049 CEST	49805	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:05.547946930 CEST	443	49805	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:05.548409939 CEST	49805	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:05.548415899 CEST	443	49805	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:05.598337889 CEST	443	49803	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:05.598406076 CEST	443	49803	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:05.598583937 CEST	49803	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:05.602381945 CEST	49803	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:05.602404118 CEST	443	49803	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:05.602447987 CEST	49803	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:05.602456093 CEST	443	49803	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:05.605181932 CEST	49808	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:05.605205059 CEST	443	49808	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:05.605341911 CEST	49808	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:05.605585098 CEST	49808	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:05.605597019 CEST	443	49808	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:05.637667894 CEST	443	49804	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:05.637738943 CEST	443	49804	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:05.637840986 CEST	49804	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:05.637985945 CEST	49804	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:05.637995958 CEST	443	49804	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:05.638005018 CEST	49804	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:05.638009071 CEST	443	49804	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:05.639967918 CEST	49809	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:05.640017986 CEST	443	49809	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:05.640088081 CEST	49809	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:05.640192032 CEST	49809	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:05.640208960 CEST	443	49809	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:05.643182039 CEST	443	49805	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:05.643321991 CEST	443	49805	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:05.643379927 CEST	49805	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:05.643416882 CEST	49805	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:05.643416882 CEST	49805	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:05.643430948 CEST	443	49805	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:05.643441916 CEST	443	49805	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:05.645015955 CEST	49810	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:05.645026922 CEST	443	49810	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:05.645087957 CEST	49810	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:05.645190001 CEST	49810	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:05.645201921 CEST	443	49810	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:06.172084093 CEST	443	49807	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:06.172616959 CEST	49807	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:06.172635078 CEST	443	49807	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:06.173053026 CEST	49807	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:06.173058033 CEST	443	49807	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:06.183943987 CEST	443	49806	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:06.184334993 CEST	49806	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:06.184367895 CEST	443	49806	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:06.184700966 CEST	49806	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:06.184706926 CEST	443	49806	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:06.260293961 CEST	443	49809	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:06.260848045 CEST	49809	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:06.260876894 CEST	443	49809	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:06.261334896 CEST	49809	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:06.261348009 CEST	443	49809	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:06.275892973 CEST	443	49807	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:06.275958061 CEST	443	49807	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:06.276038885 CEST	49807	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:06.278517008 CEST	49807	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:06.278529882 CEST	443	49807	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:06.278538942 CEST	49807	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:06.278543949 CEST	443	49807	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:06.278878927 CEST	443	49808	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:06.279359102 CEST	49808	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:06.279369116 CEST	443	49808	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:06.279882908 CEST	49808	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:06.279887915 CEST	443	49808	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:06.282855988 CEST	49811	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:06.282872915 CEST	443	49811	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:06.282951117 CEST	49811	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:06.283085108 CEST	49811	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:06.283092022 CEST	443	49811	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:06.284136057 CEST	443	49806	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:06.284239054 CEST	443	49806	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:06.284302950 CEST	49806	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:06.284343004 CEST	49806	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:06.284343958 CEST	49806	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:06.284360886 CEST	443	49806	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:06.284370899 CEST	443	49806	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:06.286370993 CEST	49812	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:06.286405087 CEST	443	49812	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:06.286488056 CEST	49812	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:06.286570072 CEST	49812	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:06.286581993 CEST	443	49812	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:06.296921015 CEST	443	49810	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:06.297326088 CEST	49810	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:06.297338963 CEST	443	49810	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:06.297801018 CEST	49810	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:06.297806025 CEST	443	49810	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:06.358097076 CEST	443	49809	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:06.358171940 CEST	443	49809	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:06.358217001 CEST	49809	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:06.358531952 CEST	49809	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:06.358555079 CEST	443	49809	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:06.358567953 CEST	49809	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:06.358575106 CEST	443	49809	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:06.361736059 CEST	49813	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:06.361767054 CEST	443	49813	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:06.361896038 CEST	49813	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:06.361968040 CEST	49813	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:06.361974955 CEST	443	49813	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:06.381057024 CEST	443	49808	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:06.381139994 CEST	443	49808	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:06.381185055 CEST	49808	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:06.381298065 CEST	49808	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:06.381298065 CEST	49808	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:06.381316900 CEST	443	49808	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:06.381325006 CEST	443	49808	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:06.383629084 CEST	49814	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:06.383645058 CEST	443	49814	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:06.383810997 CEST	49814	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:06.383882046 CEST	49814	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:06.383893967 CEST	443	49814	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:06.396912098 CEST	443	49810	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:06.396964073 CEST	443	49810	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:06.397007942 CEST	49810	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:06.397099018 CEST	49810	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:06.397114992 CEST	443	49810	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:06.397125006 CEST	49810	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:06.397130013 CEST	443	49810	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:06.398871899 CEST	49815	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:06.398912907 CEST	443	49815	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:06.398976088 CEST	49815	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:06.399066925 CEST	49815	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:06.399082899 CEST	443	49815	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:06.898519039 CEST	443	49811	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:06.899262905 CEST	49811	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:06.899276972 CEST	443	49811	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:06.899844885 CEST	49811	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:06.899856091 CEST	443	49811	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:06.931729078 CEST	443	49812	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:06.932265043 CEST	49812	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:06.932329893 CEST	443	49812	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:06.932651997 CEST	49812	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:06.932667971 CEST	443	49812	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:06.984432936 CEST	443	49813	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:06.985253096 CEST	49813	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:06.985265017 CEST	443	49813	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:06.985732079 CEST	49813	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:06.985738039 CEST	443	49813	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:06.994735956 CEST	443	49814	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:06.995251894 CEST	49814	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:06.995259047 CEST	443	49814	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:06.995527983 CEST	49814	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:06.995532990 CEST	443	49814	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:06.997040033 CEST	443	49811	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:06.997126102 CEST	443	49811	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:06.997181892 CEST	49811	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:06.997354984 CEST	49811	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:06.997371912 CEST	443	49811	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:06.997965097 CEST	49811	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:06.997971058 CEST	443	49811	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.000669956 CEST	49816	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.000713110 CEST	443	49816	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.000808001 CEST	49816	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.000999928 CEST	49816	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.001018047 CEST	443	49816	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.017045975 CEST	443	49815	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.017452955 CEST	49815	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.017496109 CEST	443	49815	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.017827034 CEST	49815	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.017841101 CEST	443	49815	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.033312082 CEST	443	49812	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.033382893 CEST	443	49812	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.033453941 CEST	49812	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.033615112 CEST	49812	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.033615112 CEST	49812	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.033654928 CEST	443	49812	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.033682108 CEST	443	49812	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.036336899 CEST	49817	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.036348104 CEST	443	49817	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.036428928 CEST	49817	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.036633968 CEST	49817	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.036648035 CEST	443	49817	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.084579945 CEST	443	49813	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.084656954 CEST	443	49813	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.084768057 CEST	49813	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.085253000 CEST	49813	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.085253000 CEST	49813	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.085269928 CEST	443	49813	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.085288048 CEST	443	49813	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.088152885 CEST	49818	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.088167906 CEST	443	49818	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.088252068 CEST	49818	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.088474989 CEST	49818	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.088488102 CEST	443	49818	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.090713024 CEST	443	49814	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.090874910 CEST	443	49814	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.090970039 CEST	49814	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.090970039 CEST	49814	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.090991020 CEST	49814	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.090996027 CEST	443	49814	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.093431950 CEST	49819	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.093473911 CEST	443	49819	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.093554020 CEST	49819	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.093684912 CEST	49819	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.093704939 CEST	443	49819	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.115545988 CEST	443	49815	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.115603924 CEST	443	49815	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.115659952 CEST	49815	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.115835905 CEST	49815	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.115835905 CEST	49815	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.115868092 CEST	443	49815	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.115892887 CEST	443	49815	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.118760109 CEST	49820	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.118808985 CEST	443	49820	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.118875027 CEST	49820	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.119060993 CEST	49820	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.119069099 CEST	443	49820	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.610146046 CEST	443	49816	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.610692024 CEST	49816	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.610738993 CEST	443	49816	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.611118078 CEST	49816	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.611131907 CEST	443	49816	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.643996954 CEST	443	49817	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.644428968 CEST	49817	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.644447088 CEST	443	49817	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.644829988 CEST	49817	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.644835949 CEST	443	49817	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.691248894 CEST	443	49818	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.691754103 CEST	49818	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.691778898 CEST	443	49818	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.692207098 CEST	49818	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.692212105 CEST	443	49818	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.720324039 CEST	443	49816	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.720410109 CEST	443	49816	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.720830917 CEST	49816	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.720830917 CEST	49816	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.720830917 CEST	49816	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.722162962 CEST	443	49819	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.722735882 CEST	49819	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.722748995 CEST	443	49819	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.723340034 CEST	49819	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.723346949 CEST	443	49819	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.725429058 CEST	49821	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.725455999 CEST	443	49821	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.725728035 CEST	49821	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.725728035 CEST	49821	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.725764036 CEST	443	49821	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.727538109 CEST	443	49820	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.727958918 CEST	49820	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.727996111 CEST	443	49820	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.728342056 CEST	49820	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.728348970 CEST	443	49820	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.739013910 CEST	443	49817	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.739088058 CEST	443	49817	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.739152908 CEST	49817	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.739208937 CEST	49817	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.739223957 CEST	443	49817	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.739234924 CEST	49817	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.739239931 CEST	443	49817	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.742088079 CEST	49822	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.742111921 CEST	443	49822	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.742221117 CEST	49822	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.742469072 CEST	49822	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.742486954 CEST	443	49822	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.806008101 CEST	443	49818	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.806061983 CEST	443	49818	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.806140900 CEST	49818	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.806397915 CEST	49818	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.806402922 CEST	443	49818	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.806423903 CEST	49818	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.806427002 CEST	443	49818	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.809377909 CEST	49823	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.809401989 CEST	443	49823	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.809488058 CEST	49823	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.809703112 CEST	49823	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.809708118 CEST	443	49823	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.817600012 CEST	443	49819	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.817764044 CEST	443	49819	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.817841053 CEST	49819	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.817873955 CEST	49819	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.817893028 CEST	443	49819	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.817903996 CEST	49819	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.817909956 CEST	443	49819	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.820341110 CEST	49824	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.820348978 CEST	443	49824	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.820427895 CEST	49824	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.820625067 CEST	49824	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.820635080 CEST	443	49824	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.824059010 CEST	443	49820	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.824105978 CEST	443	49820	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.824151039 CEST	49820	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.824282885 CEST	49820	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.824291945 CEST	443	49820	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.824301004 CEST	49820	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.824305058 CEST	443	49820	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.826210022 CEST	49825	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.826226950 CEST	443	49825	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:07.826486111 CEST	49825	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.826486111 CEST	49825	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:07.826513052 CEST	443	49825	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:08.029788971 CEST	49816	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:08.029798985 CEST	443	49816	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:08.367861032 CEST	443	49821	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:08.377528906 CEST	49821	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:08.377542973 CEST	443	49821	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:08.378205061 CEST	49821	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:08.378211975 CEST	443	49821	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:08.402350903 CEST	443	49822	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:08.402812958 CEST	49822	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:08.402833939 CEST	443	49822	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:08.403348923 CEST	49822	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:08.403359890 CEST	443	49822	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:08.433510065 CEST	443	49825	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:08.434081078 CEST	49825	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:08.434089899 CEST	443	49825	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:08.434526920 CEST	49825	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:08.434537888 CEST	443	49825	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:08.443494081 CEST	443	49823	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:08.444010019 CEST	49823	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:08.444037914 CEST	443	49823	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:08.444755077 CEST	49823	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:08.444758892 CEST	443	49823	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:08.474029064 CEST	443	49824	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:08.474492073 CEST	49824	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:08.474554062 CEST	443	49824	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:08.474673033 CEST	443	49821	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:08.474699020 CEST	443	49821	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:08.474749088 CEST	49821	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:08.474761963 CEST	443	49821	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:08.474775076 CEST	443	49821	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:08.474819899 CEST	49821	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:08.474946976 CEST	49821	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:08.474963903 CEST	443	49821	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:08.474977016 CEST	49821	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:08.474984884 CEST	443	49821	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:08.475254059 CEST	49824	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:08.475270033 CEST	443	49824	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:08.477819920 CEST	49826	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:08.477847099 CEST	443	49826	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:08.477936029 CEST	49826	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:08.478068113 CEST	49826	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:08.478075981 CEST	443	49826	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:08.528829098 CEST	443	49825	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:08.528846979 CEST	443	49825	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:08.528897047 CEST	443	49825	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:08.528944016 CEST	49825	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:08.528995991 CEST	49825	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:08.529268980 CEST	49825	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:08.529277086 CEST	443	49825	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:08.529323101 CEST	49825	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:08.529330015 CEST	443	49825	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:08.532608032 CEST	49827	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:08.532670021 CEST	443	49827	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:08.532766104 CEST	49827	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:08.532988071 CEST	49827	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:08.533020973 CEST	443	49827	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:08.543135881 CEST	443	49823	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:08.543205023 CEST	443	49823	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:08.543262005 CEST	49823	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:08.543353081 CEST	49823	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:08.543353081 CEST	49823	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:08.543375969 CEST	443	49823	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:08.543411970 CEST	443	49823	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:08.545671940 CEST	49828	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:08.545708895 CEST	443	49828	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:08.545784950 CEST	49828	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:08.545938015 CEST	49828	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:08.545952082 CEST	443	49828	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:08.565327883 CEST	443	49822	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:08.565376997 CEST	443	49822	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:08.565521955 CEST	49822	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:08.565740108 CEST	49822	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:08.565757990 CEST	443	49822	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:08.565788031 CEST	49822	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:08.565793991 CEST	443	49822	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:08.567787886 CEST	49829	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:08.567812920 CEST	443	49829	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:08.567893982 CEST	49829	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:08.568084955 CEST	49829	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:08.568100929 CEST	443	49829	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:08.574136019 CEST	443	49824	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:08.574209929 CEST	443	49824	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:08.574269056 CEST	49824	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:08.574290037 CEST	443	49824	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:08.574445009 CEST	49824	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:08.574475050 CEST	443	49824	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:08.574496031 CEST	49824	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:08.574606895 CEST	443	49824	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:08.574678898 CEST	443	49824	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:08.574729919 CEST	49824	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:08.577151060 CEST	49830	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:08.577162027 CEST	443	49830	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:08.577228069 CEST	49830	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:08.577334881 CEST	49830	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:08.577347040 CEST	443	49830	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.135730028 CEST	443	49826	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.136368036 CEST	49826	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:09.136388063 CEST	443	49826	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.136845112 CEST	49826	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:09.136852026 CEST	443	49826	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.208714962 CEST	443	49827	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.209387064 CEST	49827	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:09.209427118 CEST	443	49827	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.209847927 CEST	49827	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:09.209862947 CEST	443	49827	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.211265087 CEST	443	49828	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.211615086 CEST	49828	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:09.211652040 CEST	443	49828	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.212006092 CEST	49828	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:09.212016106 CEST	443	49828	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.232376099 CEST	443	49826	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.232399940 CEST	443	49826	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.232498884 CEST	49826	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:09.232522964 CEST	443	49826	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.232772112 CEST	49826	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:09.232781887 CEST	443	49826	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.232796907 CEST	49826	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:09.232812881 CEST	443	49826	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.232863903 CEST	443	49826	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.235618114 CEST	443	49830	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.236018896 CEST	49830	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:09.236042976 CEST	443	49830	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.236078978 CEST	49831	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:09.236125946 CEST	443	49831	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.236205101 CEST	49831	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:09.236342907 CEST	49831	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:09.236356020 CEST	443	49831	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.236495018 CEST	49830	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:09.236500978 CEST	443	49830	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.246818066 CEST	443	49829	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.247176886 CEST	49829	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:09.247184038 CEST	443	49829	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.247723103 CEST	49829	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:09.247726917 CEST	443	49829	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.303510904 CEST	443	49827	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.303709984 CEST	443	49827	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.303800106 CEST	49827	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:09.303987980 CEST	49827	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:09.304018021 CEST	443	49827	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.304038048 CEST	49827	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:09.304047108 CEST	443	49827	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.307137966 CEST	49832	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:09.307178974 CEST	443	49832	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.307276964 CEST	49832	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:09.307404041 CEST	49832	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:09.307411909 CEST	443	49832	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.308842897 CEST	443	49828	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.308904886 CEST	443	49828	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.308963060 CEST	49828	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:09.309101105 CEST	49828	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:09.309122086 CEST	443	49828	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.309134960 CEST	49828	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:09.309143066 CEST	443	49828	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.311451912 CEST	49833	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:09.311489105 CEST	443	49833	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.311574936 CEST	49833	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:09.311696053 CEST	49833	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:09.311707020 CEST	443	49833	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.332746983 CEST	443	49830	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.332855940 CEST	443	49830	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.332928896 CEST	49830	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:09.333064079 CEST	49830	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:09.333075047 CEST	443	49830	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.333087921 CEST	49830	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:09.333093882 CEST	443	49830	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.335457087 CEST	49834	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:09.335484982 CEST	443	49834	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.335576057 CEST	49834	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:09.335690975 CEST	49834	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:09.335705042 CEST	443	49834	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.348628044 CEST	443	49829	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.349433899 CEST	443	49829	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.349584103 CEST	49829	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:09.349606037 CEST	49829	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:09.349612951 CEST	443	49829	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.349622011 CEST	49829	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:09.349625111 CEST	443	49829	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.351705074 CEST	49835	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:09.351732016 CEST	443	49835	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.351807117 CEST	49835	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:09.351898909 CEST	49835	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:09.351911068 CEST	443	49835	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.846349955 CEST	443	49831	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.847219944 CEST	49831	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:09.847265959 CEST	443	49831	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.848057032 CEST	49831	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:09.848062038 CEST	443	49831	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.916260958 CEST	443	49832	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.917013884 CEST	49832	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:09.917067051 CEST	443	49832	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.917464018 CEST	49832	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:09.917476892 CEST	443	49832	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.919173002 CEST	443	49833	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.919585943 CEST	49833	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:09.919620991 CEST	443	49833	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.920319080 CEST	49833	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:09.920326948 CEST	443	49833	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.944000006 CEST	443	49831	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.944561958 CEST	443	49834	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.945085049 CEST	443	49831	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.945184946 CEST	49834	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:09.945192099 CEST	49831	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:09.945207119 CEST	443	49834	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.945647001 CEST	49834	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:09.945655107 CEST	443	49834	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.945708990 CEST	49831	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:09.945708990 CEST	49831	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:09.945749044 CEST	443	49831	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.945772886 CEST	443	49831	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.949745893 CEST	49836	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:09.949831963 CEST	443	49836	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.950050116 CEST	49836	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:09.950150967 CEST	49836	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:09.950156927 CEST	443	49836	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.963287115 CEST	443	49835	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.963815928 CEST	49835	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:09.963830948 CEST	443	49835	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:09.964306116 CEST	49835	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:09.964310884 CEST	443	49835	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.012948990 CEST	443	49832	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.013421059 CEST	443	49832	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.013504028 CEST	49832	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.013531923 CEST	49832	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.013546944 CEST	443	49832	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.013556957 CEST	49832	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.013561964 CEST	443	49832	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.015989065 CEST	443	49833	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.016118050 CEST	443	49833	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.016179085 CEST	49833	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.017230034 CEST	49833	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.017246008 CEST	443	49833	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.017256021 CEST	49833	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.017261028 CEST	443	49833	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.019747019 CEST	49837	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.019781113 CEST	443	49837	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.019846916 CEST	49837	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.020283937 CEST	49837	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.020294905 CEST	443	49837	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.020931959 CEST	49838	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.020941019 CEST	443	49838	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.020997047 CEST	49838	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.021302938 CEST	49838	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.021310091 CEST	443	49838	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.043735027 CEST	443	49834	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.043786049 CEST	443	49834	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.043920994 CEST	49834	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.044104099 CEST	49834	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.044118881 CEST	443	49834	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.044128895 CEST	49834	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.044133902 CEST	443	49834	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.046359062 CEST	49839	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.046389103 CEST	443	49839	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.046452045 CEST	49839	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.046741962 CEST	49839	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.046752930 CEST	443	49839	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.060195923 CEST	443	49835	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.060348988 CEST	443	49835	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.060410023 CEST	49835	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.060446978 CEST	49835	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.060460091 CEST	443	49835	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.060471058 CEST	49835	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.060476065 CEST	443	49835	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.067351103 CEST	49840	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.067378998 CEST	443	49840	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.067445040 CEST	49840	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.070549011 CEST	49840	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.070564985 CEST	443	49840	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.558398962 CEST	443	49836	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.560266018 CEST	49836	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.560292959 CEST	443	49836	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.560616970 CEST	49836	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.560623884 CEST	443	49836	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.626652002 CEST	443	49837	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.628108025 CEST	49837	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.628119946 CEST	443	49837	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.628715992 CEST	49837	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.628720999 CEST	443	49837	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.641963005 CEST	443	49838	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.643924952 CEST	49838	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.643935919 CEST	443	49838	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.644277096 CEST	49838	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.644279957 CEST	443	49838	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.652215958 CEST	443	49836	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.652390003 CEST	443	49836	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.652574062 CEST	49836	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.652650118 CEST	49836	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.652676105 CEST	443	49836	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.652692080 CEST	49836	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.652699947 CEST	443	49836	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.653064966 CEST	443	49839	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.653753042 CEST	49839	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.653774023 CEST	443	49839	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.654154062 CEST	49839	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.654160023 CEST	443	49839	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.656052113 CEST	49841	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.656086922 CEST	443	49841	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.656395912 CEST	49841	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.656554937 CEST	49841	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.656563044 CEST	443	49841	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.682634115 CEST	443	49840	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.683962107 CEST	49840	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.683980942 CEST	443	49840	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.684523106 CEST	49840	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.684529066 CEST	443	49840	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.721941948 CEST	443	49837	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.721962929 CEST	443	49837	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.722004890 CEST	443	49837	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.722049952 CEST	49837	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.722073078 CEST	49837	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.722302914 CEST	49837	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.722323895 CEST	443	49837	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.722338915 CEST	49837	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.722346067 CEST	443	49837	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.725357056 CEST	49842	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.725398064 CEST	443	49842	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.725509882 CEST	49842	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.725673914 CEST	49842	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.725687981 CEST	443	49842	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.740119934 CEST	443	49838	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.740183115 CEST	443	49838	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.740292072 CEST	49838	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.744944096 CEST	49838	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.744945049 CEST	49838	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.744956970 CEST	443	49838	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.744968891 CEST	443	49838	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.748502016 CEST	49843	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.748570919 CEST	443	49843	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.748678923 CEST	49843	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.748929024 CEST	49843	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.748966932 CEST	443	49843	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.750185013 CEST	443	49839	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.750401020 CEST	443	49839	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.750474930 CEST	49839	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.750507116 CEST	443	49839	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.750531912 CEST	443	49839	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.750586033 CEST	49839	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.750611067 CEST	49839	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.750628948 CEST	443	49839	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.750642061 CEST	49839	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.750648022 CEST	443	49839	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.753420115 CEST	49844	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.753437042 CEST	443	49844	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.753514051 CEST	49844	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.753729105 CEST	49844	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.753742933 CEST	443	49844	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.778409958 CEST	443	49840	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.778558016 CEST	443	49840	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.778659105 CEST	49840	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.778693914 CEST	49840	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.778693914 CEST	49840	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.778709888 CEST	443	49840	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.778721094 CEST	443	49840	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.781390905 CEST	49845	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.781457901 CEST	443	49845	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:10.781553984 CEST	49845	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.781647921 CEST	49845	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:10.781668901 CEST	443	49845	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:11.267191887 CEST	443	49841	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:11.267915010 CEST	49841	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:11.267931938 CEST	443	49841	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:11.268553019 CEST	49841	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:11.268558025 CEST	443	49841	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:11.294962883 CEST	443	49844	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:11.295428991 CEST	49844	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:11.295443058 CEST	443	49844	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:11.296262980 CEST	49844	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:11.296267986 CEST	443	49844	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:11.355165958 CEST	443	49842	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:11.355662107 CEST	49842	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:11.355681896 CEST	443	49842	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:11.356195927 CEST	49842	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:11.356200933 CEST	443	49842	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:11.362045050 CEST	443	49841	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:11.362102032 CEST	443	49841	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:11.362152100 CEST	49841	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:11.362318039 CEST	49841	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:11.362340927 CEST	443	49841	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:11.362350941 CEST	49841	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:11.362355947 CEST	443	49841	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:11.365608931 CEST	49846	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:11.365703106 CEST	443	49846	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:11.365802050 CEST	49846	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:11.365942001 CEST	49846	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:11.365967035 CEST	443	49846	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:11.385442972 CEST	443	49843	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:11.386014938 CEST	49843	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:11.386025906 CEST	443	49843	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:11.386550903 CEST	49843	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:11.386558056 CEST	443	49843	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:11.389880896 CEST	443	49844	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:11.390233040 CEST	443	49844	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:11.390292883 CEST	49844	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:11.390321970 CEST	49844	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:11.390337944 CEST	443	49844	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:11.390367031 CEST	49844	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:11.390372038 CEST	443	49844	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:11.394020081 CEST	49847	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:11.394041061 CEST	443	49847	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:11.394258022 CEST	49847	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:11.394258022 CEST	49847	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:11.394279957 CEST	443	49847	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:11.425714016 CEST	443	49845	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:11.426139116 CEST	49845	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:11.426161051 CEST	443	49845	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:11.427289963 CEST	49845	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:11.427300930 CEST	443	49845	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:11.450508118 CEST	443	49842	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:11.453066111 CEST	443	49842	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:11.453135014 CEST	49842	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:11.453282118 CEST	49842	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:11.453291893 CEST	443	49842	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:11.453301907 CEST	49842	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:11.453308105 CEST	443	49842	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:11.456463099 CEST	49848	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:11.456506968 CEST	443	49848	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:11.456582069 CEST	49848	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:11.456752062 CEST	49848	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:11.456768990 CEST	443	49848	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:11.484451056 CEST	443	49843	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:11.486038923 CEST	443	49843	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:11.486094952 CEST	443	49843	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:11.486094952 CEST	49843	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:11.486151934 CEST	49843	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:11.486196995 CEST	49843	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:11.486212015 CEST	443	49843	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:11.486223936 CEST	49843	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:11.486229897 CEST	443	49843	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:11.489126921 CEST	49849	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:11.489157915 CEST	443	49849	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:11.489221096 CEST	49849	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:11.489341974 CEST	49849	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:11.489360094 CEST	443	49849	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:11.525644064 CEST	443	49845	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:11.525798082 CEST	443	49845	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:11.525873899 CEST	49845	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:11.526026011 CEST	49845	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:11.526026011 CEST	49845	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:11.526056051 CEST	443	49845	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:11.526078939 CEST	443	49845	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:11.528548956 CEST	49850	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:11.528573990 CEST	443	49850	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:11.528652906 CEST	49850	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:11.528786898 CEST	49850	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:11.528804064 CEST	443	49850	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:11.982830048 CEST	443	49846	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:11.983464003 CEST	49846	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:11.983493090 CEST	443	49846	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:11.983968973 CEST	49846	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:11.983975887 CEST	443	49846	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.000705957 CEST	443	49847	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.001626968 CEST	49847	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.001626968 CEST	49847	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.001653910 CEST	443	49847	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.001674891 CEST	443	49847	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.070245028 CEST	443	49848	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.070805073 CEST	49848	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.070827961 CEST	443	49848	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.071403027 CEST	49848	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.071409941 CEST	443	49848	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.077697992 CEST	443	49846	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.078103065 CEST	443	49846	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.078166008 CEST	49846	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.078198910 CEST	49846	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.078216076 CEST	443	49846	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.078224897 CEST	49846	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.078231096 CEST	443	49846	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.081183910 CEST	49851	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.081218958 CEST	443	49851	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.081315041 CEST	49851	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.081479073 CEST	49851	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.081495047 CEST	443	49851	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.096445084 CEST	443	49847	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.096517086 CEST	443	49847	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.096616983 CEST	443	49847	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.096664906 CEST	49847	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.096664906 CEST	49847	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.096757889 CEST	49847	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.096757889 CEST	49847	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.096776009 CEST	443	49847	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.096785069 CEST	443	49847	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.099271059 CEST	49852	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.099304914 CEST	443	49852	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.099370003 CEST	49852	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.099525928 CEST	49852	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.099538088 CEST	443	49852	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.152978897 CEST	443	49849	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.153542995 CEST	49849	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.153568029 CEST	443	49849	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.154042006 CEST	49849	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.154048920 CEST	443	49849	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.156112909 CEST	443	49850	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.156383991 CEST	49850	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.156400919 CEST	443	49850	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.156750917 CEST	49850	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.156754971 CEST	443	49850	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.165122032 CEST	443	49848	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.165232897 CEST	443	49848	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.165306091 CEST	49848	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.165427923 CEST	49848	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.165452003 CEST	443	49848	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.165465117 CEST	49848	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.165472984 CEST	443	49848	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.168251038 CEST	49853	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.168292046 CEST	443	49853	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.168366909 CEST	49853	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.168504000 CEST	49853	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.168518066 CEST	443	49853	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.250514984 CEST	443	49850	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.250571966 CEST	443	49850	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.250704050 CEST	49850	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.250976086 CEST	49850	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.250993013 CEST	443	49850	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.251003027 CEST	49850	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.251008987 CEST	443	49850	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.253997087 CEST	49854	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.254091024 CEST	443	49854	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.254205942 CEST	49854	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.254350901 CEST	49854	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.254374027 CEST	443	49854	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.256285906 CEST	443	49849	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.257642031 CEST	443	49849	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.257680893 CEST	443	49849	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.257700920 CEST	49849	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.257730007 CEST	49849	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.257767916 CEST	49849	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.257774115 CEST	443	49849	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.257783890 CEST	49849	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.257787943 CEST	443	49849	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.259587049 CEST	49855	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.259618998 CEST	443	49855	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.259690046 CEST	49855	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.259805918 CEST	49855	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.259818077 CEST	443	49855	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.693490982 CEST	443	49851	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.694147110 CEST	49851	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.694159031 CEST	443	49851	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.694665909 CEST	49851	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.694672108 CEST	443	49851	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.752870083 CEST	443	49852	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.753959894 CEST	49852	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.753982067 CEST	443	49852	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.754482031 CEST	49852	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.754488945 CEST	443	49852	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.810339928 CEST	443	49853	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.810858011 CEST	443	49851	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.810952902 CEST	443	49851	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.811050892 CEST	49853	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.811065912 CEST	443	49853	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.811086893 CEST	49851	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.811845064 CEST	49853	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.811857939 CEST	443	49853	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.812063932 CEST	49851	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.812089920 CEST	443	49851	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.812099934 CEST	49851	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.812104940 CEST	443	49851	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.815326929 CEST	49856	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.815352917 CEST	443	49856	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.815448046 CEST	49856	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.815561056 CEST	49856	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.815572023 CEST	443	49856	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.855170012 CEST	443	49852	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.855248928 CEST	443	49852	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.855346918 CEST	49852	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.855554104 CEST	49852	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.855566025 CEST	443	49852	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.855581999 CEST	49852	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.855587006 CEST	443	49852	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.859509945 CEST	49857	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.859558105 CEST	443	49857	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.859661102 CEST	49857	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.859869957 CEST	49857	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.859884977 CEST	443	49857	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.898955107 CEST	443	49855	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.899621964 CEST	49855	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.899631023 CEST	443	49855	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.900338888 CEST	49855	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.900343895 CEST	443	49855	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.910139084 CEST	443	49853	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.910212040 CEST	443	49853	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.910326004 CEST	443	49853	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.910362005 CEST	49853	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.910412073 CEST	49853	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.910501957 CEST	49853	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.910518885 CEST	443	49853	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.910531044 CEST	49853	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.910536051 CEST	443	49853	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.913578033 CEST	49858	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.913615942 CEST	443	49858	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.913716078 CEST	49858	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.913908005 CEST	49858	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.913913012 CEST	443	49858	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.917437077 CEST	443	49854	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.917834997 CEST	49854	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.917854071 CEST	443	49854	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:12.918210030 CEST	49854	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:12.918215036 CEST	443	49854	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:13.005558014 CEST	443	49855	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:13.005665064 CEST	443	49855	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:13.005762100 CEST	49855	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:13.005883932 CEST	49855	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:13.005898952 CEST	443	49855	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:13.005906105 CEST	49855	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:13.005911112 CEST	443	49855	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:13.008712053 CEST	49859	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:13.008738041 CEST	443	49859	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:13.008826017 CEST	49859	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:13.009023905 CEST	49859	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:13.009035110 CEST	443	49859	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:13.017796040 CEST	443	49854	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:13.018567085 CEST	443	49854	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:13.018640041 CEST	49854	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:13.018681049 CEST	49854	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:13.018681049 CEST	49854	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:13.018697023 CEST	443	49854	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:13.018707037 CEST	443	49854	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:13.021473885 CEST	49860	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:13.021501064 CEST	443	49860	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:13.021564007 CEST	49860	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:13.021702051 CEST	49860	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:13.021713018 CEST	443	49860	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:13.435334921 CEST	443	49856	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:13.436043024 CEST	49856	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:13.436054945 CEST	443	49856	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:13.436538935 CEST	49856	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:13.436543941 CEST	443	49856	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:13.465929031 CEST	443	49857	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:13.466341019 CEST	49857	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:13.466352940 CEST	443	49857	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:13.466849089 CEST	49857	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:13.466854095 CEST	443	49857	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:13.531151056 CEST	443	49856	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:13.531200886 CEST	443	49856	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:13.531243086 CEST	49856	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:13.531521082 CEST	49856	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:13.531534910 CEST	443	49856	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:13.531546116 CEST	49856	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:13.531555891 CEST	443	49856	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:13.534658909 CEST	49861	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:13.534698009 CEST	443	49861	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:13.534766912 CEST	49861	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:13.534924984 CEST	49861	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:13.534930944 CEST	443	49861	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:13.537224054 CEST	443	49858	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:13.537694931 CEST	49858	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:13.537702084 CEST	443	49858	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:13.538167000 CEST	49858	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:13.538171053 CEST	443	49858	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:13.561589956 CEST	443	49857	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:13.561659098 CEST	443	49857	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:13.561708927 CEST	49857	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:13.561721087 CEST	443	49857	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:13.561764002 CEST	443	49857	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:13.561809063 CEST	49857	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:13.561908007 CEST	49857	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:13.561923027 CEST	443	49857	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:13.561939955 CEST	49857	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:13.561944962 CEST	443	49857	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:13.564685106 CEST	49862	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:13.564733982 CEST	443	49862	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:13.564888954 CEST	49862	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:13.564991951 CEST	49862	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:13.565021038 CEST	443	49862	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:13.632587910 CEST	443	49858	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:13.633030891 CEST	443	49858	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:13.633124113 CEST	49858	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:13.633161068 CEST	49858	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:13.633177996 CEST	443	49858	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:13.633203983 CEST	49858	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:13.633208990 CEST	443	49858	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:13.635868073 CEST	49863	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:13.635910988 CEST	443	49863	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:13.635986090 CEST	49863	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:13.636126041 CEST	49863	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:13.636142969 CEST	443	49863	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:13.656477928 CEST	443	49859	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:13.656878948 CEST	49859	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:13.656887054 CEST	443	49859	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:13.657314062 CEST	49859	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:13.657322884 CEST	443	49859	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:13.659271955 CEST	443	49860	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:13.659527063 CEST	49860	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:13.659545898 CEST	443	49860	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:13.659854889 CEST	49860	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:13.659864902 CEST	443	49860	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:13.756849051 CEST	443	49859	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:13.756937981 CEST	443	49859	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:13.757016897 CEST	49859	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:13.757234097 CEST	49859	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:13.757251024 CEST	443	49859	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:13.757261038 CEST	49859	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:13.757266045 CEST	443	49859	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:13.759937048 CEST	49864	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:13.760001898 CEST	443	49864	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:13.760091066 CEST	49864	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:13.760222912 CEST	49864	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:13.760242939 CEST	443	49864	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:13.761279106 CEST	443	49860	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:13.761450052 CEST	443	49860	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:13.761507034 CEST	49860	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:13.761534929 CEST	49860	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:13.761548996 CEST	443	49860	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:13.761557102 CEST	49860	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:13.761560917 CEST	443	49860	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:13.763298988 CEST	49865	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:13.763325930 CEST	443	49865	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:13.763408899 CEST	49865	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:13.763503075 CEST	49865	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:13.763511896 CEST	443	49865	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.157485008 CEST	443	49861	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.160321951 CEST	49861	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:14.160382032 CEST	443	49861	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.160732985 CEST	49861	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:14.160746098 CEST	443	49861	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.178530931 CEST	443	49862	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.181894064 CEST	49862	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:14.181948900 CEST	443	49862	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.182851076 CEST	49862	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:14.182864904 CEST	443	49862	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.254786015 CEST	443	49861	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.254816055 CEST	443	49861	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.254870892 CEST	443	49861	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.254910946 CEST	49861	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:14.254937887 CEST	49861	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:14.255244017 CEST	49861	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:14.255244017 CEST	49861	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:14.255278111 CEST	443	49861	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.255290985 CEST	443	49861	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.257869959 CEST	49866	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:14.257900000 CEST	443	49866	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.257970095 CEST	49866	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:14.258097887 CEST	49866	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:14.258104086 CEST	443	49866	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.274296999 CEST	443	49862	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.274462938 CEST	443	49862	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.274533033 CEST	49862	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:14.274588108 CEST	49862	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:14.274588108 CEST	49862	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:14.274605989 CEST	443	49862	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.274626970 CEST	443	49862	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.276475906 CEST	49867	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:14.276523113 CEST	443	49867	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.276598930 CEST	49867	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:14.276706934 CEST	49867	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:14.276726007 CEST	443	49867	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.286416054 CEST	443	49863	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.286794901 CEST	49863	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:14.286818027 CEST	443	49863	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.287213087 CEST	49863	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:14.287219048 CEST	443	49863	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.367006063 CEST	443	49864	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.367604971 CEST	49864	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:14.367625952 CEST	443	49864	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.368032932 CEST	49864	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:14.368040085 CEST	443	49864	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.375713110 CEST	443	49865	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.376003981 CEST	49865	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:14.376014948 CEST	443	49865	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.376329899 CEST	49865	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:14.376333952 CEST	443	49865	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.386790037 CEST	443	49863	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.386881113 CEST	443	49863	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.386934042 CEST	49863	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:14.387052059 CEST	49863	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:14.387069941 CEST	443	49863	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.387084007 CEST	49863	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:14.387089014 CEST	443	49863	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.389987946 CEST	49868	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:14.390022039 CEST	443	49868	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.390110970 CEST	49868	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:14.390249014 CEST	49868	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:14.390261889 CEST	443	49868	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.462230921 CEST	443	49864	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.462395906 CEST	443	49864	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.462456942 CEST	49864	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:14.462596893 CEST	49864	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:14.462608099 CEST	443	49864	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.462620974 CEST	49864	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:14.462625980 CEST	443	49864	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.466157913 CEST	49869	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:14.466202021 CEST	443	49869	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.466267109 CEST	49869	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:14.466506004 CEST	49869	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:14.466519117 CEST	443	49869	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.469773054 CEST	443	49865	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.469846010 CEST	443	49865	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.469912052 CEST	49865	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:14.469929934 CEST	443	49865	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.469960928 CEST	443	49865	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.470006943 CEST	49865	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:14.470146894 CEST	49865	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:14.470160007 CEST	443	49865	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.470168114 CEST	49865	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:14.470171928 CEST	443	49865	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.472695112 CEST	49870	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:14.472727060 CEST	443	49870	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.472788095 CEST	49870	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:14.472975016 CEST	49870	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:14.472992897 CEST	443	49870	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.866889000 CEST	443	49866	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.867518902 CEST	49866	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:14.867549896 CEST	443	49866	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.867927074 CEST	49866	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:14.867932081 CEST	443	49866	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.905211926 CEST	443	49867	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.905765057 CEST	49867	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:14.905790091 CEST	443	49867	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.906179905 CEST	49867	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:14.906184912 CEST	443	49867	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.961291075 CEST	443	49866	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.961674929 CEST	443	49866	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.961865902 CEST	49866	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:14.961929083 CEST	49866	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:14.961946964 CEST	443	49866	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.961956978 CEST	49866	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:14.961961985 CEST	443	49866	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.965092897 CEST	49871	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:14.965133905 CEST	443	49871	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.965214968 CEST	49871	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:14.965382099 CEST	49871	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:14.965394974 CEST	443	49871	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.994225979 CEST	443	49868	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.994730949 CEST	49868	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:14.994755983 CEST	443	49868	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:14.995232105 CEST	49868	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:14.995237112 CEST	443	49868	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.001620054 CEST	443	49867	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.002866983 CEST	443	49867	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.002974987 CEST	443	49867	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.003052950 CEST	49867	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.003091097 CEST	49867	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.003170967 CEST	49867	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.003187895 CEST	443	49867	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.003211975 CEST	49867	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.003217936 CEST	443	49867	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.006021023 CEST	49872	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.006063938 CEST	443	49872	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.006154060 CEST	49872	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.006290913 CEST	49872	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.006305933 CEST	443	49872	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.089463949 CEST	443	49868	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.089764118 CEST	443	49868	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.089829922 CEST	49868	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.089853048 CEST	49868	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.089870930 CEST	443	49868	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.089880943 CEST	49868	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.089886904 CEST	443	49868	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.092417002 CEST	49873	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.092454910 CEST	443	49873	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.092529058 CEST	49873	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.092643023 CEST	49873	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.092654943 CEST	443	49873	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.102787018 CEST	443	49870	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.103230000 CEST	49870	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.103300095 CEST	443	49870	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.103703022 CEST	49870	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.103709936 CEST	443	49870	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.107230902 CEST	443	49869	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.107611895 CEST	49869	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.107642889 CEST	443	49869	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.108061075 CEST	49869	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.108071089 CEST	443	49869	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.199501038 CEST	443	49870	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.199666977 CEST	443	49870	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.199769020 CEST	49870	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.199934006 CEST	49870	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.199956894 CEST	443	49870	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.199970007 CEST	49870	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.199976921 CEST	443	49870	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.203556061 CEST	49874	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.203603029 CEST	443	49874	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.203685045 CEST	49874	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.203821898 CEST	49874	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.203830957 CEST	443	49874	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.206893921 CEST	443	49869	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.206931114 CEST	443	49869	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.206989050 CEST	443	49869	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.207000017 CEST	49869	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.207035065 CEST	49869	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.214493990 CEST	49869	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.214520931 CEST	443	49869	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.214607954 CEST	49869	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.214621067 CEST	443	49869	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.217891932 CEST	49875	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.217988968 CEST	443	49875	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.218082905 CEST	49875	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.218235970 CEST	49875	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.218276024 CEST	443	49875	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.598754883 CEST	443	49871	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.599328041 CEST	49871	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.599349976 CEST	443	49871	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.599783897 CEST	49871	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.599787951 CEST	443	49871	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.618586063 CEST	443	49872	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.619028091 CEST	49872	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.619095087 CEST	443	49872	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.619415998 CEST	49872	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.619431973 CEST	443	49872	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.698461056 CEST	443	49871	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.698489904 CEST	443	49871	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.698537111 CEST	443	49871	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.698555946 CEST	49871	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.698618889 CEST	49871	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.698824883 CEST	49871	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.698824883 CEST	49871	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.698868990 CEST	443	49871	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.698898077 CEST	443	49871	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.702430964 CEST	49876	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.702476978 CEST	443	49876	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.702541113 CEST	49876	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.702697992 CEST	49876	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.702716112 CEST	443	49876	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.727449894 CEST	443	49872	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.727493048 CEST	443	49872	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.727571011 CEST	49872	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.727698088 CEST	49872	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.727698088 CEST	49872	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.727746010 CEST	443	49872	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.727772951 CEST	443	49872	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.729993105 CEST	49877	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.730025053 CEST	443	49877	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.730106115 CEST	49877	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.730225086 CEST	49877	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.730236053 CEST	443	49877	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.756409883 CEST	443	49873	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.757195950 CEST	49873	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.757280111 CEST	443	49873	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.757632971 CEST	49873	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.757647991 CEST	443	49873	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.846945047 CEST	443	49874	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.847443104 CEST	49874	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.847492933 CEST	443	49874	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.847846985 CEST	49874	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.847857952 CEST	443	49874	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.860560894 CEST	443	49873	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.860861063 CEST	443	49873	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.860902071 CEST	443	49873	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.860918999 CEST	49873	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.860953093 CEST	49873	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.861164093 CEST	49873	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.861165047 CEST	49873	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.861198902 CEST	443	49873	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.861219883 CEST	443	49873	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.863856077 CEST	49878	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.863884926 CEST	443	49878	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.863954067 CEST	49878	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.864073038 CEST	49878	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.864083052 CEST	443	49878	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.868935108 CEST	443	49875	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.869482994 CEST	49875	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.869518042 CEST	443	49875	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.869959116 CEST	49875	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.869975090 CEST	443	49875	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.946927071 CEST	443	49874	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.947097063 CEST	443	49874	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.947170973 CEST	49874	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.947287083 CEST	49874	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.947287083 CEST	49874	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.947325945 CEST	443	49874	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.947349072 CEST	443	49874	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.950680017 CEST	49879	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.950723886 CEST	443	49879	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.950812101 CEST	49879	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.950963974 CEST	49879	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.950984001 CEST	443	49879	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.970916986 CEST	443	49875	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.971043110 CEST	443	49875	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.971218109 CEST	49875	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.971218109 CEST	49875	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.971218109 CEST	49875	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.973840952 CEST	49880	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.973916054 CEST	443	49880	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:15.974009991 CEST	49880	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.974257946 CEST	49880	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:15.974288940 CEST	443	49880	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:16.279850006 CEST	49875	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:16.279880047 CEST	443	49875	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:16.336999893 CEST	443	49876	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:16.337824106 CEST	49876	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:16.337873936 CEST	443	49876	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:16.338205099 CEST	49876	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:16.338212967 CEST	443	49876	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:16.341186047 CEST	443	49877	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:16.341658115 CEST	49877	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:16.341681957 CEST	443	49877	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:16.342008114 CEST	49877	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:16.342014074 CEST	443	49877	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:16.435940981 CEST	443	49877	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:16.436254025 CEST	443	49877	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:16.436332941 CEST	49877	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:16.436350107 CEST	443	49877	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:16.436377048 CEST	443	49877	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:16.436429024 CEST	49877	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:16.436634064 CEST	49877	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:16.436647892 CEST	443	49877	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:16.436687946 CEST	49877	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:16.436702013 CEST	443	49877	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:16.437169075 CEST	443	49876	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:16.437237978 CEST	443	49876	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:16.437288046 CEST	49876	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:16.437401056 CEST	49876	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:16.437424898 CEST	443	49876	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:16.437438965 CEST	49876	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:16.437446117 CEST	443	49876	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:16.440264940 CEST	49881	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:16.440304995 CEST	443	49881	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:16.440368891 CEST	49881	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:16.440476894 CEST	49882	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:16.440485954 CEST	443	49882	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:16.440545082 CEST	49882	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:16.440670967 CEST	49882	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:16.440685034 CEST	443	49882	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:16.440725088 CEST	49881	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:16.440737009 CEST	443	49881	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:16.483756065 CEST	443	49878	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:16.484157085 CEST	49878	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:16.484178066 CEST	443	49878	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:16.484592915 CEST	49878	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:16.484599113 CEST	443	49878	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:16.581569910 CEST	443	49880	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:16.583640099 CEST	443	49878	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:16.583868980 CEST	443	49878	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:16.583940983 CEST	49878	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:16.597096920 CEST	49880	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:16.597124100 CEST	443	49880	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:16.597539902 CEST	49880	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:16.597546101 CEST	443	49880	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:16.597733021 CEST	49878	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:16.597764015 CEST	443	49878	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:16.597779036 CEST	49878	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:16.597785950 CEST	443	49878	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:16.600507021 CEST	49883	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:16.600543976 CEST	443	49883	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:16.600620031 CEST	49883	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:16.600733995 CEST	49883	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:16.600742102 CEST	443	49883	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:16.604397058 CEST	443	49879	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:16.604679108 CEST	49879	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:16.604702950 CEST	443	49879	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:16.605053902 CEST	49879	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:16.605058908 CEST	443	49879	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:16.688335896 CEST	443	49880	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:16.688656092 CEST	443	49880	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:16.688715935 CEST	49880	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:16.688750982 CEST	49880	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:16.688751936 CEST	49880	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:16.688770056 CEST	443	49880	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:16.688781023 CEST	443	49880	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:16.691503048 CEST	49884	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:16.691543102 CEST	443	49884	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:16.691622972 CEST	49884	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:16.691775084 CEST	49884	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:16.691785097 CEST	443	49884	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:16.722548008 CEST	443	49879	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:16.722626925 CEST	443	49879	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:16.722698927 CEST	49879	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:16.722713947 CEST	443	49879	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:16.722743034 CEST	443	49879	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:16.722790956 CEST	49879	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:16.722889900 CEST	49879	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:16.722907066 CEST	443	49879	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:16.722917080 CEST	49879	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:16.722920895 CEST	443	49879	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:16.725105047 CEST	49885	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:16.725205898 CEST	443	49885	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:16.725301027 CEST	49885	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:16.725400925 CEST	49885	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:16.725429058 CEST	443	49885	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.076105118 CEST	443	49881	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.076570034 CEST	49881	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:17.076584101 CEST	443	49881	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.077069998 CEST	49881	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:17.077075958 CEST	443	49881	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.084414005 CEST	443	49882	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.084749937 CEST	49882	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:17.084763050 CEST	443	49882	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.085129976 CEST	49882	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:17.085134983 CEST	443	49882	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.170469999 CEST	443	49881	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.170578003 CEST	443	49881	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.170664072 CEST	49881	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:17.170777082 CEST	49881	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:17.170794964 CEST	443	49881	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.170830965 CEST	49881	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:17.170835972 CEST	443	49881	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.173584938 CEST	49886	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:17.173628092 CEST	443	49886	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.173734903 CEST	49886	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:17.173885107 CEST	49886	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:17.173902035 CEST	443	49886	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.181006908 CEST	443	49882	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.181209087 CEST	443	49882	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.181267023 CEST	49882	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:17.181315899 CEST	49882	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:17.181319952 CEST	443	49882	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.181351900 CEST	49882	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:17.181355953 CEST	443	49882	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.183114052 CEST	49887	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:17.183162928 CEST	443	49887	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.183229923 CEST	49887	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:17.183331013 CEST	49887	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:17.183346987 CEST	443	49887	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.228254080 CEST	443	49883	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.228966951 CEST	49883	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:17.228992939 CEST	443	49883	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.229567051 CEST	49883	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:17.229573965 CEST	443	49883	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.324012995 CEST	443	49883	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.324042082 CEST	443	49883	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.324091911 CEST	443	49883	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.324184895 CEST	49883	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:17.324238062 CEST	49883	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:17.324491978 CEST	49883	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:17.324532032 CEST	443	49883	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.324558020 CEST	49883	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:17.324573994 CEST	443	49883	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.327868938 CEST	49888	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:17.327917099 CEST	443	49888	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.327985048 CEST	49888	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:17.328126907 CEST	49888	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:17.328135967 CEST	443	49888	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.334196091 CEST	443	49884	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.334661007 CEST	49884	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:17.334673882 CEST	443	49884	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.335129976 CEST	49884	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:17.335136890 CEST	443	49884	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.399979115 CEST	443	49885	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.400587082 CEST	49885	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:17.400610924 CEST	443	49885	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.401070118 CEST	49885	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:17.401074886 CEST	443	49885	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.428648949 CEST	443	49884	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.428908110 CEST	443	49884	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.428994894 CEST	49884	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:17.429043055 CEST	49884	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:17.429043055 CEST	49884	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:17.429066896 CEST	443	49884	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.429080963 CEST	443	49884	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.432207108 CEST	49889	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:17.432240009 CEST	443	49889	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.432349920 CEST	49889	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:17.432482004 CEST	49889	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:17.432487011 CEST	443	49889	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.499346972 CEST	443	49885	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.499603987 CEST	443	49885	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.499660969 CEST	49885	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:17.499680042 CEST	443	49885	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.499736071 CEST	443	49885	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.499758959 CEST	49885	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:17.499783993 CEST	443	49885	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.499811888 CEST	49885	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:17.499811888 CEST	49885	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:17.499819040 CEST	443	49885	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.499824047 CEST	443	49885	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.502808094 CEST	49890	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:17.502829075 CEST	443	49890	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.502907038 CEST	49890	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:17.503038883 CEST	49890	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:17.503057957 CEST	443	49890	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.806005955 CEST	443	49886	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.806636095 CEST	49886	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:17.806684971 CEST	443	49886	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.807013988 CEST	443	49887	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.807018995 CEST	49886	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:17.807025909 CEST	443	49886	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.807262897 CEST	49887	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:17.807291985 CEST	443	49887	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.807599068 CEST	49887	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:17.807605982 CEST	443	49887	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.901957035 CEST	443	49887	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.902014971 CEST	443	49887	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.902076960 CEST	49887	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:17.902335882 CEST	49887	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:17.902354002 CEST	443	49887	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.902384996 CEST	49887	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:17.902393103 CEST	443	49887	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.902825117 CEST	443	49886	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.903179884 CEST	443	49886	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.903264046 CEST	49886	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:17.903328896 CEST	49886	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:17.903350115 CEST	443	49886	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.903419971 CEST	49886	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:17.903426886 CEST	443	49886	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.906069040 CEST	49891	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:17.906100035 CEST	443	49891	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.906127930 CEST	49892	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:17.906174898 CEST	443	49892	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.906186104 CEST	49891	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:17.906233072 CEST	49892	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:17.906317949 CEST	49891	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:17.906325102 CEST	443	49891	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.906430006 CEST	49892	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:17.906447887 CEST	443	49892	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.959872007 CEST	443	49888	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.964548111 CEST	49888	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:17.964566946 CEST	443	49888	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:17.964967966 CEST	49888	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:17.964973927 CEST	443	49888	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:18.032843113 CEST	443	49889	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:18.033565998 CEST	49889	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:18.033607006 CEST	443	49889	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:18.034046888 CEST	49889	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:18.034054995 CEST	443	49889	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:18.060039043 CEST	443	49888	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:18.060198069 CEST	443	49888	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:18.060292006 CEST	49888	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:18.060561895 CEST	49888	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:18.060581923 CEST	443	49888	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:18.060622931 CEST	49888	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:18.060630083 CEST	443	49888	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:18.063924074 CEST	49893	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:18.063956022 CEST	443	49893	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:18.064076900 CEST	49893	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:18.064265966 CEST	49893	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:18.064276934 CEST	443	49893	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:18.122585058 CEST	443	49890	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:18.123100042 CEST	49890	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:18.123136044 CEST	443	49890	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:18.123547077 CEST	49890	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:18.123553038 CEST	443	49890	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:18.127559900 CEST	443	49889	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:18.127635002 CEST	443	49889	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:18.127716064 CEST	49889	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:18.127929926 CEST	49889	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:18.127953053 CEST	443	49889	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:18.127964973 CEST	49889	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:18.127971888 CEST	443	49889	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:18.130873919 CEST	49894	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:18.130932093 CEST	443	49894	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:18.131038904 CEST	49894	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:18.131196022 CEST	49894	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:18.131211042 CEST	443	49894	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:18.217499018 CEST	443	49890	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:18.217653036 CEST	443	49890	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:18.217726946 CEST	49890	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:18.218019962 CEST	49890	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:18.218036890 CEST	443	49890	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:18.218048096 CEST	49890	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:18.218053102 CEST	443	49890	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:18.220850945 CEST	49895	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:18.220890999 CEST	443	49895	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:18.221008062 CEST	49895	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:18.221160889 CEST	49895	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:18.221173048 CEST	443	49895	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:18.518651009 CEST	443	49892	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:18.519167900 CEST	49892	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:18.519191980 CEST	443	49892	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:18.519603014 CEST	49892	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:18.519613028 CEST	443	49892	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:18.613035917 CEST	443	49892	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:18.613231897 CEST	443	49892	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:18.613298893 CEST	49892	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:18.613416910 CEST	49892	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:18.613437891 CEST	443	49892	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:18.613451004 CEST	49892	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:18.613457918 CEST	443	49892	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:18.616646051 CEST	49896	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:18.616708994 CEST	443	49896	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:18.616837978 CEST	49896	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:18.617044926 CEST	49896	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:18.617063999 CEST	443	49896	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:18.733285904 CEST	443	49893	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:18.734297037 CEST	49893	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:18.734324932 CEST	443	49893	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:18.735410929 CEST	49893	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:18.735419035 CEST	443	49893	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:18.777673006 CEST	443	49894	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:18.778476000 CEST	49894	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:18.778486013 CEST	443	49894	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:18.779160023 CEST	49894	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:18.779165030 CEST	443	49894	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:18.832897902 CEST	443	49893	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:18.833054066 CEST	443	49893	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:18.833110094 CEST	49893	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:18.833115101 CEST	443	49893	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:18.833250046 CEST	49893	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:18.872737885 CEST	443	49894	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:18.873095036 CEST	443	49894	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:18.873150110 CEST	49894	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:18.877314091 CEST	443	49895	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:18.920500040 CEST	49895	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:18.961945057 CEST	49893	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:18.961977005 CEST	443	49893	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:18.961988926 CEST	49893	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:18.961993933 CEST	443	49893	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:18.963208914 CEST	49894	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:18.963213921 CEST	443	49894	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:18.963246107 CEST	49894	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:18.963248968 CEST	443	49894	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:18.965327024 CEST	49895	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:18.965342045 CEST	443	49895	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:18.965748072 CEST	49895	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:18.965754032 CEST	443	49895	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:18.968648911 CEST	49897	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:18.968681097 CEST	443	49897	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:18.968770981 CEST	49897	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:18.969769955 CEST	49898	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:18.969778061 CEST	443	49898	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:18.969844103 CEST	49898	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:18.969952106 CEST	49898	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:18.969964981 CEST	443	49898	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:18.970181942 CEST	49897	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:18.970192909 CEST	443	49897	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:19.059040070 CEST	443	49895	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:19.059204102 CEST	443	49895	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:19.059305906 CEST	49895	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:19.074220896 CEST	49895	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:19.074244022 CEST	443	49895	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:19.074261904 CEST	49895	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:19.074270010 CEST	443	49895	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:19.131510019 CEST	49899	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:19.131558895 CEST	443	49899	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:19.131640911 CEST	49899	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:19.136055946 CEST	49899	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:19.136097908 CEST	443	49899	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:19.255609035 CEST	443	49896	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:19.262432098 CEST	49896	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:19.262458086 CEST	443	49896	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:19.263618946 CEST	49896	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:19.263632059 CEST	443	49896	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:19.369029999 CEST	443	49896	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:19.369183064 CEST	443	49896	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:19.369246960 CEST	49896	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:19.372222900 CEST	49896	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:19.372241974 CEST	443	49896	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:19.372273922 CEST	49896	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:19.372278929 CEST	443	49896	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:19.381381035 CEST	49900	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:19.381474972 CEST	443	49900	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:19.381563902 CEST	49900	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:19.381901979 CEST	49900	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:19.381937981 CEST	443	49900	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:19.576750994 CEST	443	49898	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:19.578571081 CEST	49898	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:19.578584909 CEST	443	49898	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:19.579199076 CEST	49898	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:19.579202890 CEST	443	49898	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:19.582954884 CEST	443	49897	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:19.583359957 CEST	49897	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:19.583376884 CEST	443	49897	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:19.583950996 CEST	49897	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:19.583957911 CEST	443	49897	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:19.671902895 CEST	443	49898	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:19.671933889 CEST	443	49898	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:19.671972990 CEST	443	49898	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:19.672015905 CEST	49898	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:19.675014973 CEST	49898	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:19.675029039 CEST	443	49898	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:19.679730892 CEST	443	49897	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:19.679791927 CEST	443	49897	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:19.679841995 CEST	49897	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:19.679851055 CEST	443	49897	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:19.679929018 CEST	443	49897	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:19.679975033 CEST	49897	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:19.687974930 CEST	49897	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:19.687984943 CEST	443	49897	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:19.709656954 CEST	49901	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:19.709693909 CEST	443	49901	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:19.709765911 CEST	49901	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:19.711172104 CEST	49902	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:19.711179018 CEST	443	49902	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:19.711340904 CEST	49902	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:19.711550951 CEST	49901	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:19.711565018 CEST	443	49901	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:19.711842060 CEST	49902	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:19.711850882 CEST	443	49902	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:19.789175987 CEST	443	49899	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:19.789850950 CEST	49899	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:19.789902925 CEST	443	49899	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:19.790400982 CEST	49899	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:19.790407896 CEST	443	49899	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:19.890088081 CEST	443	49899	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:19.890161991 CEST	443	49899	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:19.890237093 CEST	49899	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:19.890271902 CEST	443	49899	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:19.890296936 CEST	443	49899	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:19.890353918 CEST	49899	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:19.890522003 CEST	49899	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:19.890542984 CEST	443	49899	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:19.890556097 CEST	49899	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:19.890563965 CEST	443	49899	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:19.893729925 CEST	49903	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:19.893774986 CEST	443	49903	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:19.893845081 CEST	49903	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:19.893980980 CEST	49903	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:19.893995047 CEST	443	49903	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:20.034073114 CEST	443	49900	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:20.038983107 CEST	49900	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:20.039051056 CEST	443	49900	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:20.039418936 CEST	49900	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:20.039433956 CEST	443	49900	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:20.136106014 CEST	443	49900	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:20.136265993 CEST	443	49900	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:20.136620045 CEST	49900	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:20.136620045 CEST	49900	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:20.136620045 CEST	49900	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:20.139874935 CEST	49904	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:20.139925957 CEST	443	49904	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:20.140033960 CEST	49904	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:20.140218019 CEST	49904	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:20.140235901 CEST	443	49904	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:20.335628033 CEST	443	49902	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:20.336185932 CEST	49902	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:20.336220980 CEST	443	49902	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:20.336783886 CEST	49902	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:20.336788893 CEST	443	49902	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:20.377296925 CEST	443	49901	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:20.377851963 CEST	49901	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:20.377868891 CEST	443	49901	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:20.378403902 CEST	49901	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:20.378408909 CEST	443	49901	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:20.433070898 CEST	443	49902	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:20.433121920 CEST	443	49902	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:20.433387041 CEST	49902	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:20.433433056 CEST	49902	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:20.433445930 CEST	443	49902	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:20.433454990 CEST	49902	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:20.433459997 CEST	443	49902	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:20.436645985 CEST	49905	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:20.436742067 CEST	443	49905	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:20.436891079 CEST	49905	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:20.437026024 CEST	49905	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:20.437062025 CEST	443	49905	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:20.451770067 CEST	49900	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:20.451843023 CEST	443	49900	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:20.476592064 CEST	443	49901	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:20.476672888 CEST	443	49901	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:20.476788998 CEST	443	49901	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:20.476857901 CEST	49901	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:20.476979017 CEST	49901	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:20.476995945 CEST	443	49901	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:20.477014065 CEST	49901	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:20.477020025 CEST	443	49901	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:20.480956078 CEST	49906	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:20.480973959 CEST	443	49906	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:20.481247902 CEST	49906	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:20.481590986 CEST	49906	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:20.481602907 CEST	443	49906	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:20.514863968 CEST	443	49903	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:20.515573025 CEST	49903	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:20.515640020 CEST	443	49903	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:20.516069889 CEST	49903	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:20.516077995 CEST	443	49903	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:20.609342098 CEST	443	49903	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:20.609399080 CEST	443	49903	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:20.609479904 CEST	49903	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:20.609545946 CEST	443	49903	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:20.609586954 CEST	443	49903	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:20.609657049 CEST	49903	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:20.609810114 CEST	49903	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:20.609852076 CEST	443	49903	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:20.609879017 CEST	49903	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:20.609894991 CEST	443	49903	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:20.613425970 CEST	49907	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:20.613476992 CEST	443	49907	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:20.613764048 CEST	49907	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:20.613929033 CEST	49907	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:20.613940001 CEST	443	49907	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:20.761147976 CEST	443	49904	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:20.762021065 CEST	49904	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:20.762047052 CEST	443	49904	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:20.762582064 CEST	49904	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:20.762587070 CEST	443	49904	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:20.857531071 CEST	443	49904	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:20.857976913 CEST	443	49904	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:20.858026981 CEST	443	49904	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:20.858082056 CEST	49904	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:20.858109951 CEST	49904	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:20.858474016 CEST	49904	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:20.858505011 CEST	443	49904	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:20.858517885 CEST	49904	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:20.858522892 CEST	443	49904	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:20.861535072 CEST	49908	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:20.861644030 CEST	443	49908	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:20.861850023 CEST	49908	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:20.861998081 CEST	49908	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:20.862010002 CEST	443	49908	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:20.978955030 CEST	443	49905	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:20.979617119 CEST	49905	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:20.979701042 CEST	443	49905	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:20.980099916 CEST	49905	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:20.980107069 CEST	443	49905	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.048619986 CEST	443	49906	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.055432081 CEST	49906	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:21.055468082 CEST	443	49906	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.055875063 CEST	49906	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:21.055881023 CEST	443	49906	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.073498964 CEST	443	49905	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.073532104 CEST	443	49905	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.073585987 CEST	443	49905	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.073719978 CEST	49905	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:21.073987961 CEST	49905	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:21.074049950 CEST	443	49905	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.074084997 CEST	49905	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:21.074101925 CEST	443	49905	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.076896906 CEST	49909	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:21.076937914 CEST	443	49909	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.077018976 CEST	49909	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:21.077266932 CEST	49909	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:21.077282906 CEST	443	49909	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.150892019 CEST	443	49906	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.151058912 CEST	443	49906	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.151143074 CEST	49906	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:21.151364088 CEST	49906	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:21.151376963 CEST	443	49906	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.151395082 CEST	49906	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:21.151400089 CEST	443	49906	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.154299974 CEST	49910	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:21.154345036 CEST	443	49910	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.154428959 CEST	49910	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:21.154596090 CEST	49910	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:21.154613972 CEST	443	49910	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.255179882 CEST	443	49907	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.255764961 CEST	49907	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:21.255786896 CEST	443	49907	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.256424904 CEST	49907	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:21.256429911 CEST	443	49907	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.349446058 CEST	443	49907	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.349576950 CEST	443	49907	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.349710941 CEST	49907	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:21.349957943 CEST	49907	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:21.349978924 CEST	443	49907	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.349992037 CEST	49907	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:21.349997997 CEST	443	49907	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.353204012 CEST	49911	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:21.353254080 CEST	443	49911	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.353338003 CEST	49911	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:21.353518009 CEST	49911	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:21.353539944 CEST	443	49911	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.490474939 CEST	443	49908	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.491359949 CEST	49908	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:21.491400003 CEST	443	49908	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.491823912 CEST	49908	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:21.491830111 CEST	443	49908	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.549922943 CEST	443	49891	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.550704002 CEST	49891	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:21.550734997 CEST	443	49891	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.551182985 CEST	49891	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:21.551188946 CEST	443	49891	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.588295937 CEST	443	49908	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.588342905 CEST	443	49908	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.588433981 CEST	49908	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:21.590065002 CEST	49908	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:21.590080976 CEST	443	49908	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.594633102 CEST	49912	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:21.594680071 CEST	443	49912	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.594779968 CEST	49912	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:21.595537901 CEST	49912	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:21.595558882 CEST	443	49912	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.651094913 CEST	443	49891	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.651191950 CEST	443	49891	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.651257992 CEST	49891	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:21.651515007 CEST	49891	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:21.651541948 CEST	443	49891	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.651556969 CEST	49891	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:21.651563883 CEST	443	49891	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.654303074 CEST	49913	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:21.654386044 CEST	443	49913	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.654603958 CEST	49913	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:21.654869080 CEST	49913	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:21.654901981 CEST	443	49913	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.700109959 CEST	443	49909	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.748712063 CEST	49909	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:21.750799894 CEST	49909	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:21.750813961 CEST	443	49909	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.763972998 CEST	49909	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:21.763984919 CEST	443	49909	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.813278913 CEST	443	49910	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.813818932 CEST	49910	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:21.813865900 CEST	443	49910	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.814284086 CEST	49910	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:21.814295053 CEST	443	49910	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.863817930 CEST	443	49909	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.863857985 CEST	443	49909	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.863930941 CEST	443	49909	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.864000082 CEST	49909	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:21.864042044 CEST	49909	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:21.866111040 CEST	49909	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:21.866146088 CEST	443	49909	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.866274118 CEST	49909	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:21.866290092 CEST	443	49909	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.900080919 CEST	49914	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:21.900182009 CEST	443	49914	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.900270939 CEST	49914	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:21.900458097 CEST	49914	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:21.900481939 CEST	443	49914	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.912681103 CEST	443	49910	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.912844896 CEST	443	49910	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.912935019 CEST	49910	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:21.914074898 CEST	49910	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:21.914076090 CEST	49910	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:21.914094925 CEST	443	49910	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.914118052 CEST	443	49910	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.952136993 CEST	49915	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:21.952183008 CEST	443	49915	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.952258110 CEST	49915	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:21.955707073 CEST	49915	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:21.955744982 CEST	443	49915	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.984002113 CEST	443	49911	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.988055944 CEST	49911	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:21.988104105 CEST	443	49911	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:21.988486052 CEST	49911	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:21.988501072 CEST	443	49911	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:22.084064007 CEST	443	49911	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:22.084225893 CEST	443	49911	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:22.084285975 CEST	443	49911	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:22.084332943 CEST	49911	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:22.084357023 CEST	49911	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:22.093602896 CEST	49911	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:22.093615055 CEST	443	49911	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:22.093647957 CEST	49911	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:22.093652010 CEST	443	49911	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:22.110404968 CEST	49916	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:22.110446930 CEST	443	49916	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:22.110516071 CEST	49916	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:22.110816956 CEST	49916	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:22.110825062 CEST	443	49916	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:22.211627960 CEST	443	49912	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:22.212140083 CEST	49912	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:22.212179899 CEST	443	49912	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:22.212598085 CEST	49912	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:22.212608099 CEST	443	49912	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:22.264014959 CEST	443	49913	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:22.264841080 CEST	49913	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:22.264904976 CEST	443	49913	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:22.265171051 CEST	49913	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:22.265187025 CEST	443	49913	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:22.321885109 CEST	443	49912	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:22.321971893 CEST	443	49912	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:22.322283030 CEST	49912	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:22.322315931 CEST	49912	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:22.322315931 CEST	49912	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:22.322334051 CEST	443	49912	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:22.322343111 CEST	443	49912	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:22.325503111 CEST	49917	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:22.325546980 CEST	443	49917	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:22.325637102 CEST	49917	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:22.325799942 CEST	49917	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:22.325808048 CEST	443	49917	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:22.366151094 CEST	443	49913	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:22.366184950 CEST	443	49913	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:22.366233110 CEST	443	49913	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:22.366393089 CEST	49913	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:22.366394043 CEST	49913	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:22.366540909 CEST	49913	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:22.366540909 CEST	49913	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:22.366586924 CEST	443	49913	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:22.366616011 CEST	443	49913	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:22.369365931 CEST	49918	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:22.369411945 CEST	443	49918	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:22.369587898 CEST	49918	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:22.369643927 CEST	49918	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:22.369652987 CEST	443	49918	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:22.516235113 CEST	443	49914	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:22.516937017 CEST	49914	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:22.517002106 CEST	443	49914	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:22.517417908 CEST	49914	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:22.517433882 CEST	443	49914	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:22.606961012 CEST	443	49915	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:22.607839108 CEST	49915	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:22.607878923 CEST	443	49915	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:22.608437061 CEST	49915	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:22.608448029 CEST	443	49915	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:22.610430002 CEST	443	49914	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:22.610604048 CEST	443	49914	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:22.610754013 CEST	49914	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:22.610850096 CEST	49914	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:22.610850096 CEST	49914	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:22.610907078 CEST	443	49914	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:22.610943079 CEST	443	49914	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:22.614031076 CEST	49919	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:22.614073992 CEST	443	49919	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:22.614159107 CEST	49919	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:22.614327908 CEST	49919	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:22.614336967 CEST	443	49919	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:22.719733000 CEST	443	49915	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:22.719903946 CEST	443	49915	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:22.720083952 CEST	49915	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:22.720122099 CEST	49915	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:22.720139027 CEST	443	49915	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:22.720151901 CEST	49915	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:22.720156908 CEST	443	49915	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:22.723012924 CEST	49920	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:22.723053932 CEST	443	49920	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:22.723139048 CEST	49920	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:22.723305941 CEST	49920	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:22.723315001 CEST	443	49920	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:22.762043953 CEST	443	49916	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:22.765991926 CEST	49916	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:22.766006947 CEST	443	49916	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:22.766411066 CEST	49916	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:22.766417027 CEST	443	49916	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:22.864003897 CEST	443	49916	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:22.864423990 CEST	443	49916	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:22.864620924 CEST	49916	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:22.864620924 CEST	49916	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:22.864620924 CEST	49916	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:22.867233992 CEST	49921	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:22.867280006 CEST	443	49921	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:22.867352009 CEST	49921	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:22.867475033 CEST	49921	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:22.867480993 CEST	443	49921	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:22.934075117 CEST	443	49917	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:22.934624910 CEST	49917	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:22.934658051 CEST	443	49917	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:22.935048103 CEST	49917	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:22.935055971 CEST	443	49917	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:22.980209112 CEST	443	49918	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:22.981028080 CEST	49918	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:22.981046915 CEST	443	49918	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:22.981683016 CEST	49918	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:22.981690884 CEST	443	49918	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:23.028871059 CEST	443	49917	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:23.029031038 CEST	443	49917	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:23.029169083 CEST	49917	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:23.029467106 CEST	49917	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:23.029495001 CEST	443	49917	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:23.029509068 CEST	49917	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:23.029515028 CEST	443	49917	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:23.032785892 CEST	49922	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:23.032838106 CEST	443	49922	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:23.032910109 CEST	49922	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:23.033075094 CEST	49922	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:23.033093929 CEST	443	49922	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:23.074359894 CEST	443	49918	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:23.074457884 CEST	443	49918	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:23.074632883 CEST	49918	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:23.074676037 CEST	49918	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:23.074686050 CEST	443	49918	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:23.074700117 CEST	49918	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:23.074706078 CEST	443	49918	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:23.077392101 CEST	49923	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:23.077435017 CEST	443	49923	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:23.077950954 CEST	49923	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:23.078069925 CEST	49923	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:23.078104973 CEST	443	49923	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:23.170465946 CEST	49916	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:23.170497894 CEST	443	49916	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:23.440321922 CEST	443	49919	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:23.440819025 CEST	49919	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:23.440835953 CEST	443	49919	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:23.441246033 CEST	49919	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:23.441251040 CEST	443	49919	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:23.565813065 CEST	443	49919	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:23.565882921 CEST	443	49919	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:23.565939903 CEST	443	49919	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:23.566055059 CEST	49919	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:23.566055059 CEST	49919	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:23.566206932 CEST	49919	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:23.566234112 CEST	443	49919	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:23.566250086 CEST	49919	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:23.566257000 CEST	443	49919	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:23.568835020 CEST	49924	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:23.568890095 CEST	443	49924	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:23.568964958 CEST	49924	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:23.569106102 CEST	49924	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:23.569125891 CEST	443	49924	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:23.636079073 CEST	443	49921	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:23.636775970 CEST	49921	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:23.636801958 CEST	443	49921	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:23.637276888 CEST	49921	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:23.637283087 CEST	443	49921	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:23.642505884 CEST	443	49920	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:23.642992973 CEST	49920	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:23.643027067 CEST	443	49920	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:23.643415928 CEST	49920	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:23.643420935 CEST	443	49920	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:23.667768955 CEST	443	49922	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:23.668256044 CEST	49922	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:23.668287992 CEST	443	49922	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:23.668612957 CEST	49922	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:23.668622017 CEST	443	49922	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:23.733027935 CEST	443	49921	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:23.736876965 CEST	443	49923	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:23.737163067 CEST	443	49921	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:23.737215042 CEST	443	49921	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:23.737247944 CEST	49921	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:23.737272978 CEST	49921	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:23.737319946 CEST	49921	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:23.737337112 CEST	443	49921	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:23.737351894 CEST	49921	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:23.737358093 CEST	443	49921	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:23.737413883 CEST	49923	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:23.737438917 CEST	443	49923	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:23.737831116 CEST	49923	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:23.737834930 CEST	443	49923	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:23.740149975 CEST	49925	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:23.740202904 CEST	443	49925	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:23.740283966 CEST	49925	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:23.740406036 CEST	49925	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:23.740417957 CEST	443	49925	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:23.751808882 CEST	443	49920	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:23.752027035 CEST	443	49920	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:23.752120972 CEST	49920	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:23.752204895 CEST	49920	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:23.752204895 CEST	49920	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:23.752250910 CEST	443	49920	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:23.752278090 CEST	443	49920	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:23.754364014 CEST	49926	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:23.754400015 CEST	443	49926	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:23.754508018 CEST	49926	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:23.754627943 CEST	49926	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:23.754637003 CEST	443	49926	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:23.768248081 CEST	443	49922	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:23.768390894 CEST	443	49922	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:23.768481970 CEST	49922	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:23.769910097 CEST	49922	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:23.769910097 CEST	49922	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:23.769932032 CEST	443	49922	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:23.769942999 CEST	443	49922	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:23.770463943 CEST	49927	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:23.770513058 CEST	443	49927	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:23.770584106 CEST	49927	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:23.770679951 CEST	49927	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:23.770697117 CEST	443	49927	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:23.834291935 CEST	443	49923	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:23.834345102 CEST	443	49923	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:23.834403992 CEST	443	49923	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:23.834450006 CEST	49923	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:23.834517002 CEST	49923	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:23.834739923 CEST	49923	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:23.834741116 CEST	49923	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:23.834786892 CEST	443	49923	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:23.834814072 CEST	443	49923	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:23.837630033 CEST	49928	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:23.837692976 CEST	443	49928	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:23.837785006 CEST	49928	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:23.837937117 CEST	49928	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:23.837958097 CEST	443	49928	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:24.184094906 CEST	443	49924	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:24.184748888 CEST	49924	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:24.184777975 CEST	443	49924	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:24.185250998 CEST	49924	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:24.185256958 CEST	443	49924	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:24.278479099 CEST	443	49924	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:24.278767109 CEST	443	49924	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:24.278877020 CEST	49924	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:24.278877020 CEST	49924	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:24.278915882 CEST	49924	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:24.278938055 CEST	443	49924	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:24.282356977 CEST	49929	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:24.282408953 CEST	443	49929	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:24.282486916 CEST	49929	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:24.282604933 CEST	49929	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:24.282623053 CEST	443	49929	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:24.365077019 CEST	443	49925	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:24.365746021 CEST	49925	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:24.365772009 CEST	443	49925	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:24.366101980 CEST	49925	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:24.366107941 CEST	443	49925	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:24.386545897 CEST	443	49927	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:24.387125969 CEST	49927	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:24.387149096 CEST	443	49927	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:24.387389898 CEST	49927	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:24.387396097 CEST	443	49927	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:24.398535013 CEST	443	49926	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:24.398863077 CEST	49926	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:24.398888111 CEST	443	49926	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:24.399173021 CEST	49926	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:24.399178982 CEST	443	49926	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:24.452472925 CEST	443	49928	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:24.455995083 CEST	49928	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:24.456079960 CEST	443	49928	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:24.456466913 CEST	49928	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:24.456482887 CEST	443	49928	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:24.473062038 CEST	443	49925	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:24.473220110 CEST	443	49925	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:24.473325968 CEST	443	49925	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:24.473326921 CEST	49925	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:24.473377943 CEST	49925	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:24.488533974 CEST	443	49927	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:24.488563061 CEST	443	49927	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:24.488672972 CEST	49927	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:24.488688946 CEST	443	49927	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:24.489152908 CEST	443	49927	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:24.489212036 CEST	49927	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:24.497106075 CEST	443	49926	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:24.497271061 CEST	443	49926	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:24.497344017 CEST	49926	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:24.528534889 CEST	49925	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:24.528543949 CEST	443	49925	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:24.528578997 CEST	49925	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:24.528584003 CEST	443	49925	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:24.537720919 CEST	49927	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:24.537744999 CEST	443	49927	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:24.537759066 CEST	49927	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:24.537766933 CEST	443	49927	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:24.539412022 CEST	49926	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:24.539412022 CEST	49926	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:24.539421082 CEST	443	49926	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:24.539427996 CEST	443	49926	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:24.544341087 CEST	49930	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:24.544398069 CEST	443	49930	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:24.544467926 CEST	49930	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:24.544575930 CEST	49930	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:24.544586897 CEST	443	49930	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:24.546060085 CEST	49931	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:24.546135902 CEST	443	49931	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:24.546283007 CEST	49931	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:24.547094107 CEST	49931	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:24.547111034 CEST	443	49931	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:24.548054934 CEST	49932	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:24.548099995 CEST	443	49932	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:24.548161030 CEST	49932	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:24.548366070 CEST	49932	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:24.548383951 CEST	443	49932	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:24.549273968 CEST	443	49928	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:24.549294949 CEST	443	49928	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:24.549348116 CEST	49928	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:24.549359083 CEST	443	49928	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:24.549463987 CEST	443	49928	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:24.549477100 CEST	49928	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:24.549496889 CEST	443	49928	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:24.549511909 CEST	49928	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:24.549511909 CEST	49928	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:24.549519062 CEST	443	49928	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:24.549529076 CEST	443	49928	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:24.553020954 CEST	49933	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:24.553109884 CEST	443	49933	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:24.553183079 CEST	49933	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:24.553433895 CEST	49933	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:24.553469896 CEST	443	49933	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.127557039 CEST	443	49929	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.128298044 CEST	49929	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:25.128324032 CEST	443	49929	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.128806114 CEST	49929	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:25.128813982 CEST	443	49929	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.206636906 CEST	443	49931	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.207421064 CEST	49931	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:25.207496881 CEST	443	49931	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.207551956 CEST	443	49933	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.207576990 CEST	443	49932	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.207941055 CEST	49932	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:25.208003044 CEST	443	49932	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.208041906 CEST	49931	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:25.208056927 CEST	443	49931	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.208396912 CEST	49933	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:25.208446026 CEST	443	49933	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.208547115 CEST	49932	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:25.208563089 CEST	443	49932	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.208894014 CEST	49933	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:25.208906889 CEST	443	49933	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.224576950 CEST	443	49929	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.224800110 CEST	443	49929	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.224842072 CEST	443	49929	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.224864006 CEST	49929	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:25.224926949 CEST	49929	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:25.224989891 CEST	49929	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:25.225013971 CEST	443	49929	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.225028038 CEST	49929	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:25.225034952 CEST	443	49929	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.225845098 CEST	443	49930	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.226293087 CEST	49930	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:25.226304054 CEST	443	49930	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.226811886 CEST	49930	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:25.226818085 CEST	443	49930	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.228584051 CEST	49934	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:25.228646994 CEST	443	49934	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.228790045 CEST	49934	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:25.228944063 CEST	49934	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:25.228964090 CEST	443	49934	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.300040960 CEST	443	49931	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.300586939 CEST	443	49931	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.300666094 CEST	49931	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:25.300694942 CEST	443	49931	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.300729036 CEST	443	49931	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.300825119 CEST	49931	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:25.300883055 CEST	49931	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:25.300916910 CEST	443	49931	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.300941944 CEST	49931	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:25.300956964 CEST	443	49931	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.301748037 CEST	443	49933	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.301816940 CEST	443	49933	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.301887035 CEST	49933	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:25.301913023 CEST	443	49933	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.301943064 CEST	443	49933	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.302004099 CEST	49933	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:25.302119970 CEST	49933	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:25.302119970 CEST	49933	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:25.302148104 CEST	443	49933	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.302170038 CEST	443	49933	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.302988052 CEST	443	49932	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.303134918 CEST	443	49932	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.303208113 CEST	49932	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:25.303719044 CEST	49932	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:25.303756952 CEST	443	49932	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.303783894 CEST	49932	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:25.303797960 CEST	443	49932	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.304974079 CEST	49935	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:25.305020094 CEST	443	49935	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.305109024 CEST	49935	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:25.305327892 CEST	49935	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:25.305342913 CEST	443	49935	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.305974007 CEST	49936	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:25.306005955 CEST	443	49936	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.306082964 CEST	49936	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:25.306226969 CEST	49936	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:25.306241989 CEST	443	49936	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.306451082 CEST	49937	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:25.306489944 CEST	443	49937	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.306556940 CEST	49937	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:25.306679010 CEST	49937	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:25.306693077 CEST	443	49937	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.324353933 CEST	443	49930	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.324516058 CEST	443	49930	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.324596882 CEST	49930	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:25.324753046 CEST	49930	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:25.324774027 CEST	443	49930	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.324786901 CEST	49930	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:25.324794054 CEST	443	49930	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.328305960 CEST	49938	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:25.328326941 CEST	443	49938	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.328458071 CEST	49938	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:25.328674078 CEST	49938	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:25.328689098 CEST	443	49938	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.872842073 CEST	443	49934	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.874433994 CEST	49934	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:25.874501944 CEST	443	49934	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.875269890 CEST	49934	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:25.875293016 CEST	443	49934	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.932130098 CEST	443	49935	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.932959080 CEST	49935	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:25.932996035 CEST	443	49935	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.933623075 CEST	49935	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:25.933634996 CEST	443	49935	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.962991953 CEST	443	49936	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.963345051 CEST	443	49938	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.963656902 CEST	49936	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:25.963680983 CEST	443	49936	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.963778973 CEST	49938	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:25.963808060 CEST	443	49938	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.964277983 CEST	49936	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:25.964282990 CEST	443	49936	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.964405060 CEST	49938	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:25.964413881 CEST	443	49938	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.968813896 CEST	443	49937	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.969253063 CEST	49937	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:25.969266891 CEST	443	49937	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.969805956 CEST	49937	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:25.969810963 CEST	443	49937	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.971690893 CEST	443	49934	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.972333908 CEST	443	49934	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.972424030 CEST	49934	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:25.972516060 CEST	49934	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:25.972516060 CEST	49934	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:25.972563028 CEST	443	49934	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.972589970 CEST	443	49934	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.975939989 CEST	49939	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:25.975972891 CEST	443	49939	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:25.976067066 CEST	49939	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:25.976237059 CEST	49939	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:25.976247072 CEST	443	49939	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.030721903 CEST	443	49935	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.030760050 CEST	443	49935	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.030822992 CEST	443	49935	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.030842066 CEST	49935	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.030906916 CEST	49935	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.031047106 CEST	49935	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.031095028 CEST	443	49935	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.031121969 CEST	49935	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.031137943 CEST	443	49935	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.034701109 CEST	49940	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.034735918 CEST	443	49940	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.034806013 CEST	49940	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.034971952 CEST	49940	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.034986973 CEST	443	49940	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.060355902 CEST	443	49938	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.060435057 CEST	443	49938	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.060584068 CEST	49938	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.060678959 CEST	49938	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.060699940 CEST	443	49938	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.060715914 CEST	49938	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.060720921 CEST	443	49938	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.060729980 CEST	443	49936	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.060869932 CEST	443	49936	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.060920000 CEST	49936	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.061583996 CEST	49936	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.061594009 CEST	443	49936	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.061614037 CEST	49936	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.061618090 CEST	443	49936	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.066443920 CEST	49941	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.066545963 CEST	443	49941	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.066643953 CEST	49941	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.066792011 CEST	49941	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.066829920 CEST	443	49941	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.067948103 CEST	49942	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.067970991 CEST	443	49942	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.068063974 CEST	49942	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.068216085 CEST	49942	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.068243027 CEST	443	49942	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.108753920 CEST	443	49937	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.108831882 CEST	443	49937	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.108971119 CEST	443	49937	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.108999968 CEST	49937	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.109062910 CEST	49937	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.109249115 CEST	49937	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.109272957 CEST	443	49937	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.109286070 CEST	49937	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.109292030 CEST	443	49937	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.112476110 CEST	49943	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.112504959 CEST	443	49943	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.112585068 CEST	49943	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.112763882 CEST	49943	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.112777948 CEST	443	49943	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.597898006 CEST	443	49939	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.598484039 CEST	49939	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.598505020 CEST	443	49939	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.599083900 CEST	49939	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.599087954 CEST	443	49939	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.687283993 CEST	443	49940	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.687627077 CEST	443	49941	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.687959909 CEST	49940	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.687987089 CEST	443	49940	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.688150883 CEST	49941	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.688231945 CEST	443	49941	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.688643932 CEST	49940	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.688656092 CEST	443	49940	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.688739061 CEST	49941	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.688755035 CEST	443	49941	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.692749023 CEST	443	49939	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.692853928 CEST	443	49939	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.692913055 CEST	49939	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.693109989 CEST	49939	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.693129063 CEST	443	49939	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.693144083 CEST	49939	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.693149090 CEST	443	49939	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.694454908 CEST	443	49942	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.694884062 CEST	49942	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.694900036 CEST	443	49942	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.695478916 CEST	49942	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.695488930 CEST	443	49942	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.696567059 CEST	49944	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.696665049 CEST	443	49944	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.696763992 CEST	49944	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.697067022 CEST	49944	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.697104931 CEST	443	49944	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.733761072 CEST	443	49943	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.734235048 CEST	49943	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.734258890 CEST	443	49943	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.734848022 CEST	49943	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.734857082 CEST	443	49943	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.783255100 CEST	443	49941	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.783457041 CEST	443	49941	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.783538103 CEST	49941	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.783627033 CEST	49941	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.783627033 CEST	49941	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.783669949 CEST	443	49941	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.783694983 CEST	443	49941	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.786197901 CEST	443	49940	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.786233902 CEST	443	49940	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.786288977 CEST	49940	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.786294937 CEST	443	49940	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.786345005 CEST	49940	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.786473036 CEST	49940	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.786488056 CEST	443	49940	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.786506891 CEST	49940	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.786511898 CEST	443	49940	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.787195921 CEST	49945	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.787288904 CEST	443	49945	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.787369013 CEST	49945	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.787537098 CEST	49945	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.787575006 CEST	443	49945	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.789098978 CEST	49946	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.789122105 CEST	443	49946	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.789216042 CEST	49946	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.789371967 CEST	49946	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.789396048 CEST	443	49946	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.812911987 CEST	443	49942	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.813080072 CEST	443	49942	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.813160896 CEST	49942	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.813390970 CEST	49942	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.813390970 CEST	49942	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.813407898 CEST	443	49942	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.813416958 CEST	443	49942	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.816150904 CEST	49947	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.816186905 CEST	443	49947	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.816334963 CEST	49947	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.816483974 CEST	49947	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.816505909 CEST	443	49947	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.828484058 CEST	443	49943	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.828629971 CEST	443	49943	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.828685045 CEST	49943	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.828706980 CEST	443	49943	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.828747988 CEST	443	49943	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.828794956 CEST	49943	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.828836918 CEST	49943	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.828847885 CEST	443	49943	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.828856945 CEST	49943	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.828861952 CEST	443	49943	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.831351042 CEST	49948	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.831391096 CEST	443	49948	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:26.831485033 CEST	49948	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.831650019 CEST	49948	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:26.831664085 CEST	443	49948	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:27.326057911 CEST	443	49944	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:27.341938972 CEST	49944	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:27.342005014 CEST	443	49944	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:27.342875004 CEST	49944	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:27.342890024 CEST	443	49944	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:27.435812950 CEST	443	49945	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:27.444958925 CEST	443	49946	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:27.453372002 CEST	443	49944	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:27.453442097 CEST	443	49944	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:27.453530073 CEST	49944	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:27.457271099 CEST	443	49948	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:27.474124908 CEST	443	49947	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:27.482996941 CEST	49945	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:27.498605967 CEST	49946	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:27.502033949 CEST	49948	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:27.514247894 CEST	49947	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:27.713491917 CEST	49947	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:27.713531971 CEST	443	49947	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:27.714406013 CEST	49947	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:27.714412928 CEST	443	49947	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:27.714967012 CEST	49948	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:27.714999914 CEST	443	49948	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:27.715704918 CEST	49948	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:27.715711117 CEST	443	49948	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:27.716242075 CEST	49945	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:27.716265917 CEST	443	49945	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:27.716892004 CEST	49945	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:27.716897964 CEST	443	49945	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:27.717747927 CEST	49946	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:27.717761993 CEST	443	49946	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:27.718481064 CEST	49946	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:27.718486071 CEST	443	49946	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:27.718841076 CEST	49944	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:27.718877077 CEST	443	49944	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:27.718894958 CEST	49944	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:27.718904018 CEST	443	49944	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:27.773658037 CEST	49949	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:27.773703098 CEST	443	49949	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:27.773760080 CEST	49949	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:27.789555073 CEST	49949	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:27.789583921 CEST	443	49949	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:27.811625957 CEST	443	49948	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:27.811702967 CEST	443	49948	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:27.811757088 CEST	49948	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:27.811794043 CEST	443	49948	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:27.811835051 CEST	443	49948	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:27.811878920 CEST	49948	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:27.812422991 CEST	49948	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:27.812448025 CEST	443	49948	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:27.812458992 CEST	49948	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:27.812464952 CEST	443	49948	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:27.814501047 CEST	443	49945	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:27.814666033 CEST	443	49945	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:27.814718962 CEST	49945	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:27.814721107 CEST	443	49945	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:27.814765930 CEST	49945	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:27.815135956 CEST	49945	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:27.815152884 CEST	443	49945	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:27.815162897 CEST	49945	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:27.815167904 CEST	443	49945	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:27.816108942 CEST	443	49947	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:27.816207886 CEST	443	49947	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:27.816267967 CEST	49947	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:27.817111015 CEST	443	49946	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:27.817370892 CEST	443	49946	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:27.817436934 CEST	49946	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:27.820758104 CEST	49947	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:27.820787907 CEST	443	49947	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:27.820807934 CEST	49947	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:27.820816994 CEST	443	49947	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:27.825328112 CEST	49946	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:27.825336933 CEST	443	49946	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:27.825354099 CEST	49946	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:27.825359106 CEST	443	49946	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:27.829901934 CEST	49950	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:27.829994917 CEST	443	49950	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:27.830099106 CEST	49950	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:27.831783056 CEST	49951	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:27.831828117 CEST	443	49951	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:27.831892014 CEST	49951	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:27.833321095 CEST	49950	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:27.833352089 CEST	443	49950	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:27.843590975 CEST	49952	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:27.843632936 CEST	443	49952	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:27.843703032 CEST	49952	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:27.843761921 CEST	49951	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:27.843775988 CEST	443	49951	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:27.843868971 CEST	49952	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:27.843879938 CEST	443	49952	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:27.845931053 CEST	49953	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:27.846012115 CEST	443	49953	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:27.846121073 CEST	49953	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:27.846252918 CEST	49953	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:27.846265078 CEST	443	49953	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:28.456060886 CEST	443	49950	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:28.456852913 CEST	49950	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:28.456913948 CEST	443	49950	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:28.457310915 CEST	49950	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:28.457324982 CEST	443	49950	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:28.463036060 CEST	443	49949	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:28.463475943 CEST	49949	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:28.463547945 CEST	443	49949	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:28.463727951 CEST	49949	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:28.463745117 CEST	443	49949	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:28.487123966 CEST	443	49952	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:28.487689972 CEST	49952	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:28.487709999 CEST	443	49952	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:28.488491058 CEST	49952	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:28.488496065 CEST	443	49952	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:28.543867111 CEST	443	49953	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:28.544388056 CEST	49953	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:28.544414997 CEST	443	49953	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:28.545082092 CEST	49953	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:28.545089960 CEST	443	49953	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:28.551228046 CEST	443	49950	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:28.552067041 CEST	443	49950	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:28.552153111 CEST	49950	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:28.552186012 CEST	49950	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:28.552206993 CEST	443	49950	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:28.552220106 CEST	49950	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:28.552228928 CEST	443	49950	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:28.552625895 CEST	443	49951	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:28.553149939 CEST	49951	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:28.553173065 CEST	443	49951	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:28.553966045 CEST	49951	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:28.553972006 CEST	443	49951	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:28.555866957 CEST	49954	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:28.555902958 CEST	443	49954	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:28.555984020 CEST	49954	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:28.556126118 CEST	49954	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:28.556138992 CEST	443	49954	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:28.562093973 CEST	443	49949	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:28.562279940 CEST	443	49949	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:28.562339067 CEST	49949	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:28.562377930 CEST	49949	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:28.562391996 CEST	443	49949	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:28.562402964 CEST	49949	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:28.562410116 CEST	443	49949	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:28.564970016 CEST	49955	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:28.565006018 CEST	443	49955	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:28.565095901 CEST	49955	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:28.565239906 CEST	49955	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:28.565254927 CEST	443	49955	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:28.581995964 CEST	443	49952	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:28.582170963 CEST	443	49952	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:28.582287073 CEST	49952	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:28.582331896 CEST	49952	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:28.582356930 CEST	443	49952	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:28.582370043 CEST	49952	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:28.582376003 CEST	443	49952	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:28.585210085 CEST	49956	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:28.585264921 CEST	443	49956	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:28.585334063 CEST	49956	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:28.585479975 CEST	49956	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:28.585493088 CEST	443	49956	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:28.651943922 CEST	443	49951	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:28.652015924 CEST	443	49951	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:28.652077913 CEST	49951	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:28.652097940 CEST	443	49951	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:28.652129889 CEST	443	49951	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:28.652203083 CEST	49951	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:28.652399063 CEST	49951	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:28.652399063 CEST	49951	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:28.652411938 CEST	443	49951	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:28.652420998 CEST	443	49951	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:28.655627966 CEST	49957	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:28.655669928 CEST	443	49957	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:28.655754089 CEST	49957	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:28.655917883 CEST	49957	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:28.655932903 CEST	443	49957	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:28.897461891 CEST	443	49953	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:28.897830009 CEST	443	49953	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:28.897895098 CEST	49953	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:28.897903919 CEST	443	49953	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:28.897955894 CEST	49953	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:28.898014069 CEST	49953	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:28.898034096 CEST	443	49953	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:28.898049116 CEST	49953	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:28.898055077 CEST	443	49953	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:28.901259899 CEST	49958	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:28.901308060 CEST	443	49958	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:28.901392937 CEST	49958	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:28.901550055 CEST	49958	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:28.901561975 CEST	443	49958	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:29.213819027 CEST	443	49955	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:29.214651108 CEST	49955	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:29.214704990 CEST	443	49955	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:29.215238094 CEST	49955	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:29.215249062 CEST	443	49955	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:29.237960100 CEST	443	49954	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:29.238614082 CEST	49954	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:29.238641024 CEST	443	49954	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:29.239028931 CEST	49954	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:29.239034891 CEST	443	49954	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:29.248658895 CEST	443	49956	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:29.249350071 CEST	49956	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:29.249428034 CEST	443	49956	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:29.249775887 CEST	49956	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:29.249790907 CEST	443	49956	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:29.353713036 CEST	443	49955	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:29.353877068 CEST	443	49955	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:29.353976965 CEST	49955	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:29.354234934 CEST	49955	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:29.354265928 CEST	443	49955	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:29.354281902 CEST	49955	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:29.354290009 CEST	443	49955	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:29.356429100 CEST	443	49956	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:29.356585979 CEST	443	49956	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:29.356656075 CEST	49956	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:29.356703997 CEST	49956	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:29.356739044 CEST	443	49956	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:29.356765985 CEST	49956	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:29.356780052 CEST	443	49956	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:29.357830048 CEST	49959	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:29.357880116 CEST	443	49959	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:29.358009100 CEST	49959	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:29.358278036 CEST	49959	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:29.358306885 CEST	443	49959	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:29.358767033 CEST	49960	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:29.358805895 CEST	443	49960	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:29.358865976 CEST	49960	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:29.358961105 CEST	49960	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:29.358974934 CEST	443	49960	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:29.361047029 CEST	443	49954	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:29.361114979 CEST	443	49954	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:29.361160040 CEST	49954	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:29.361251116 CEST	49954	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:29.361265898 CEST	443	49954	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:29.361279011 CEST	49954	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:29.361284018 CEST	443	49954	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:29.363271952 CEST	49961	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:29.363363028 CEST	443	49961	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:29.363456011 CEST	49961	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:29.363590002 CEST	49961	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:29.363620996 CEST	443	49961	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:29.367861986 CEST	443	49957	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:29.368314981 CEST	49957	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:29.368344069 CEST	443	49957	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:29.368737936 CEST	49957	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:29.368750095 CEST	443	49957	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:29.469105005 CEST	443	49957	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:29.469315052 CEST	443	49957	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:29.469393015 CEST	49957	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:29.469419956 CEST	443	49957	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:29.469441891 CEST	443	49957	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:29.469510078 CEST	49957	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:29.469927073 CEST	49957	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:29.469944000 CEST	443	49957	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:29.469954014 CEST	49957	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:29.469959974 CEST	443	49957	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:29.473140001 CEST	49962	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:29.473257065 CEST	443	49962	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:29.473386049 CEST	49962	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:29.473561049 CEST	49962	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:29.473598957 CEST	443	49962	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:29.536659002 CEST	443	49958	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:29.537734985 CEST	49958	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:29.537764072 CEST	443	49958	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:29.538614035 CEST	49958	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:29.538621902 CEST	443	49958	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:29.643184900 CEST	443	49958	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:29.643526077 CEST	443	49958	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:29.643584013 CEST	49958	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:29.644171000 CEST	49958	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:29.644192934 CEST	443	49958	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:29.644207954 CEST	49958	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:29.644215107 CEST	443	49958	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:29.652198076 CEST	49963	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:29.652242899 CEST	443	49963	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:29.652337074 CEST	49963	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:29.652482986 CEST	49963	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:29.652501106 CEST	443	49963	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.010683060 CEST	443	49959	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.011317968 CEST	49959	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.011378050 CEST	443	49959	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.011774063 CEST	49959	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.011789083 CEST	443	49959	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.017129898 CEST	443	49960	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.017518044 CEST	49960	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.017571926 CEST	443	49960	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.017888069 CEST	49960	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.017894983 CEST	443	49960	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.032434940 CEST	443	49961	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.032857895 CEST	49961	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.032917976 CEST	443	49961	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.033159971 CEST	49961	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.033174038 CEST	443	49961	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.105474949 CEST	443	49959	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.105557919 CEST	443	49959	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.105627060 CEST	49959	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.105695009 CEST	443	49959	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.105736017 CEST	443	49959	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.105789900 CEST	49959	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.106101036 CEST	49959	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.106142998 CEST	443	49959	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.106199026 CEST	49959	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.106215000 CEST	443	49959	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.110716105 CEST	49964	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.110752106 CEST	443	49964	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.110807896 CEST	49964	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.111006975 CEST	49964	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.111020088 CEST	443	49964	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.115374088 CEST	443	49960	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.116019964 CEST	443	49960	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.116074085 CEST	49960	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.116137981 CEST	49960	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.116156101 CEST	443	49960	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.116169930 CEST	49960	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.116174936 CEST	443	49960	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.118010044 CEST	49965	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.118043900 CEST	443	49965	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.118117094 CEST	49965	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.118964911 CEST	49965	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.118979931 CEST	443	49965	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.122129917 CEST	443	49962	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.122936010 CEST	49962	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.122972965 CEST	443	49962	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.123356104 CEST	49962	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.123363018 CEST	443	49962	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.133991003 CEST	443	49961	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.134350061 CEST	443	49961	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.134396076 CEST	443	49961	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.134402037 CEST	49961	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.134440899 CEST	49961	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.134464025 CEST	49961	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.134481907 CEST	443	49961	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.134495020 CEST	49961	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.134500980 CEST	443	49961	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.137955904 CEST	49966	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.137995958 CEST	443	49966	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.138055086 CEST	49966	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.138178110 CEST	49966	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.138192892 CEST	443	49966	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.222477913 CEST	443	49962	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.222655058 CEST	443	49962	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.222810984 CEST	49962	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.223110914 CEST	49962	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.223143101 CEST	443	49962	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.223157883 CEST	49962	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.223165989 CEST	443	49962	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.225800991 CEST	49967	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.225836992 CEST	443	49967	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.225912094 CEST	49967	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.226017952 CEST	49967	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.226023912 CEST	443	49967	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.271125078 CEST	443	49963	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.271712065 CEST	49963	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.271733999 CEST	443	49963	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.272161007 CEST	49963	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.272170067 CEST	443	49963	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.366086006 CEST	443	49963	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.366549969 CEST	443	49963	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.366621017 CEST	49963	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.366681099 CEST	49963	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.366695881 CEST	443	49963	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.366708994 CEST	49963	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.366714001 CEST	443	49963	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.369599104 CEST	49968	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.369637012 CEST	443	49968	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.369709969 CEST	49968	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.369839907 CEST	49968	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.369844913 CEST	443	49968	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.740614891 CEST	443	49965	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.741157055 CEST	49965	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.741178036 CEST	443	49965	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.741611004 CEST	49965	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.741619110 CEST	443	49965	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.761523008 CEST	443	49964	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.761982918 CEST	49964	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.762017965 CEST	443	49964	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.762192965 CEST	49964	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.762197971 CEST	443	49964	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.769882917 CEST	443	49966	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.770132065 CEST	49966	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.770165920 CEST	443	49966	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.770414114 CEST	49966	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.770426989 CEST	443	49966	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.839328051 CEST	443	49965	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.839799881 CEST	443	49965	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.839905977 CEST	443	49965	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.840197086 CEST	49965	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.840197086 CEST	49965	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.840197086 CEST	49965	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.840198040 CEST	49965	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.843199015 CEST	49969	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.843290091 CEST	443	49969	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.843415022 CEST	49969	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.843518972 CEST	49969	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.843543053 CEST	443	49969	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.864428997 CEST	443	49964	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.864521980 CEST	443	49964	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.864689112 CEST	49964	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.866482973 CEST	49964	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.866482973 CEST	49964	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.866502047 CEST	443	49964	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.866511106 CEST	443	49964	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.866717100 CEST	443	49967	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.867160082 CEST	49970	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.867189884 CEST	443	49970	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.867522001 CEST	49967	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.867528915 CEST	443	49967	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.867572069 CEST	49970	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.867691040 CEST	49970	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.867717028 CEST	443	49970	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.867945910 CEST	49967	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.867949963 CEST	443	49967	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.868896008 CEST	443	49966	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.869179010 CEST	443	49966	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.869236946 CEST	49966	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.869278908 CEST	49966	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.869278908 CEST	49966	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.869302988 CEST	443	49966	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.869318962 CEST	443	49966	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.871397018 CEST	49971	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.871438980 CEST	443	49971	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.871515989 CEST	49971	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.871627092 CEST	49971	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.871640921 CEST	443	49971	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.967675924 CEST	443	49967	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.967874050 CEST	443	49967	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.968107939 CEST	49967	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.968226910 CEST	49967	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.968226910 CEST	49967	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.968245029 CEST	443	49967	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.968256950 CEST	443	49967	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.971190929 CEST	49972	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.971287966 CEST	443	49972	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:30.971431017 CEST	49972	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.971568108 CEST	49972	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:30.971586943 CEST	443	49972	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:31.030940056 CEST	443	49968	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:31.039134979 CEST	49968	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:31.039166927 CEST	443	49968	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:31.039619923 CEST	49968	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:31.039627075 CEST	443	49968	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:31.136389017 CEST	443	49968	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:31.136596918 CEST	443	49968	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:31.137061119 CEST	49968	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:31.137104988 CEST	49968	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:31.137120008 CEST	443	49968	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:31.137132883 CEST	49968	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:31.137137890 CEST	443	49968	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:31.140225887 CEST	49973	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:31.140280008 CEST	443	49973	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:31.140362978 CEST	49973	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:31.140491009 CEST	49973	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:31.140499115 CEST	443	49973	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:31.154974937 CEST	49965	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:31.155009985 CEST	443	49965	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:31.457565069 CEST	443	49969	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:31.458306074 CEST	49969	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:31.458374023 CEST	443	49969	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:31.458769083 CEST	49969	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:31.458781958 CEST	443	49969	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:31.491719961 CEST	443	49971	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:31.492235899 CEST	49971	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:31.492258072 CEST	443	49971	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:31.492605925 CEST	49971	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:31.492614031 CEST	443	49971	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:31.499021053 CEST	443	49970	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:31.499325991 CEST	49970	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:31.499353886 CEST	443	49970	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:31.499675035 CEST	49970	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:31.499686003 CEST	443	49970	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:31.552397966 CEST	443	49969	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:31.552542925 CEST	443	49969	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:31.552615881 CEST	49969	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:31.552731037 CEST	49969	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:31.552769899 CEST	443	49969	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:31.552795887 CEST	49969	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:31.552810907 CEST	443	49969	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:31.555748940 CEST	49974	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:31.555785894 CEST	443	49974	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:31.555845976 CEST	49974	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:31.555993080 CEST	49974	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:31.556006908 CEST	443	49974	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:31.585267067 CEST	443	49972	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:31.585777044 CEST	49972	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:31.585824013 CEST	443	49972	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:31.586230040 CEST	49972	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:31.586245060 CEST	443	49972	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:31.587300062 CEST	443	49971	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:31.587905884 CEST	443	49971	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:31.587965012 CEST	49971	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:31.587995052 CEST	49971	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:31.587996006 CEST	49971	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:31.588011026 CEST	443	49971	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:31.588021040 CEST	443	49971	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:31.590424061 CEST	49975	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:31.590481997 CEST	443	49975	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:31.590564013 CEST	49975	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:31.590662003 CEST	49975	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:31.590679884 CEST	443	49975	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:31.595993996 CEST	443	49970	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:31.596215010 CEST	443	49970	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:31.596285105 CEST	49970	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:31.596317053 CEST	49970	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:31.596317053 CEST	49970	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:31.596335888 CEST	443	49970	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:31.596359015 CEST	443	49970	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:31.598133087 CEST	49976	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:31.598177910 CEST	443	49976	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:31.598248005 CEST	49976	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:31.598356962 CEST	49976	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:31.598375082 CEST	443	49976	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:31.679007053 CEST	443	49972	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:31.679550886 CEST	443	49972	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:31.679631948 CEST	49972	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:31.679691076 CEST	49972	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:31.679691076 CEST	49972	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:31.679728031 CEST	443	49972	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:31.679755926 CEST	443	49972	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:31.682363033 CEST	49977	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:31.682400942 CEST	443	49977	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:31.682473898 CEST	49977	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:31.682593107 CEST	49977	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:31.682606936 CEST	443	49977	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:31.759310961 CEST	443	49973	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:31.759958982 CEST	49973	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:31.759980917 CEST	443	49973	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:31.760462046 CEST	49973	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:31.760467052 CEST	443	49973	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:31.853689909 CEST	443	49973	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:31.853739977 CEST	443	49973	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:31.853796005 CEST	49973	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:31.853806973 CEST	443	49973	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:31.853852034 CEST	443	49973	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:31.853899956 CEST	49973	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:31.854130983 CEST	49973	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:31.854142904 CEST	443	49973	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:31.854171991 CEST	49973	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:31.854176044 CEST	443	49973	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:31.856825113 CEST	49978	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:31.856864929 CEST	443	49978	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:31.856928110 CEST	49978	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:31.857050896 CEST	49978	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:31.857067108 CEST	443	49978	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:32.166683912 CEST	443	49974	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:32.167238951 CEST	49974	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:32.167259932 CEST	443	49974	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:32.167692900 CEST	49974	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:32.167697906 CEST	443	49974	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:32.209801912 CEST	443	49976	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:32.210323095 CEST	49976	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:32.210345030 CEST	443	49976	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:32.210727930 CEST	49976	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:32.210732937 CEST	443	49976	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:32.213498116 CEST	443	49975	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:32.213840008 CEST	49975	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:32.213876963 CEST	443	49975	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:32.214183092 CEST	49975	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:32.214191914 CEST	443	49975	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:32.263987064 CEST	443	49974	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:32.264214039 CEST	443	49974	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:32.264287949 CEST	49974	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:32.264497042 CEST	49974	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:32.264514923 CEST	443	49974	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:32.264538050 CEST	49974	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:32.264543056 CEST	443	49974	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:32.267082930 CEST	49979	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:32.267123938 CEST	443	49979	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:32.267205000 CEST	49979	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:32.267317057 CEST	49979	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:32.267330885 CEST	443	49979	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:32.293467999 CEST	443	49977	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:32.293900967 CEST	49977	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:32.293926954 CEST	443	49977	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:32.294255972 CEST	49977	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:32.294265985 CEST	443	49977	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:32.305071115 CEST	443	49976	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:32.305325985 CEST	443	49976	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:32.305398941 CEST	49976	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:32.305438042 CEST	49976	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:32.305438042 CEST	49976	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:32.305459023 CEST	443	49976	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:32.305469990 CEST	443	49976	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:32.307707071 CEST	49980	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:32.307760954 CEST	443	49980	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:32.307832956 CEST	49980	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:32.307971954 CEST	49980	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:32.307991982 CEST	443	49980	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:32.310302973 CEST	443	49975	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:32.310442924 CEST	443	49975	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:32.310492039 CEST	443	49975	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:32.310682058 CEST	49975	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:32.310745001 CEST	49975	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:32.310786009 CEST	443	49975	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:32.310818911 CEST	49975	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:32.310833931 CEST	443	49975	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:32.312711000 CEST	49981	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:32.312789917 CEST	443	49981	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:32.312882900 CEST	49981	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:32.313014984 CEST	49981	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:32.313045025 CEST	443	49981	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:32.387461901 CEST	443	49977	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:32.388148069 CEST	443	49977	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:32.388195992 CEST	443	49977	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:32.388211012 CEST	49977	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:32.388266087 CEST	49977	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:32.389625072 CEST	49977	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:32.389647007 CEST	443	49977	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:32.389662027 CEST	49977	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:32.389669895 CEST	443	49977	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:32.393289089 CEST	49982	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:32.393333912 CEST	443	49982	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:32.393415928 CEST	49982	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:32.397413969 CEST	49982	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:32.397425890 CEST	443	49982	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:32.479500055 CEST	443	49978	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:32.480098963 CEST	49978	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:32.480124950 CEST	443	49978	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:32.480557919 CEST	49978	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:32.480564117 CEST	443	49978	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:32.576350927 CEST	443	49978	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:32.576513052 CEST	443	49978	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:32.576582909 CEST	49978	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:32.576870918 CEST	49978	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:32.576891899 CEST	443	49978	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:32.576904058 CEST	49978	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:32.576911926 CEST	443	49978	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:32.580997944 CEST	49983	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:32.581053972 CEST	443	49983	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:32.581115961 CEST	49983	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:32.581258059 CEST	49983	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:32.581274033 CEST	443	49983	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:32.939862013 CEST	443	49979	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:32.940392971 CEST	49979	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:32.940414906 CEST	443	49979	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:32.940864086 CEST	49979	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:32.940867901 CEST	443	49979	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:32.940910101 CEST	443	49980	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:32.941164017 CEST	49980	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:32.941194057 CEST	443	49980	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:32.941514015 CEST	49980	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:32.941519976 CEST	443	49980	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:32.948627949 CEST	443	49981	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:32.949058056 CEST	49981	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:32.949095964 CEST	443	49981	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:32.949631929 CEST	49981	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:32.949645042 CEST	443	49981	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.049060106 CEST	443	49980	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.049129963 CEST	443	49980	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.049211979 CEST	49980	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.049454927 CEST	49980	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.049480915 CEST	443	49980	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.049500942 CEST	49980	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.049508095 CEST	443	49980	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.052397013 CEST	49984	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.052443027 CEST	443	49984	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.052445889 CEST	443	49982	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.052553892 CEST	49984	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.052635908 CEST	443	49979	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.052692890 CEST	49984	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.052704096 CEST	443	49984	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.052747011 CEST	443	49979	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.052797079 CEST	49979	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.052887917 CEST	49979	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.052896976 CEST	443	49979	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.052907944 CEST	49979	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.052911043 CEST	443	49979	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.053160906 CEST	49982	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.053229094 CEST	443	49982	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.053739071 CEST	49982	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.053754091 CEST	443	49982	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.053864002 CEST	443	49981	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.053903103 CEST	443	49981	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.053955078 CEST	49981	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.053973913 CEST	443	49981	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.054009914 CEST	443	49981	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.054059982 CEST	49981	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.054178953 CEST	49981	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.054214001 CEST	443	49981	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.054239988 CEST	49981	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.054254055 CEST	443	49981	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.055605888 CEST	49985	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.055658102 CEST	443	49985	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.055788040 CEST	49985	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.055907965 CEST	49985	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.055924892 CEST	443	49985	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.056680918 CEST	49986	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.056691885 CEST	443	49986	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.056771040 CEST	49986	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.056844950 CEST	49986	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.056859970 CEST	443	49986	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.149308920 CEST	443	49982	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.149796009 CEST	443	49982	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.149888992 CEST	49982	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.149955034 CEST	49982	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.149981976 CEST	443	49982	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.150007010 CEST	49982	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.150018930 CEST	443	49982	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.153033018 CEST	49987	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.153161049 CEST	443	49987	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.153268099 CEST	49987	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.153418064 CEST	49987	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.153434992 CEST	443	49987	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.252228022 CEST	443	49983	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.252842903 CEST	49983	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.252878904 CEST	443	49983	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.253307104 CEST	49983	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.253313065 CEST	443	49983	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.351130009 CEST	443	49983	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.351288080 CEST	443	49983	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.351509094 CEST	49983	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.351588011 CEST	49983	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.351607084 CEST	443	49983	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.351658106 CEST	49983	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.351663113 CEST	443	49983	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.355072021 CEST	49988	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.355098009 CEST	443	49988	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.355176926 CEST	49988	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.355437994 CEST	49988	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.355479956 CEST	443	49988	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.672333956 CEST	443	49984	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.673099995 CEST	49984	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.673129082 CEST	443	49984	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.673671961 CEST	49984	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.673676968 CEST	443	49984	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.693922043 CEST	443	49986	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.694674015 CEST	49986	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.694693089 CEST	443	49986	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.695220947 CEST	49986	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.695228100 CEST	443	49986	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.698254108 CEST	443	49985	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.698582888 CEST	49985	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.698590040 CEST	443	49985	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.698920965 CEST	49985	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.698925018 CEST	443	49985	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.772430897 CEST	443	49984	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.772494078 CEST	443	49984	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.772625923 CEST	443	49984	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.772735119 CEST	49984	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.772735119 CEST	49984	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.775554895 CEST	49984	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.775585890 CEST	443	49984	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.775600910 CEST	49984	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.775608063 CEST	443	49984	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.778875113 CEST	49989	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.778949022 CEST	443	49989	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.779047966 CEST	49989	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.779212952 CEST	49989	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.779232025 CEST	443	49989	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.786912918 CEST	443	49987	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.787494898 CEST	49987	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.787523031 CEST	443	49987	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.787966013 CEST	49987	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.787977934 CEST	443	49987	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.809973001 CEST	443	49986	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.810030937 CEST	443	49986	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.810111046 CEST	49986	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.810146093 CEST	443	49986	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.810349941 CEST	443	49986	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.810374022 CEST	49986	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.810374022 CEST	49986	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.810399055 CEST	443	49986	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.810414076 CEST	49986	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.810421944 CEST	443	49986	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.812649965 CEST	49990	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.812668085 CEST	443	49985	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.812676907 CEST	443	49990	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.812741995 CEST	443	49985	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.812766075 CEST	49990	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.812804937 CEST	49985	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.812877893 CEST	49985	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.812884092 CEST	443	49985	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.812916994 CEST	49985	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.812922001 CEST	443	49985	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.813029051 CEST	49990	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.813055038 CEST	443	49990	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.814677954 CEST	49991	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.814775944 CEST	443	49991	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.814912081 CEST	49991	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.814987898 CEST	49991	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.815010071 CEST	443	49991	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.882476091 CEST	443	49987	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.882529020 CEST	443	49987	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.882647991 CEST	49987	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.882659912 CEST	443	49987	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.882807016 CEST	49987	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.882982016 CEST	49987	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.883001089 CEST	443	49987	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.883011103 CEST	49987	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.883016109 CEST	443	49987	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.885896921 CEST	49992	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.885943890 CEST	443	49992	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:33.886039019 CEST	49992	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.886253119 CEST	49992	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:33.886271000 CEST	443	49992	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:34.020065069 CEST	443	49988	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:34.020693064 CEST	49988	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:34.020714045 CEST	443	49988	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:34.021167994 CEST	49988	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:34.021173000 CEST	443	49988	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:34.120690107 CEST	443	49988	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:34.120805979 CEST	443	49988	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:34.120938063 CEST	443	49988	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:34.121109962 CEST	49988	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:34.121180058 CEST	49988	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:34.121567011 CEST	49988	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:34.121567011 CEST	49988	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:34.121644020 CEST	443	49988	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:34.121678114 CEST	443	49988	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:34.124665022 CEST	49993	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:34.124762058 CEST	443	49993	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:34.124870062 CEST	49993	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:34.124995947 CEST	49993	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:34.125017881 CEST	443	49993	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:34.422468901 CEST	443	49990	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:34.423043013 CEST	49990	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:34.423062086 CEST	443	49990	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:34.423475027 CEST	49990	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:34.423482895 CEST	443	49990	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:34.428728104 CEST	443	49991	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:34.429142952 CEST	49991	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:34.429178953 CEST	443	49991	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:34.429456949 CEST	49991	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:34.429465055 CEST	443	49991	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:34.446120024 CEST	443	49989	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:34.446711063 CEST	49989	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:34.446779013 CEST	443	49989	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:34.447244883 CEST	49989	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:34.447268963 CEST	443	49989	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:34.518781900 CEST	443	49990	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:34.518940926 CEST	443	49990	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:34.519166946 CEST	49990	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:34.519258022 CEST	49990	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:34.519258022 CEST	49990	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:34.519295931 CEST	443	49990	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:34.519309044 CEST	443	49990	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:34.522886038 CEST	49994	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:34.522984028 CEST	443	49994	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:34.523098946 CEST	49994	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:34.523180962 CEST	443	49991	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:34.523257971 CEST	443	49991	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:34.523380995 CEST	49991	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:34.523380995 CEST	49991	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:34.523380995 CEST	49991	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:34.523432970 CEST	49994	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:34.523471117 CEST	443	49994	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:34.525218964 CEST	443	49992	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:34.525671959 CEST	49995	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:34.525707960 CEST	443	49995	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:34.525741100 CEST	49992	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:34.525757074 CEST	443	49992	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:34.525789022 CEST	49995	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:34.525950909 CEST	49995	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:34.525960922 CEST	443	49995	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:34.526206017 CEST	49992	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:34.526209116 CEST	443	49992	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:34.546657085 CEST	443	49989	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:34.546688080 CEST	443	49989	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:34.546798944 CEST	443	49989	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:34.546848059 CEST	49989	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:34.546971083 CEST	49989	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:34.546971083 CEST	49989	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:34.547729969 CEST	49989	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:34.547749043 CEST	443	49989	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:34.549575090 CEST	49996	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:34.549608946 CEST	443	49996	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:34.549669027 CEST	49996	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:34.549841881 CEST	49996	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:34.549848080 CEST	443	49996	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:34.626422882 CEST	443	49992	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:34.626504898 CEST	443	49992	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:34.626568079 CEST	49992	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:34.626908064 CEST	49992	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:34.626924038 CEST	443	49992	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:34.626940966 CEST	49992	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:34.626945972 CEST	443	49992	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:34.631108999 CEST	49997	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:34.631151915 CEST	443	49997	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:34.631258011 CEST	49997	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:34.631475925 CEST	49997	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:34.631494999 CEST	443	49997	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:34.736758947 CEST	443	49993	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:34.737481117 CEST	49993	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:34.737520933 CEST	443	49993	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:34.738251925 CEST	49993	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:34.738256931 CEST	443	49993	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:34.826761961 CEST	49991	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:34.826832056 CEST	443	49991	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:34.833578110 CEST	443	49993	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:34.833689928 CEST	443	49993	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:34.833746910 CEST	49993	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:34.833913088 CEST	49993	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:34.833940029 CEST	443	49993	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:34.833954096 CEST	49993	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:34.833961964 CEST	443	49993	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:34.837150097 CEST	49998	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:34.837191105 CEST	443	49998	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:34.837281942 CEST	49998	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:34.837446928 CEST	49998	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:34.837467909 CEST	443	49998	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.154865980 CEST	443	49995	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.155878067 CEST	49995	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:35.155925035 CEST	443	49995	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.156481981 CEST	49995	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:35.156488895 CEST	443	49995	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.170803070 CEST	443	49996	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.171509027 CEST	49996	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:35.171591997 CEST	443	49996	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.172081947 CEST	443	49994	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.172113895 CEST	49996	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:35.172130108 CEST	443	49996	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.172427893 CEST	49994	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:35.172498941 CEST	443	49994	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.172900915 CEST	49994	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:35.172930002 CEST	443	49994	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.252517939 CEST	443	49995	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.252547026 CEST	443	49995	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.252616882 CEST	443	49995	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.252727032 CEST	49995	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:35.252798080 CEST	49995	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:35.253118992 CEST	49995	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:35.253145933 CEST	443	49995	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.253163099 CEST	49995	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:35.253170967 CEST	443	49995	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.253463030 CEST	443	49997	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.254122972 CEST	49997	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:35.254152060 CEST	443	49997	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.254867077 CEST	49997	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:35.254877090 CEST	443	49997	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.257093906 CEST	49999	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:35.257131100 CEST	443	49999	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.257215023 CEST	49999	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:35.257385969 CEST	49999	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:35.257399082 CEST	443	49999	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.269177914 CEST	443	49994	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.269237995 CEST	443	49994	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.269324064 CEST	49994	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:35.269354105 CEST	443	49994	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.269386053 CEST	443	49994	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.269438982 CEST	49994	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:35.269478083 CEST	49994	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:35.269721985 CEST	49994	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:35.269745111 CEST	443	49994	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.269754887 CEST	49994	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:35.269761086 CEST	443	49994	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.272737026 CEST	50000	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:35.272783995 CEST	443	50000	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.272918940 CEST	50000	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:35.273102045 CEST	50000	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:35.273116112 CEST	443	50000	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.350512028 CEST	443	49997	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.350565910 CEST	443	49997	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.350640059 CEST	49997	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:35.350670099 CEST	443	49997	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.350739956 CEST	443	49997	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.350799084 CEST	49997	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:35.350938082 CEST	49997	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:35.350960016 CEST	443	49997	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.350974083 CEST	49997	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:35.350980997 CEST	443	49997	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.354563951 CEST	50001	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:35.354660988 CEST	443	50001	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.354758024 CEST	50001	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:35.354928970 CEST	50001	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:35.354967117 CEST	443	50001	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.428611040 CEST	443	49996	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.428638935 CEST	443	49996	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.428653955 CEST	443	49996	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.428725004 CEST	49996	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:35.428752899 CEST	443	49996	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.428807020 CEST	49996	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:35.428837061 CEST	49996	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:35.474669933 CEST	443	49998	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.475328922 CEST	49998	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:35.475354910 CEST	443	49998	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.475958109 CEST	49998	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:35.475965977 CEST	443	49998	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.511291027 CEST	443	49996	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.511394978 CEST	443	49996	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.511415958 CEST	49996	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:35.511477947 CEST	49996	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:35.511595964 CEST	49996	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:35.511612892 CEST	443	49996	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.511625051 CEST	49996	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:35.511632919 CEST	443	49996	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.514920950 CEST	50002	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:35.515028000 CEST	443	50002	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.515160084 CEST	50002	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:35.515351057 CEST	50002	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:35.515387058 CEST	443	50002	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.580884933 CEST	443	49998	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.580948114 CEST	443	49998	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.580992937 CEST	443	49998	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.581039906 CEST	49998	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:35.581072092 CEST	443	49998	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.581091881 CEST	49998	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:35.581130981 CEST	49998	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:35.670600891 CEST	443	49998	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.670676947 CEST	443	49998	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.670727015 CEST	49998	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:35.670744896 CEST	443	49998	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.670815945 CEST	49998	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:35.670842886 CEST	443	49998	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.670852900 CEST	49998	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:35.670905113 CEST	49998	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:35.671029091 CEST	49998	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:35.671047926 CEST	443	49998	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.671057940 CEST	49998	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:35.671062946 CEST	443	49998	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.674031973 CEST	50003	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:35.674081087 CEST	443	50003	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.674170017 CEST	50003	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:35.674308062 CEST	50003	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:35.674321890 CEST	443	50003	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.902091980 CEST	443	50000	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.902702093 CEST	50000	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:35.902725935 CEST	443	50000	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.903280973 CEST	50000	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:35.903286934 CEST	443	50000	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.906053066 CEST	443	49999	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.906459093 CEST	49999	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:35.906497955 CEST	443	49999	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.907033920 CEST	49999	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:35.907046080 CEST	443	49999	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.993179083 CEST	443	50001	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.993830919 CEST	50001	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:35.993875027 CEST	443	50001	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.994307995 CEST	50001	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:35.994318962 CEST	443	50001	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.999728918 CEST	443	50000	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.999757051 CEST	443	50000	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.999819040 CEST	50000	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:35.999836922 CEST	443	50000	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.999860048 CEST	443	50000	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:35.999917030 CEST	50000	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:36.000135899 CEST	50000	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:36.000152111 CEST	443	50000	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.000164032 CEST	50000	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:36.000171900 CEST	443	50000	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.003458977 CEST	50004	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:36.003495932 CEST	443	50004	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.003575087 CEST	50004	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:36.003741980 CEST	50004	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:36.003757954 CEST	443	50004	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.005678892 CEST	443	49999	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.005706072 CEST	443	49999	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.005786896 CEST	49999	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:36.005851030 CEST	443	49999	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.005878925 CEST	443	49999	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.005920887 CEST	49999	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:36.005966902 CEST	49999	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:36.006006956 CEST	49999	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:36.006042004 CEST	443	49999	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.006067991 CEST	49999	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:36.006082058 CEST	443	49999	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.008454084 CEST	50005	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:36.008498907 CEST	443	50005	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.008570910 CEST	50005	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:36.008735895 CEST	50005	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:36.008753061 CEST	443	50005	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.088377953 CEST	443	50001	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.088541031 CEST	443	50001	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.088669062 CEST	50001	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:36.088898897 CEST	50001	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:36.088948965 CEST	443	50001	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.088979959 CEST	50001	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:36.088995934 CEST	443	50001	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.092572927 CEST	50006	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:36.092624903 CEST	443	50006	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.092717886 CEST	50006	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:36.092974901 CEST	50006	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:36.092997074 CEST	443	50006	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.157632113 CEST	443	50002	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.158169031 CEST	50002	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:36.158222914 CEST	443	50002	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.158643007 CEST	50002	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:36.158657074 CEST	443	50002	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.257683992 CEST	443	50002	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.257862091 CEST	443	50002	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.257973909 CEST	50002	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:36.258200884 CEST	50002	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:36.258253098 CEST	443	50002	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.258285999 CEST	50002	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:36.258302927 CEST	443	50002	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.261760950 CEST	50007	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:36.261805058 CEST	443	50007	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.261914968 CEST	50007	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:36.262124062 CEST	50007	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:36.262140989 CEST	443	50007	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.306420088 CEST	443	50003	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.307205915 CEST	50003	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:36.307233095 CEST	443	50003	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.307687998 CEST	50003	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:36.307693005 CEST	443	50003	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.442985058 CEST	443	50003	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.443181992 CEST	443	50003	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.443279982 CEST	50003	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:36.443531990 CEST	50003	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:36.443552017 CEST	443	50003	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.443563938 CEST	50003	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:36.443568945 CEST	443	50003	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.447244883 CEST	50008	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:36.447305918 CEST	443	50008	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.447437048 CEST	50008	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:36.447684050 CEST	50008	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:36.447696924 CEST	443	50008	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.613348007 CEST	443	50004	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.613909006 CEST	50004	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:36.613924980 CEST	443	50004	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.614728928 CEST	50004	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:36.614734888 CEST	443	50004	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.645345926 CEST	443	50005	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.646028042 CEST	50005	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:36.646049023 CEST	443	50005	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.646790028 CEST	50005	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:36.646797895 CEST	443	50005	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.722687960 CEST	443	50004	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.722779989 CEST	443	50004	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.722963095 CEST	50004	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:36.723153114 CEST	50004	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:36.723182917 CEST	443	50004	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.723206997 CEST	50004	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:36.723215103 CEST	443	50004	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.726695061 CEST	50009	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:36.726739883 CEST	443	50009	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.726850986 CEST	50009	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:36.727056980 CEST	50009	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:36.727071047 CEST	443	50009	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.745495081 CEST	443	50006	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.746397018 CEST	50006	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:36.746429920 CEST	443	50006	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.746845961 CEST	50006	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:36.746853113 CEST	443	50006	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.747725964 CEST	443	50005	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.747781992 CEST	443	50005	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.747837067 CEST	443	50005	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.747906923 CEST	50005	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:36.747958899 CEST	50005	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:36.748609066 CEST	50005	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:36.748625994 CEST	443	50005	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.846515894 CEST	443	50006	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.846599102 CEST	443	50006	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.846731901 CEST	50006	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:36.846940994 CEST	50006	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:36.846965075 CEST	443	50006	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.847007990 CEST	50006	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:36.847014904 CEST	443	50006	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.896682024 CEST	443	50007	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.897402048 CEST	50007	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:36.897425890 CEST	443	50007	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.897934914 CEST	50007	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:36.897941113 CEST	443	50007	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.993247032 CEST	443	50007	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.993382931 CEST	443	50007	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.993477106 CEST	50007	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:36.993647099 CEST	50007	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:36.993665934 CEST	443	50007	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:36.993716955 CEST	50007	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:36.993725061 CEST	443	50007	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:37.097165108 CEST	443	50008	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:37.097719908 CEST	50008	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:37.097745895 CEST	443	50008	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:37.098166943 CEST	50008	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:37.098172903 CEST	443	50008	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:37.198097944 CEST	443	50008	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:37.198261023 CEST	443	50008	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:37.198368073 CEST	50008	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:37.198529005 CEST	50008	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:37.198551893 CEST	443	50008	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:37.198587894 CEST	50008	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:37.198594093 CEST	443	50008	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:37.339932919 CEST	443	50009	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:37.340630054 CEST	50009	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:37.340697050 CEST	443	50009	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:37.341286898 CEST	50009	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:37.341301918 CEST	443	50009	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:37.433839083 CEST	443	50009	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:37.433949947 CEST	443	50009	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:37.434040070 CEST	50009	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:37.434317112 CEST	50009	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:37.434345961 CEST	443	50009	13.107.246.45	192.168.2.4
Oct 7, 2024 23:31:37.434364080 CEST	50009	443	192.168.2.4	13.107.246.45
Oct 7, 2024 23:31:37.434372902 CEST	443	50009	13.107.246.45	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 23:29:57.625946045 CEST	54153	53	192.168.2.4	1.1.1.1
Oct 7, 2024 23:29:57.752155066 CEST	53	54153	1.1.1.1	192.168.2.4
Oct 7, 2024 23:29:57.754556894 CEST	53602	53	192.168.2.4	1.1.1.1
Oct 7, 2024 23:29:57.769582033 CEST	53	53602	1.1.1.1	192.168.2.4
Oct 7, 2024 23:29:57.773353100 CEST	61276	53	192.168.2.4	1.1.1.1
Oct 7, 2024 23:29:57.783200979 CEST	53	61276	1.1.1.1	192.168.2.4
Oct 7, 2024 23:29:57.788654089 CEST	64388	53	192.168.2.4	1.1.1.1
Oct 7, 2024 23:29:57.797616959 CEST	53	64388	1.1.1.1	192.168.2.4
Oct 7, 2024 23:29:57.801572084 CEST	55644	53	192.168.2.4	1.1.1.1
Oct 7, 2024 23:29:57.811142921 CEST	53	55644	1.1.1.1	192.168.2.4
Oct 7, 2024 23:29:57.820533991 CEST	60787	53	192.168.2.4	1.1.1.1
Oct 7, 2024 23:29:57.829662085 CEST	53	60787	1.1.1.1	192.168.2.4
Oct 7, 2024 23:29:57.831048965 CEST	63787	53	192.168.2.4	1.1.1.1
Oct 7, 2024 23:29:57.839858055 CEST	53	63787	1.1.1.1	192.168.2.4
Oct 7, 2024 23:29:57.841243029 CEST	62722	53	192.168.2.4	1.1.1.1
Oct 7, 2024 23:29:57.850153923 CEST	53	62722	1.1.1.1	192.168.2.4
Oct 7, 2024 23:29:57.851495028 CEST	58952	53	192.168.2.4	1.1.1.1
Oct 7, 2024 23:29:57.861772060 CEST	53	58952	1.1.1.1	192.168.2.4
Oct 7, 2024 23:29:57.864209890 CEST	49784	53	192.168.2.4	1.1.1.1
Oct 7, 2024 23:29:57.872526884 CEST	53	49784	1.1.1.1	192.168.2.4
Oct 7, 2024 23:29:59.215095043 CEST	64816	53	192.168.2.4	1.1.1.1
Oct 7, 2024 23:29:59.430512905 CEST	53	64816	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 7, 2024 23:29:57.625946045 CEST	192.168.2.4	1.1.1.1	0xe9e4	Standard query (0)	trustterwowqm.shop	A (IP address)	IN (0x0001)	false
Oct 7, 2024 23:29:57.754556894 CEST	192.168.2.4	1.1.1.1	0xeb6b	Standard query (0)	mobbipenju.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 23:29:57.773353100 CEST	192.168.2.4	1.1.1.1	0x629a	Standard query (0)	eaglepawnoy.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 23:29:57.788654089 CEST	192.168.2.4	1.1.1.1	0x8746	Standard query (0)	dissapoiznw.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 23:29:57.801572084 CEST	192.168.2.4	1.1.1.1	0xb71	Standard query (0)	studennotediw.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 23:29:57.820533991 CEST	192.168.2.4	1.1.1.1	0x42a3	Standard query (0)	bathdoomgaz.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 23:29:57.831048965 CEST	192.168.2.4	1.1.1.1	0xa261	Standard query (0)	spirittunek.store	A (IP address)	IN (0x0001)	false
Oct 7, 2024 23:29:57.841243029 CEST	192.168.2.4	1.1.1.1	0x27cd	Standard query (0)	licendfilteo.site	A (IP address)	IN (0x0001)	false
Oct 7, 2024 23:29:57.851495028 CEST	192.168.2.4	1.1.1.1	0x5747	Standard query (0)	clearancek.site	A (IP address)	IN (0x0001)	false
Oct 7, 2024 23:29:57.864209890 CEST	192.168.2.4	1.1.1.1	0xc758	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 23:29:59.215095043 CEST	192.168.2.4	1.1.1.1	0x4f63	Standard query (0)	sergei-esenin.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 7, 2024 23:29:57.752155066 CEST	1.1.1.1	192.168.2.4	0xe9e4	Name error (3)	trustterwowqm.shop	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 23:29:57.769582033 CEST	1.1.1.1	192.168.2.4	0xeb6b	Name error (3)	mobbipenju.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 23:29:57.783200979 CEST	1.1.1.1	192.168.2.4	0x629a	Name error (3)	eaglepawnoy.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 23:29:57.797616959 CEST	1.1.1.1	192.168.2.4	0x8746	Name error (3)	dissapoiznw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 23:29:57.811142921 CEST	1.1.1.1	192.168.2.4	0xb71	Name error (3)	studennotediw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 23:29:57.829662085 CEST	1.1.1.1	192.168.2.4	0x42a3	Name error (3)	bathdoomgaz.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 23:29:57.839858055 CEST	1.1.1.1	192.168.2.4	0xa261	Name error (3)	spirittunek.store	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 23:29:57.850153923 CEST	1.1.1.1	192.168.2.4	0x27cd	Name error (3)	licendfilteo.site	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 23:29:57.861772060 CEST	1.1.1.1	192.168.2.4	0x5747	Name error (3)	clearancek.site	none	none	A (IP address)	IN (0x0001)	false
Oct 7, 2024 23:29:57.872526884 CEST	1.1.1.1	192.168.2.4	0xc758	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Oct 7, 2024 23:29:59.423942089 CEST	1.1.1.1	192.168.2.4	0x9ff1	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 23:29:59.423942089 CEST	1.1.1.1	192.168.2.4	0x9ff1	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.18	A (IP address)	IN (0x0001)	false
Oct 7, 2024 23:29:59.423942089 CEST	1.1.1.1	192.168.2.4	0x9ff1	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.34	A (IP address)	IN (0x0001)	false
Oct 7, 2024 23:29:59.430512905 CEST	1.1.1.1	192.168.2.4	0x4f63	No error (0)	sergei-esenin.com		172.67.206.204	A (IP address)	IN (0x0001)	false
Oct 7, 2024 23:29:59.430512905 CEST	1.1.1.1	192.168.2.4	0x4f63	No error (0)	sergei-esenin.com		104.21.53.8	A (IP address)	IN (0x0001)	false
Oct 7, 2024 23:30:01.290646076 CEST	1.1.1.1	192.168.2.4	0xdfe2	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 23:30:01.290646076 CEST	1.1.1.1	192.168.2.4	0xdfe2	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Oct 7, 2024 23:30:53.713037968 CEST	1.1.1.1	192.168.2.4	0x2f5d	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 23:30:53.713037968 CEST	1.1.1.1	192.168.2.4	0x2f5d	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

sergei-esenin.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	104.102.49.254	443	7380	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 21:29:58 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-07 21:29:58 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Mon, 07 Oct 2024 21:29:58 GMT Content-Length: 34837 Connection: close Set-Cookie: sessionid=1fb3b345d331768ab96c705c; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=None
2024-10-07 21:29:58 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-07 21:29:59 UTC	16384	IN	Data Raw: 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0d 0a 09 09 6a 51 75 65 72 79 28 66 75 6e 63 74 69 6f 6e 28 24 29 20 7b 0d 0a 09 09 09 24 28 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 27 29 2e 76 5f 74 6f 6f 6c 74 69 70 28 7b 27 6c 6f 63 61 74 69 6f 6e 27 3a 27 62 6f 74 74 6f 6d 27 2c 20 27 64 65 73 74 72 6f 79 57 68 65 6e 44 6f 6e 65 27 3a 20 66 61 6c 73 65 2c 20 27 74 6f 6f 6c 74 69 70 43 6c 61 73 73 27 3a 20 27 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 65 6e 74 27 2c 20 27 6f 66 66 73 65 74 59 27 3a 2d 36 2c 20 27 6f 66 66 73 65 74 58 27 3a 20 31 2c 20 27 68 6f 72 69 7a 6f 6e 74 61 6c 53 6e 61 70 27 3a 20 34 2c 20 27 74 6f 6f 6c 74 69 70 50 61 72 65 6e 74 27 3a 20 27 23 67 6c 6f Data Ascii: <script type="text/javascript">jQuery(function($) {$('#global_header .supernav').v_tooltip({'location':'bottom', 'destroyWhenDone': false, 'tooltipClass': 'supernav_content', 'offsetY':-6, 'offsetX': 1, 'horizontalSnap': 4, 'tooltipParent': '#glo
2024-10-07 21:29:59 UTC	3768	IN	Data Raw: 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 73 75 6d 6d 61 72 79 5f 66 6f 6f 74 65 72 22 3e 0d 0a 09 09 09 09 09 09 09 3c 73 70 61 6e 20 64 61 74 61 2d 70 61 6e 65 6c 3d 22 7b 26 71 75 6f 74 3b 66 6f 63 75 73 61 62 6c 65 26 71 75 6f 74 3b 3a 74 72 75 65 2c 26 71 75 6f 74 3b 63 6c 69 63 6b 4f 6e 41 63 74 69 76 61 74 65 26 71 75 6f 74 3b 3a 74 72 75 65 7d 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 3e 56 69 65 77 20 6d 6f 72 65 20 69 6e 66 6f 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 20 24 4a 28 20 66 75 6e 63 74 69 6f 6e 28 29 Data Ascii: <div class="profile_summary_footer"><span data-panel="{"focusable":true,"clickOnActivate":true}" class="whiteLink" class="whiteLink">View more info</span></div><script type="text/javascript"> $J( function()
2024-10-07 21:29:59 UTC	171	IN	Data Raw: 09 3c 73 70 61 6e 3e 56 69 65 77 20 6d 6f 62 69 6c 65 20 77 65 62 73 69 74 65 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 0d 0a 09 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 63 6f 6e 74 65 6e 74 20 2d 2d 3e 0d 0a 0d 0a 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 66 72 61 6d 65 20 2d 2d 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <span>View mobile website</span></div></div></div></div>... responsive_page_content --></div>... responsive_page_frame --></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49733	172.67.206.204	443	7380	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 21:29:59 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: sergei-esenin.com
2024-10-07 21:29:59 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-07 21:30:00 UTC	774	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 21:30:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=tt8hho1r12niekg1l15ies3ovm; expires=Fri, 31 Jan 2025 15:16:39 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=e2QDMURn1UA8GVpCi5gBXGJVcggjpNhsHRemrNzliF0xDzTjkP7KMO1t1KU8Q1P5CAVQO%2F2W0qXcEHwOvFC9Ad3tSWcR%2BdxPmVPg37YhWj9zPnU%2Bfh1OnYzMaxM0uP8E7eGHCQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cf0fd65f83f0f8b-EWR
2024-10-07 21:30:00 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-07 21:30:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	17:29:56
Start date:	07/10/2024
Path:	C:\Users\user\Desktop\PFW1cgN8EK.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PFW1cgN8EK.exe"
Imagebase:	0x600000
File size:	550'912 bytes
MD5 hash:	65C2ECFC7938FBB0AE043F410D7422BC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	17:29:56
Start date:	07/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0x1d0000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	17:29:56
Start date:	07/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0x450000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	17:29:56
Start date:	07/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0x790000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	17:29:56
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7348 -s 280
Imagebase:	0x800000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	6.1%
Total number of Nodes:	229
Total number of Limit Nodes:	3

Executed Functions

Function 00602021 Relevance: 9.4, APIs: 1, Strings: 4, Instructions: 631
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(006858D8,?,00000040,?), ref: 00602738

Strings

MZx, xrefs: 0060274B, 00602757, 0060275C
a, xrefs: 00602296
', xrefs: 00602718
S, xrefs: 0060206A

Memory Dump Source

Source File: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID: ProtectVirtual
String ID: '$MZx$S$a
API String ID: 544645111-3057195942
Opcode ID: 473057a85d55ad0b2cff40158f5c6aff2bef7df5440f6add7922c00cf966e623
Instruction ID: 32757908b599e87defc39ac1c93a8c4761c438ddd1a90854e3d9f7be67aea591
Opcode Fuzzy Hash: 473057a85d55ad0b2cff40158f5c6aff2bef7df5440f6add7922c00cf966e623
Instruction Fuzzy Hash: 78F1C2279B4E1B06E70C64398D7A2E7954BDFAA730F914333BE63973F4E36909429244

Function 00616368 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE(?,00618F1C,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 0061639C
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00618F1C,?,?,00000000,?,00000000), ref: 006163BA

Strings

R[`, xrefs: 00616396

Memory Dump Source

Source File: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID: String
String ID: R[`
API String ID: 2568140703-2223293963
Opcode ID: 027befe82634877285140c2e4c588c2bc64f0b8747160df1061fa0caf36d7677
Instruction ID: c34c9bbeb353c6f8475e2d7a88f51309ece21e6d8f8a7a076f8ecee00be08204
Opcode Fuzzy Hash: 027befe82634877285140c2e4c588c2bc64f0b8747160df1061fa0caf36d7677
Instruction Fuzzy Hash: 29F0683600056ABBCF125F90DC099DE7E27AB48360B099015FA2965120C736D9B2EB94

Function 00618E2E Relevance: 4.7, APIs: 3, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__freea.LIBCMT ref: 00618FDD

Part of subcall function 00613A83: HeapAlloc.KERNEL32(00000000,0061A1AA,?,?,0061A1AA,00000220,?,?,?), ref: 00613AB5

__freea.LIBCMT ref: 00618FF2
__freea.LIBCMT ref: 00619002

Memory Dump Source

Source File: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID: __freea$AllocHeap
String ID:
API String ID: 85559729-0
Opcode ID: 254b0df5e8b9492ac9aebba272a651a0ccef5f0aff31efbff3f492d14c220c45
Instruction ID: f8b0dc17d71e0e3044ce176c73eeb92c76a857685cec2948700e9104e068dca3
Opcode Fuzzy Hash: 254b0df5e8b9492ac9aebba272a651a0ccef5f0aff31efbff3f492d14c220c45
Instruction Fuzzy Hash: 14518072600216AFEB259F64CC81EFB36ABEB44790B1D0129FD08D7250EB71CD92C764

Function 0061A3A6 Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00619ED6: GetOEMCP.KERNEL32(00000000,?,?,?,?), ref: 00619F01

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,0061A1ED,?,00000000,?,?,?), ref: 0061A407
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,0061A1ED,?,00000000,?,?,?), ref: 0061A449

Memory Dump Source

Source File: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 4b283dbd028a337e73f5ae40c87551d09e63162796eecf3271ed2acfc3ae2aa8
Instruction ID: b2980e2fa56ec671d68b69339da52b0c066816b6a5757f26c1b4d8f6f188acab
Opcode Fuzzy Hash: 4b283dbd028a337e73f5ae40c87551d09e63162796eecf3271ed2acfc3ae2aa8
Instruction Fuzzy Hash: D9512470A056459FDB21CFB5C8456EABBF7EF84304F1C406ED082CB351E6B89986CB52

Function 00619FAA Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(E8458D00,?,0061A1F9,0061A1ED,00000000), ref: 00619FDC

Memory Dump Source

Source File: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: ae40ea353766e3714447c6d779afc3989a08458a749b09f7bdcf9c30baa5c72e
Instruction ID: 56a40e1ed58ef643468ee2f6a41815d2956d6570dccc32e3ed00b490ff3f25ff
Opcode Fuzzy Hash: ae40ea353766e3714447c6d779afc3989a08458a749b09f7bdcf9c30baa5c72e
Instruction Fuzzy Hash: C3518C719052589EDB218F68CC80BF67BBAEB59308F2805EDE09AC7142D3359D86DF21

Non-executed Functions

Function 0064CB98 Relevance: 20.7, Strings: 15, Instructions: 1988COMMON

Download Yara Rule

Strings

(+*-, xrefs: 0064D6A1
efgh, xrefs: 0064D6D8
,/.!, xrefs: 0064D6AC
@GFE, xrefs: 0064D92F
yz{|, xrefs: 0064D6B7
4, xrefs: 0064D80C
`onm, xrefs: 0064D8F8
,, xrefs: 0064DC6F
pwvu, xrefs: 0064D8AB
lcba, xrefs: 0064D8CC
$'&9, xrefs: 0064D6C2
8;:=, xrefs: 0064D6CD
lkji, xrefs: 0064D903
p, xrefs: 0064E019
0325, xrefs: 0064D6E3

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID: $'&9$(+*-$,$,/.!$0325$4$8;:=$@GFE$`onm$efgh$lcba$lkji$p$pwvu$yz{|
API String ID: 0-4284672935
Opcode ID: 17a9da9fb198ce4cff53889ca9a74bbfb73063c59ecad7ce56909eb832305105
Instruction ID: ce8df0fead1bcc3d4d7b691445449ce8aa92769f6aaa995a6596f8068ccfa073
Opcode Fuzzy Hash: 17a9da9fb198ce4cff53889ca9a74bbfb73063c59ecad7ce56909eb832305105
Instruction Fuzzy Hash: 1DF276B15083819BEB70CF54C884BAFBBE2BF86305F58491DE4C99B292D7359805CB67

Function 0065C568 Relevance: 11.5, Strings: 9, Instructions: 256COMMON

Download Yara Rule

Strings

8O?A, xrefs: 0065C5E9
;_(Q, xrefs: 0065C605
7S.U, xrefs: 0065C60C
W7JI, xrefs: 0065C5DB
0W4i, xrefs: 0065C613
4[&], xrefs: 0065C5FE
=G!Y, xrefs: 0065C5F7
2C!E, xrefs: 0065C5F0
A3W5, xrefs: 0065C5D4

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID: 0W4i$2C!E$4[&]$7S.U$8O?A$;_(Q$=G!Y$A3W5$W7JI
API String ID: 0-83756894
Opcode ID: c1abe5d969104e4faaeeb94a57dcd0a77674fd740321b7385ce3fa244a949eb5
Instruction ID: cc6f98516aaebcc329685a93953ffec0a43b9a7e51484e6ea75f8c5e452e25e7
Opcode Fuzzy Hash: c1abe5d969104e4faaeeb94a57dcd0a77674fd740321b7385ce3fa244a949eb5
Instruction Fuzzy Hash: AA818BB49003069FCB10CF94C991BAEB7B2FF46312F644188E845BB791E334AE55CBA5

Function 0061C9E9 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00614EB1: GetLastError.KERNEL32(?,00000008,00619482), ref: 00614EB5
Part of subcall function 00614EB1: SetLastError.KERNEL32(00000000,0062C480,00000024,00610419), ref: 00614F57

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 0061CAF5
IsValidCodePage.KERNEL32(00000000), ref: 0061CB3E
IsValidLocale.KERNEL32(?,00000001), ref: 0061CB4D
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 0061CB95
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 0061CBB4

Strings

||b, xrefs: 0061CA4E

Memory Dump Source

Source File: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID: ||b
API String ID: 415426439-2191294120
Opcode ID: 0ae159ebd848c49a419b998a7064eccdaa70f948797dc0e33e759bb9810bdb50
Instruction ID: 50d7b077c9fbc7ce82b095db28af6f58e3706837eeb20bca741b9e4dc48fbe9c
Opcode Fuzzy Hash: 0ae159ebd848c49a419b998a7064eccdaa70f948797dc0e33e759bb9810bdb50
Instruction Fuzzy Hash: DD51B171A40219ABDB11DFA5DC42EFE77BAFF08710F1C4429E910E7290E7709A85CB65

Function 0061D39B Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0061D57F

Strings

1#QNAN, xrefs: 0061D4AE
1#SNAN, xrefs: 0061D4A7
1#IND, xrefs: 0061D4A0
1#INF, xrefs: 0061D4D1

Memory Dump Source

Source File: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 60a2f164bd94ed0a35cd9f9d40d5393e8ca502d53eb32470fcb1a6b1d95fbbe7
Instruction ID: 5efed5e3294128071457bf210a555b8ba49c7254d283e0fb836824ed8e864676
Opcode Fuzzy Hash: 60a2f164bd94ed0a35cd9f9d40d5393e8ca502d53eb32470fcb1a6b1d95fbbe7
Instruction Fuzzy Hash: 61D21971E086298FDB65CE28DD407EAB7B6EB44305F1845EAD80DE7240E779AEC18F41

Function 0061C085 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00614EB1: GetLastError.KERNEL32(?,00000008,00619482), ref: 00614EB5
Part of subcall function 00614EB1: SetLastError.KERNEL32(00000000,0062C480,00000024,00610419), ref: 00614F57

GetACP.KERNEL32(?,?,?,?,?,?,00611848,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0061C146
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00611848,?,?,?,00000055,?,-00000050,?,?), ref: 0061C171
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 0061C2D4

Strings

||b, xrefs: 0061C0C7
utf8, xrefs: 0061C243

Memory Dump Source

Source File: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8$||b
API String ID: 607553120-2227450998
Opcode ID: dfaa80937569aa615e45ab0ce3f57e0fc80a3bc651fa7eba131b6d1765fefce4
Instruction ID: 3c1638d45b30d802df2948ddf68375a06c045bf71f08af9de17f6da650471e04
Opcode Fuzzy Hash: dfaa80937569aa615e45ab0ce3f57e0fc80a3bc651fa7eba131b6d1765fefce4
Instruction Fuzzy Hash: 01710B31A80712ABDB24AB75DC42BEE73AAEF45720F1C4429F905D7281EB74DAC18764

Function 0061C814 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,0061CB32,00000002,00000000,?,?,?,0061CB32,?,00000000), ref: 0061C8AD
GetLocaleInfoW.KERNEL32(?,20001004,0061CB32,00000002,00000000,?,?,?,0061CB32,?,00000000), ref: 0061C8D6
GetACP.KERNEL32(?,?,0061CB32,?,00000000), ref: 0061C8EB

Strings

OCP, xrefs: 0061C868
ACP, xrefs: 0061C832

Memory Dump Source

Source File: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 8d723626ab22082520c1f97c1527e63425c805776448406fd5b3f095b95f16c1
Instruction ID: 8175b04367667fa423771f300f7964af2ae668348fe7f7931c7e5bbf0ee70732
Opcode Fuzzy Hash: 8d723626ab22082520c1f97c1527e63425c805776448406fd5b3f095b95f16c1
Instruction Fuzzy Hash: 72219522A80101DADB748F55C981ADF7BA7AF54B70B5E8424E90AD7300E731DD81D760

Function 0060FEF0 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 449COMMONLIBRARYCODE

Download Yara Rule

Strings

Ga, xrefs: 00610233, 00610211
Ga, xrefs: 0060FF0B, 0061008E, 006102B7, 00610250, 006100DD

Memory Dump Source

Source File: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID: Ga$Ga
API String ID: 0-4175219222
Opcode ID: b78e9bc5a25061f1abca4818c36b3245c47596756df3441acd3b4668cd2eb70a
Instruction ID: adb99c0ade00d1c9e11b0d23a9b3d942146f4decb9aa5c57c4bd53c1335c97c0
Opcode Fuzzy Hash: b78e9bc5a25061f1abca4818c36b3245c47596756df3441acd3b4668cd2eb70a
Instruction Fuzzy Hash: FEF14171E002199FDF14CFA8C8846EDB7B2FF89314F198269E815AB381D7709E81CB94

Function 0062E175 Relevance: 7.2, Strings: 5, Instructions: 909COMMON

Download Yara Rule

Strings

0, xrefs: 0062ED58
0, xrefs: 0062F3A0
i, xrefs: 0062F7FE
@, xrefs: 0062F90C
0, xrefs: 0062ECA9

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID: 0$0$0$@$i
API String ID: 0-3124195287
Opcode ID: 71f3d092406bf2b1da397f9251c19992cfeb9473183140990b6d77d2ed173c24
Instruction ID: 467732d0df0adc88ee86e48b83a013f64f35ac4ab42a428a674048c75be22698
Opcode Fuzzy Hash: 71f3d092406bf2b1da397f9251c19992cfeb9473183140990b6d77d2ed173c24
Instruction Fuzzy Hash: EF72CF71A087618FD318DF28D49076ABBE2ABC5704F188A3DE8DA97391D275DC45CF82

Function 0062E2D5 Relevance: 6.7, Strings: 5, Instructions: 453COMMON

Download Yara Rule

Strings

gfff, xrefs: 0062F0A1
-, xrefs: 0062EFFD
0, xrefs: 0062E5FB
gfff, xrefs: 0062F0EC
gfff, xrefs: 0062F033

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID: -$0$gfff$gfff$gfff
API String ID: 0-1217629319
Opcode ID: e70ea6af7df4099828697e47c503092b59018ffd614456e3a52484d2297035ff
Instruction ID: c6f34d843a7713fee13b6ab0c63c8472d792d456b3217c4b2cfa5ae057aa5f6a
Opcode Fuzzy Hash: e70ea6af7df4099828697e47c503092b59018ffd614456e3a52484d2297035ff
Instruction Fuzzy Hash: 6AF1B071A087618FD318CF29D49075AFBE2ABD9314F488A3DE8D9CB381D275D945CB82

Function 0063C938 Relevance: 6.7, Strings: 5, Instructions: 409COMMON

Download Yara Rule

Strings

JpzN, xrefs: 0063CCA5
vLyB, xrefs: 0063CCDB, 0063CCE3
\W, xrefs: 0063CAEC
d`df, xrefs: 0063C94A
q-s, xrefs: 0063CA32

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID: JpzN$\W$d`df$vLyB$q-s
API String ID: 0-2943124228
Opcode ID: c0123f9ddd81bde4ead67e13c59693835463b28b846828819b093025ea9eb232
Instruction ID: 21893ae858eb0a32f1cab9cabe0c6c2074bb110359ac1b7cc25d1cdf98021b0e
Opcode Fuzzy Hash: c0123f9ddd81bde4ead67e13c59693835463b28b846828819b093025ea9eb232
Instruction Fuzzy Hash: 52D189B150C3808BD311EF188490A6EBBE2AF96754F680D5CF4D5AB352C336C949CBE6

Function 0064EF70 Relevance: 6.5, Strings: 5, Instructions: 258COMMON

Download Yara Rule

Strings

KC, xrefs: 0064EFCD
-{4y, xrefs: 0064F17B, 0064F183
zC, xrefs: 0064EFC5
H~, xrefs: 0064EFD5
k$i, xrefs: 0064F259, 0064F25D

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID: k$i$-{4y$H~$KC$zC
API String ID: 0-1198185020
Opcode ID: cb060303c5a1a0c4baba74594868201dd970643a30ef342180b2144766bb590c
Instruction ID: eb5bb1c243a894e675af597f6c1fb3faeb4950094548df22c542f9e9eae87f3e
Opcode Fuzzy Hash: cb060303c5a1a0c4baba74594868201dd970643a30ef342180b2144766bb590c
Instruction Fuzzy Hash: 328199B04083408BD720EF18C891B6AB7F1FF96764F449A1CE4D59B391E339D905CBA6

Function 00613C92 Relevance: 6.3, APIs: 4, Instructions: 337COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00613D1F

Memory Dump Source

Source File: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 40f0e063838af908aa0c23a01ee66fead67f3bdac29e3056e6e3dd52480c6ad0
Instruction ID: 38c06ba13e3767d7018df9d68e14710fff6d4208dadb392d2b89aed6cdc44edf
Opcode Fuzzy Hash: 40f0e063838af908aa0c23a01ee66fead67f3bdac29e3056e6e3dd52480c6ad0
Instruction Fuzzy Hash: B3B12C72D042659FDB158F68C8817EEBBB6EF55310F1C816AE506AB341D234DE86CBA0

Function 00607922 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 0060792E
IsDebuggerPresent.KERNEL32 ref: 006079FA
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00607A13
UnhandledExceptionFilter.KERNEL32(?), ref: 00607A1D

Memory Dump Source

Source File: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 33e65b59e1c3f564565143e6fe29199a11bd179b2ee7f00ad5778462fd75bdba
Instruction ID: 12c46f469a9643fc227ae9f80a340f059f67c4e9860bd0411b2d967cdc38a21a
Opcode Fuzzy Hash: 33e65b59e1c3f564565143e6fe29199a11bd179b2ee7f00ad5778462fd75bdba
Instruction Fuzzy Hash: 2B31F775D4522C9BDB60DFA4D949BCDBBB8AF08300F1041EAE50CAB290EB749B858F55

Function 00675288 Relevance: 5.3, Strings: 4, Instructions: 348COMMON

Download Yara Rule

Strings

oD, xrefs: 0067551C
kD, xrefs: 00675509
, xrefs: 006755BE, 00675717, 006756EB, 0067559B, 006755A3, 006756F3
P, xrefs: 0067542E

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID: P$kD$oD$
API String ID: 0-1115615460
Opcode ID: ed1cfad7e5831a2e1b48057f332d66576bd6f5d84c9fae2d0d95bb32115eec55
Instruction ID: ed620975f7b1c0cefa29f95bf10620499883d637ed1cdbd22074de0fdae7c53e
Opcode Fuzzy Hash: ed1cfad7e5831a2e1b48057f332d66576bd6f5d84c9fae2d0d95bb32115eec55
Instruction Fuzzy Hash: 6DC110325083608FD715CE28D84065EB7E2EBC1714F19CA6CE8AAAB394D7B5DC45CBC2

Function 0064FAE2 Relevance: 5.2, Strings: 4, Instructions: 209COMMON

Download Yara Rule

Strings

~, xrefs: 0064FB45
I}, xrefs: 0064FD29
v}, xrefs: 0064FB37
I}, xrefs: 0064FB3E

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID: I}$I}$v}$~
API String ID: 0-1535326304
Opcode ID: 18d941ddf0c7df2a2020a84959c7baed37afdcccf923d2de2c574be5e132557b
Instruction ID: 231d39b988375d8a900dc9a544ebbd30da1a3bca6d7fcc16b18b03b2fd72691c
Opcode Fuzzy Hash: 18d941ddf0c7df2a2020a84959c7baed37afdcccf923d2de2c574be5e132557b
Instruction Fuzzy Hash: B7618FB09012568BDB10CF94CC91BBEBBB2FF56341F184998E891AF392D3759841CBA5

Function 00673642 Relevance: 5.1, Strings: 4, Instructions: 142COMMON

Download Yara Rule

Strings

US, xrefs: 0067364A
, xrefs: 0067385E, 0067383B, 00673843
Q_, xrefs: 00673652
@, xrefs: 006737F5

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID: @$Q_$US$
API String ID: 0-1387636662
Opcode ID: b84bd2cad6fc919d03a3147de07ecc8b5f863db2d204b0a85fdfcd1955775bcd
Instruction ID: 66e60f1dbee629923ffa2a80d1ea351aff199012a5787ade77b83f28bc4c3d58
Opcode Fuzzy Hash: b84bd2cad6fc919d03a3147de07ecc8b5f863db2d204b0a85fdfcd1955775bcd
Instruction Fuzzy Hash: C74184B0418352ABD714DF14C850A2ABBF2EF86344F54891CF4C9AB3A1E335DA45DB5A

Function 0061C498 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00614EB1: GetLastError.KERNEL32(?,00000008,00619482), ref: 00614EB5
Part of subcall function 00614EB1: SetLastError.KERNEL32(00000000,0062C480,00000024,00610419), ref: 00614F57

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0061C4EC
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0061C536
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0061C5FC

Memory Dump Source

Source File: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: d3791a014bc7c8847bee3e8dad7ac1acc16c6f8cc0a7fc20880d302cc9aea2f4
Instruction ID: d5ff03b07d8c3d7b49a6ada2b4e7acd4eef21974f2c95e6d740f46589367ef77
Opcode Fuzzy Hash: d3791a014bc7c8847bee3e8dad7ac1acc16c6f8cc0a7fc20880d302cc9aea2f4
Instruction Fuzzy Hash: 566173725802179FEB689F24CC82BFE77AAEF04320F184169E905C6685E774E9D1CB94

Function 0060DA73 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 0060DB6B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 0060DB75
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 0060DB82

Memory Dump Source

Source File: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: cdb2769b6a7a778c33a46a2a5568feed492f04de0c57d5a7286d4d312a92df61
Instruction ID: 8ba8af0bd6e9acb42b7ee90e3002563cb73d91c7c5b3c850d80e41806862f288
Opcode Fuzzy Hash: cdb2769b6a7a778c33a46a2a5568feed492f04de0c57d5a7286d4d312a92df61
Instruction Fuzzy Hash: F331D47494122CABCB65DF68DC89BCDBBB9BF18310F5041DAE40CA7290EB349B858F54

Function 006736EE Relevance: 3.9, Strings: 3, Instructions: 122COMMON

Download Yara Rule

Strings

, xrefs: 0067385E, 0067383B, 00673843
]oXm, xrefs: 00673716
@, xrefs: 006737F5

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID: @$]oXm$
API String ID: 0-4013158905
Opcode ID: 08b563d773aac84b36ad4809571cbbdf506584426bf330bc6785f7f8a4602933
Instruction ID: ff491122a95bd5745bb0ed5897ae979e725b90d2108590a3fd45481ab6ccd839
Opcode Fuzzy Hash: 08b563d773aac84b36ad4809571cbbdf506584426bf330bc6785f7f8a4602933
Instruction Fuzzy Hash: E34141B44183919BD714DF14C49062EBBF2EF86344F54891CF8C9AB361D33ACA85DB5A

Function 0065C224 Relevance: 3.8, Strings: 3, Instructions: 38COMMON

Download Yara Rule

Strings

Q^\X, xrefs: 0065C23A
UNOc, xrefs: 0065C232
KFCI, xrefs: 0065C252

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID: KFCI$Q^\X$UNOc
API String ID: 0-1593643587
Opcode ID: c1021c8647da17318554d3aa5cff67c87dd53425995099f84c7b189f47ca34d0
Instruction ID: fb73345e5b79879d528e099f41f85a7c5456b0c6445d026fede943d6c9494c14
Opcode Fuzzy Hash: c1021c8647da17318554d3aa5cff67c87dd53425995099f84c7b189f47ca34d0
Instruction Fuzzy Hash: 541109B0508380AFD3618F94C480A1EFFF1AB8A781F10980CFAD857222C3B5C8858F17

Function 0061622B Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,006123AE,?,20001004,00000000,00000002,?,?,006119B0), ref: 0061625F

Strings

R[`, xrefs: 0061624A

Memory Dump Source

Source File: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID: InfoLocale
String ID: R[`
API String ID: 2299586839-2223293963
Opcode ID: aa141e434321edc317f6231a1e703f7401024a2a9158ecee622e6bc3a5a1486b
Instruction ID: f499b82d6c3006cd9fc1db2538fcddb547e1e14cd770636d07ab7a0ba31963bb
Opcode Fuzzy Hash: aa141e434321edc317f6231a1e703f7401024a2a9158ecee622e6bc3a5a1486b
Instruction Fuzzy Hash: 82E04F36500638BBCF222F60DC08AEE7F2BEF44760F088015FD0565261CB758E62AAA5

Function 006749F8 Relevance: 2.8, Strings: 2, Instructions: 288COMMON

Download Yara Rule

Strings

, xrefs: 00674A69, 00674B39, 00674C4D, 00674B70, 00674B0C, 00674A3C, 00674A48, 00674B18, 00674B7B, 00674C56
, xrefs: 00674C0C, 00674BDC, 00674BE5

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-1425349742
Opcode ID: a72b061ef2fa19078f6f09b4256c813a26286e548eea71359ce8abeef3a1e115
Instruction ID: db157d73511aaf69ddeceabcbd44bd24b85f87fd70f39a015f8fb5bcb9dd19a8
Opcode Fuzzy Hash: a72b061ef2fa19078f6f09b4256c813a26286e548eea71359ce8abeef3a1e115
Instruction Fuzzy Hash: 5FA1C071608341ABEB24CF14CC44BABB7E6EF85350F54892CF98997391EB31E940CB96

Function 00676FD8 Relevance: 2.7, Strings: 2, Instructions: 228COMMON

Download Yara Rule

Strings

, xrefs: 0067702E, 00677142, 0067711B, 0067700B, 00677013, 00677123
, xrefs: 006770CE

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-1425349742
Opcode ID: e90198aaeed22a300b19465d833889039e3ddf500042478477c72a525097edc6
Instruction ID: 8726a977a797517a33f92b76e6dffee2d775999b4e9ad9131ad5f933fbf12fdd
Opcode Fuzzy Hash: e90198aaeed22a300b19465d833889039e3ddf500042478477c72a525097edc6
Instruction Fuzzy Hash: 5671CD7050C341ABCB10AF58C880A2EB7E6EF95710F58C92CF5D98B3A2D736D954CB56

Function 00655EC3 Relevance: 2.6, Strings: 2, Instructions: 140COMMON

Download Yara Rule

Strings

^TPX, xrefs: 00655FE9
6, xrefs: 00656061

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID: 6$^TPX
API String ID: 0-3674074485
Opcode ID: e2faa7a7b5874149e8eed49c136e69c5cac99755a3b347c5e8b82d654e240883
Instruction ID: 06808442cb188b4335beed7547f49ec7cdeed46bec799c1171f25f105297ae14
Opcode Fuzzy Hash: e2faa7a7b5874149e8eed49c136e69c5cac99755a3b347c5e8b82d654e240883
Instruction Fuzzy Hash: 0C510FB050C7808FD3629F2A859466AFBF2AB92746FA4595CE4E14B3A1C332C449CF17

Function 00676EA8 Relevance: 2.6, Strings: 2, Instructions: 98COMMON

Download Yara Rule

Strings

, xrefs: 00676F7E, 00676F5B, 00676F63
@, xrefs: 00676F10

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID: @$
API String ID: 0-736778079
Opcode ID: 0ac285f3c4d7bf6ff568a0e3d31a6644a2a8a6f4a62bd3ece0da7e21683cf0fc
Instruction ID: 2adc761f39e839d97f1c87508f99f35fbcdfb95f9e88d23ae8fd218aa9e2e514
Opcode Fuzzy Hash: 0ac285f3c4d7bf6ff568a0e3d31a6644a2a8a6f4a62bd3ece0da7e21683cf0fc
Instruction Fuzzy Hash: CE3167719083049BD314DF14D880A6FFBE6EF86304F14CA2DF59897291D339D908CBAA

Function 0063BB58 Relevance: 2.6, Strings: 2, Instructions: 82COMMON

Download Yara Rule

Strings

p, xrefs: 0063BBC1, 0063BB9B
p, xrefs: 0063BBE9

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID: p$p
API String ID: 0-2001073228
Opcode ID: 9ccebd6029074dcc193b65c5d4f3edf18eb513497d73d4234c938a2efa72fd27
Instruction ID: b41009a582207b287c969a51c9a303ef82e8c44a4801ffa7204e5d00e182d05e
Opcode Fuzzy Hash: 9ccebd6029074dcc193b65c5d4f3edf18eb513497d73d4234c938a2efa72fd27
Instruction Fuzzy Hash: DC311DB0D0024A9BDB00CF98C8866AEFFB2FB0A310F145519E654BB791D734A994CBE5

Function 00636C29 Relevance: 2.6, Strings: 2, Instructions: 71COMMON

Download Yara Rule

Strings

8, xrefs: 00636C7F
0, xrefs: 00636C87

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: 101362e4397cd3868e0d82b2d27283c317da1e6fc92abe76afbb474ffa19d7ef
Instruction ID: 61d9fe1313facc430f8b4830f9e7de4a0c57884f4eebf624671248554b1386ef
Opcode Fuzzy Hash: 101362e4397cd3868e0d82b2d27283c317da1e6fc92abe76afbb474ffa19d7ef
Instruction Fuzzy Hash: FB31D63660D3C58BD315CA58D44069FFBE2ABE5314F488D5DE8C457342CA74D809CBA3

Function 0062DED8 Relevance: 2.5, Strings: 1, Instructions: 1296COMMON

Download Yara Rule

Strings

@, xrefs: 0062FE4D

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 0f2fb15fb640a0ac74f7ebf11ae0a00e79eb1ebbcee514835237cce2622ebf17
Instruction ID: e0a898dcbe5fd9c1aa7218e80046c19f5fe53bdb9df6bcf352b15b5c5fc9a5fb
Opcode Fuzzy Hash: 0f2fb15fb640a0ac74f7ebf11ae0a00e79eb1ebbcee514835237cce2622ebf17
Instruction Fuzzy Hash: D09212716087618FD714CF28D49466ABBE3AFC9314F188A3DE89A9B391D334DD49CB81

Function 00671798 Relevance: 1.9, Strings: 1, Instructions: 618COMMON

Download Yara Rule

Strings

f, xrefs: 00671976

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID: f
API String ID: 0-1993550816
Opcode ID: b38e6f6da0f4ee892dc7bd84d3849ea3ee91e3c5acb601456a1049e317f3aa66
Instruction ID: 001f8de162753d3cd42d0a26b64f606660e590591ffead27c7d24ec3ef94c18e
Opcode Fuzzy Hash: b38e6f6da0f4ee892dc7bd84d3849ea3ee91e3c5acb601456a1049e317f3aa66
Instruction Fuzzy Hash: 1322CD716083419FC714CF18C890A6ABBE6BF8A314F188A2EF4999B391D735D945CB52

Function 0061572C Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00615727,?,?,00000008,?,?,006215F5,00000000), ref: 00615959

Memory Dump Source

Source File: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: ab558ec321769709d07de9d5f51e892a8d1421c39b62d6b5d152401f43edfa5d
Instruction ID: 8a81e9086ef594a225badf2c0952fd1c6c2dab9e86bd7c282e7150589d821164
Opcode Fuzzy Hash: ab558ec321769709d07de9d5f51e892a8d1421c39b62d6b5d152401f43edfa5d
Instruction Fuzzy Hash: 2CB13E31610A04DFD715CF28C486BD5BBA1FF85364F298659E89ACF3A1C335E992CB41

Function 0060729C Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 006072B2

Memory Dump Source

Source File: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: ac3c1cbd81b6d3e5976f58f55fdf7d2969920eb5d4238681040578b8f97eff0b
Instruction ID: 14ad92e3089944f1a10ef439df2e252958f81724b456a962969c0a0af2dff704
Opcode Fuzzy Hash: ac3c1cbd81b6d3e5976f58f55fdf7d2969920eb5d4238681040578b8f97eff0b
Instruction Fuzzy Hash: 19A17FB1D45A058FDB29CF64D8827EABBF2FB48714F24952AD419E73A0D334A942CF50

Function 006305B8 Relevance: 1.7, Strings: 1, Instructions: 448COMMON

Download Yara Rule

Strings

CD, xrefs: 00630616

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID: CD
API String ID: 0-3115673787
Opcode ID: 4c0b4b88843fe66386dd9f80ba3723d5ab93d35f761372caa74b535c6bc6894e
Instruction ID: 67169c7f15b3dc16594dac46f92ab2a57623989846912e9a8f547221f7e5a8ad
Opcode Fuzzy Hash: 4c0b4b88843fe66386dd9f80ba3723d5ab93d35f761372caa74b535c6bc6894e
Instruction Fuzzy Hash: 56E1E472A083019BD704CF29C89065EB7E6EBC8750F258A2DF89997394E774DD45CBC1

Function 00655368 Relevance: 1.7, Strings: 1, Instructions: 415COMMON

Download Yara Rule

Strings

TW, xrefs: 0065538A

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID: TW
API String ID: 0-1778470648
Opcode ID: 37e65682408c37040f626a0ca88badc03505eecafd751e2c16e196c146a53e28
Instruction ID: 8b33d67e04f784045b2f179f141aa5ec34aadb4c4ab5e4994c1088fcc7fa5e67
Opcode Fuzzy Hash: 37e65682408c37040f626a0ca88badc03505eecafd751e2c16e196c146a53e28
Instruction Fuzzy Hash: 44C1EFB15087409BDB10AB14C865A6FB7F6EF55352F48881CF8CA8B361E335DD08CBA6

Function 00619ABF Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93f2dc98727e75dbd13b4ea54e3bf295df8773cf21c01c749a231d149b72bd30
Instruction ID: 0ff260d6e05c4dd493e13a01276bd9faa450d6076466d50c6cb2699db998b5b4
Opcode Fuzzy Hash: 93f2dc98727e75dbd13b4ea54e3bf295df8773cf21c01c749a231d149b72bd30
Instruction Fuzzy Hash: 7631D972904219AFCB20DFB9DC95DFB777EEF84714F184558F90597244EA30AE808B64

Function 0060CAF2 Relevance: 1.6, Strings: 1, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 0060CC80

Memory Dump Source

Source File: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: ca947212c33621440a64af3af391fb9403a5efcad6614e4bdecbac624ab389ee
Instruction ID: e4200dbaad50e0e0a2b3c9339fc85309583c247a4ec70401c7036e7c44717b98
Opcode Fuzzy Hash: ca947212c33621440a64af3af391fb9403a5efcad6614e4bdecbac624ab389ee
Instruction Fuzzy Hash: 1CC19C70680A4A8FDB2CCF68C495AABBBB3AF45324F24471DD4569B3D1C730AD46CB91

Function 0066074E Relevance: 1.6, Strings: 1, Instructions: 336COMMON

Download Yara Rule

Strings

-'.$, xrefs: 00660989

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID: -'.$
API String ID: 0-2031752551
Opcode ID: 34e3f814482b72035446470293d0cf0e4fa038b8cce2f5f390abddc47372c923
Instruction ID: 040fd322c4033e68afc921a1174c71b43e4c4587392b37af95e7b2f9baf238ee
Opcode Fuzzy Hash: 34e3f814482b72035446470293d0cf0e4fa038b8cce2f5f390abddc47372c923
Instruction Fuzzy Hash: D2B16D74504B818FE7268F29C090B22FBF2EF56314F14859DD8EA9B752C735E806CBA5

Function 0061C6EB Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00614EB1: GetLastError.KERNEL32(?,00000008,00619482), ref: 00614EB5
Part of subcall function 00614EB1: SetLastError.KERNEL32(00000000,0062C480,00000024,00610419), ref: 00614F57

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0061C73F

Memory Dump Source

Source File: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 47322eb7a0462e664fe697026e456c26dad2ec96dd15da663b381a66bbbe4449
Instruction ID: 12458b64a2cbd55ad7665ef5731af08c57cace6275f5fb47b8f9ebdf4aba3ae7
Opcode Fuzzy Hash: 47322eb7a0462e664fe697026e456c26dad2ec96dd15da663b381a66bbbe4449
Instruction Fuzzy Hash: EF21B332540206ABEB689F25DC42EFE73AAEF44320B18007EF905D6281EB74DD818A54

Function 0061C372 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00614EB1: GetLastError.KERNEL32(?,00000008,00619482), ref: 00614EB5
Part of subcall function 00614EB1: SetLastError.KERNEL32(00000000,0062C480,00000024,00610419), ref: 00614F57

EnumSystemLocalesW.KERNEL32(0061C498,00000001,00000000,?,-00000050,?,0061CAC9,00000000,?,?,?,00000055,?), ref: 0061C3E4

Memory Dump Source

Source File: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 3b232ceebad8839a81b68972ff35778d1a2f93cba30b8d23aed89507e3195aec
Instruction ID: 24347d5ae3e64fb8f382b80367fcd736e042505159b0256370208a93ca400d3a
Opcode Fuzzy Hash: 3b232ceebad8839a81b68972ff35778d1a2f93cba30b8d23aed89507e3195aec
Instruction Fuzzy Hash: 931125362047019FDB189F38C8A15FEBBA2FF84368B18882CE94787B40D371A983C750

Function 0061C91A Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00614EB1: GetLastError.KERNEL32(?,00000008,00619482), ref: 00614EB5
Part of subcall function 00614EB1: SetLastError.KERNEL32(00000000,0062C480,00000024,00610419), ref: 00614F57

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,0061C6B4,00000000,00000000,?), ref: 0061C946

Memory Dump Source

Source File: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: c5142ffad49e6fc84898f3e92df4084a68e630a3d8be123e17aa36436a5bff74
Instruction ID: 4a2cb139bccf7a667e3659891677142170d654cc193421395e8c9d8816d2a0fb
Opcode Fuzzy Hash: c5142ffad49e6fc84898f3e92df4084a68e630a3d8be123e17aa36436a5bff74
Instruction Fuzzy Hash: ACF0F933540615BBDB2456608805BFE775AEB40774F0C4828EC02A3280DA34FE82D5D0

Function 0061C40D Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00614EB1: GetLastError.KERNEL32(?,00000008,00619482), ref: 00614EB5
Part of subcall function 00614EB1: SetLastError.KERNEL32(00000000,0062C480,00000024,00610419), ref: 00614F57

EnumSystemLocalesW.KERNEL32(0061C6EB,00000001,?,?,-00000050,?,0061CA8D,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 0061C457

Memory Dump Source

Source File: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: d15093b74c49a07c9bd2ee1e114ccd6306da79c7f553f0d57e64dafb22487150
Instruction ID: 05257d68dbee17df699c3511afc00a7f3d50f7f99830174cd66a7a6f6bfa9e1d
Opcode Fuzzy Hash: d15093b74c49a07c9bd2ee1e114ccd6306da79c7f553f0d57e64dafb22487150
Instruction Fuzzy Hash: 45F022322047045FCB249F39DC91AFA7BD2EB80778F09842CF9468BA80C6719C82C654

Function 00615D7F Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0060DDC1: EnterCriticalSection.KERNEL32(?,?,00614B89,?,0062C2E0,00000008,00614D4D,?,0060C446,?), ref: 0060DDD0

EnumSystemLocalesW.KERNEL32(00615D72,00000001,0062C3A0,0000000C,00616127,00000000), ref: 00615DB7

Memory Dump Source

Source File: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 8a21d3f7ee3baac7e23216cd7d7769d9ca8b6932a13e0fd9a33eac33b91b24eb
Instruction ID: f2f86ed21f7a7c47a2e06c3e0d5d3423e3f4d7f73ac83a01df46d988558254d4
Opcode Fuzzy Hash: 8a21d3f7ee3baac7e23216cd7d7769d9ca8b6932a13e0fd9a33eac33b91b24eb
Instruction Fuzzy Hash: D8F03C72A44614EFD700EF98E882B9D77F2EB44721F20411AE415972E1C7755945CB58

Function 0061C327 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00614EB1: GetLastError.KERNEL32(?,00000008,00619482), ref: 00614EB5
Part of subcall function 00614EB1: SetLastError.KERNEL32(00000000,0062C480,00000024,00610419), ref: 00614F57

EnumSystemLocalesW.KERNEL32(0061C280,00000001,?,?,?,0061CAEB,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0061C35E

Memory Dump Source

Source File: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 7d0dc14645115201d352efa061223232e68aa879e2ec82fac7c0b9ec21699c66
Instruction ID: ffb47b4ac0cd09ba6d2803b23b5e767485c9a9bd1a41888a62808ad62837ed8d
Opcode Fuzzy Hash: 7d0dc14645115201d352efa061223232e68aa879e2ec82fac7c0b9ec21699c66
Instruction Fuzzy Hash: 99F0E53634020557CB149F75D845AEEBF96EFC1B70B0A8058EA098B790C6759982D7A4

Function 0065A059 Relevance: 1.5, Strings: 1, Instructions: 267COMMON

Download Yara Rule

Strings

P, xrefs: 0065A397

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: 4bfaa7626ea9b600e4b84af23bd05a8ca6e36999e86aa202f38862eca0be855c
Instruction ID: 687c3280620e914ec3ae14ddaa8eb0e9d1155249a8ae744db9d0019e52a4dd1e
Opcode Fuzzy Hash: 4bfaa7626ea9b600e4b84af23bd05a8ca6e36999e86aa202f38862eca0be855c
Instruction Fuzzy Hash: 66A103719083418BE7108A94C8813AFFBE3EF95395F184A6DEC8587392D335C949CB87

Function 0062E212 Relevance: 1.5, Strings: 1, Instructions: 264COMMON

Download Yara Rule

Strings

@, xrefs: 0062E7F8

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 306e642b51b2512054d38a46158e9f08723d7b25d1953b1fc47caece9ac7f322
Instruction ID: 2401d0097c168bc4293f5a0fcf8f829982b0c5a5e19546a9277df32d79847a5a
Opcode Fuzzy Hash: 306e642b51b2512054d38a46158e9f08723d7b25d1953b1fc47caece9ac7f322
Instruction Fuzzy Hash: 5DA1AA71A08B619FD314CF18E09479AFBE2ABC4314F198A2DE8D957391C7759C49CF82

Function 00607AAF Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00007ABB,00606DC9), ref: 00607AB4

Memory Dump Source

Source File: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: e8654bf827a125383bd2f61a1d9d587f3fbca897db9f71dc9ad36e8880fe6a63
Instruction ID: 003334c4ed1d36d18879c6c8ecf6a68cd022619471b680110d8970295debac80
Opcode Fuzzy Hash: e8654bf827a125383bd2f61a1d9d587f3fbca897db9f71dc9ad36e8880fe6a63
Instruction Fuzzy Hash:

Function 006774F8 Relevance: 1.5, Strings: 1, Instructions: 247COMMON

Download Yara Rule

Strings

, xrefs: 00677552, 0067760E, 006775EB, 0067752B, 00677533, 006775F3

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3019521637
Opcode ID: 08d3931baa2a9c42408cb6ec1c64e50b571bbd3c3c2ceb0987ed0c3721af9082
Instruction ID: 7a9686aa8c4688238152ff880b9c56376721e2f5ebf764e407a12ca21018425a
Opcode Fuzzy Hash: 08d3931baa2a9c42408cb6ec1c64e50b571bbd3c3c2ceb0987ed0c3721af9082
Instruction Fuzzy Hash: A881DE756083519BCB249F18C890A6BB7E6FF89710F19892CF9899B351DB31EC50CB92

Function 0065E388 Relevance: 1.5, Strings: 1, Instructions: 237COMMON

Download Yara Rule

Strings

", xrefs: 0065E64C

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 7e98b4656ee7a597cc4d0ae5467a7c4b97e5a60aa5ade5d03bcc0f57a0d03316
Instruction ID: 8346076640fe38f7a751dbae6ef7a12256ffafe2983b6ddfde9acff6cce63c81
Opcode Fuzzy Hash: 7e98b4656ee7a597cc4d0ae5467a7c4b97e5a60aa5ade5d03bcc0f57a0d03316
Instruction Fuzzy Hash: B771D7327087504FDB288D2CC88036AB6D36BD6336F299769E8B4CB3E1D676DD498741

Function 006747F8 Relevance: 1.4, Strings: 1, Instructions: 183COMMON

Download Yara Rule

Strings

, xrefs: 006748BE, 006749A8, 0067497B, 0067489B, 006748A3, 00674983

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3019521637
Opcode ID: caa00a0baa876a8884e4083aa7b8b58c4b77efdead5d9ec54620c567e662e154
Instruction ID: 431df3cfefffc8566c1a2970ec98596748349101549bd6993c558e7372cc738f
Opcode Fuzzy Hash: caa00a0baa876a8884e4083aa7b8b58c4b77efdead5d9ec54620c567e662e154
Instruction Fuzzy Hash: 2851DE31608350ABD7149E19C895B2FB7E6EB86714F24CA2CEAD997391DB31DC00C756

Function 00660AD4 Relevance: 1.4, Strings: 1, Instructions: 161COMMON

Download Yara Rule

Strings

2FD>, xrefs: 00661F68

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID: 2FD>
API String ID: 0-1510312430
Opcode ID: 242552adc178d8c3491bf93f30874780fcc0fbb89b54cad1dcff1d541b57b90a
Instruction ID: 95db40462f7dba5445669a93ece65a77b0ffd3b3c6426e97c9aadb9c3d5dc6b5
Opcode Fuzzy Hash: 242552adc178d8c3491bf93f30874780fcc0fbb89b54cad1dcff1d541b57b90a
Instruction Fuzzy Hash: 265161705047818EDB268F25C050A66FBF2AF17354B68888DD8D69FB83C339E806DB65

Function 0063FA44 Relevance: 1.4, Strings: 1, Instructions: 160COMMON

Download Yara Rule

Strings

2, xrefs: 0063FADA

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID: 2
API String ID: 0-450215437
Opcode ID: e6034f399045d4b6abb2554f6b82214a593dffe65b117c12c080d18cf511f5b9
Instruction ID: f9fea9ed508395c095b037e6443d12ac7ffa8b7ee0fda1f8b683259692a1f4b1
Opcode Fuzzy Hash: e6034f399045d4b6abb2554f6b82214a593dffe65b117c12c080d18cf511f5b9
Instruction Fuzzy Hash: 4451A4B194A380DBE771A7508842FEFB6E2BFD6301F08092CE48957282DB369505D7A7

Function 0063FCD4 Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

2, xrefs: 0063FD63

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID: 2
API String ID: 0-450215437
Opcode ID: 15cde75e9d06dabda2588e85d20db4463443109759951a92bfa7a8f5d5147061
Instruction ID: 8e0a3267e92cd70008d193c92a1918e37cddff0020253fede498f9b497d07677
Opcode Fuzzy Hash: 15cde75e9d06dabda2588e85d20db4463443109759951a92bfa7a8f5d5147061
Instruction Fuzzy Hash: 005191B194A380D7E771A7508842FEFB6A3BFD6301F08092CF48957282DB769505D7AB

Function 00601D79 Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

Z81xbyuAua, xrefs: 00601E9B

Memory Dump Source

Source File: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID: Z81xbyuAua
API String ID: 0-3121583705
Opcode ID: 8f65eec1d1a2562f9659a0c85a36f6391bab9f4160e1af65b3a13556f979f41b
Instruction ID: e9a10820b3663c4f5611b4daeb8e9b1acb9f0cf4414af73316cdf8e852c56cac
Opcode Fuzzy Hash: 8f65eec1d1a2562f9659a0c85a36f6391bab9f4160e1af65b3a13556f979f41b
Instruction Fuzzy Hash: 41412E76D6052B4BCB4CEEB8C8560EFBB69EB56350B04427ADD11DF3D1E2348A01C6D4

Function 00661327 Relevance: 1.4, Strings: 1, Instructions: 141COMMON

Download Yara Rule

Strings

2FD>, xrefs: 00661F68

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID: 2FD>
API String ID: 0-1510312430
Opcode ID: 482e1bb03dcd7035389772e6bba219ce3904a568faca1742d2efed7deef8c6d7
Instruction ID: 76e593bd67e47e04fc386e4912ba0f39e2752a30e28c374951c7efd4f772bf78
Opcode Fuzzy Hash: 482e1bb03dcd7035389772e6bba219ce3904a568faca1742d2efed7deef8c6d7
Instruction Fuzzy Hash: 47417E705047818EDB268F258050A76FBF1AF17354F68988DD8D69FB83C73AE806CB65

Function 00676B98 Relevance: 1.4, Strings: 1, Instructions: 131COMMON

Download Yara Rule

Strings

, xrefs: 00676BF7, 00676CAE, 00676C8B, 00676BCC, 00676BD5, 00676C93

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3019521637
Opcode ID: 3f681d420308340ce622b70d3801fe125027f74667fc1b293c25dd6169613fb3
Instruction ID: c83973dd3f100f419fd1ccd51ae2ebe60d52ad9ace812e6b5db988544facd091
Opcode Fuzzy Hash: 3f681d420308340ce622b70d3801fe125027f74667fc1b293c25dd6169613fb3
Instruction Fuzzy Hash: A7418D75608340ABDB159F14C990B6BBBE6EB86710F24C82CF9C99B392D331D814CB5A

Function 00676D28 Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

, xrefs: 00676D87, 00676E3E, 00676E1B, 00676D5C, 00676D65, 00676E23

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3019521637
Opcode ID: 35ff341fea01c2b82f004fdc622a9334d9847dfee3824cdca80f10c1f8328be7
Instruction ID: f1410317011aeaa8bba29b27944a7de12bb1a7989b085b5c656fc98de80e8445
Opcode Fuzzy Hash: 35ff341fea01c2b82f004fdc622a9334d9847dfee3824cdca80f10c1f8328be7
Instruction Fuzzy Hash: 5B416D74608340ABD7249F14C980B2BBBE6EF86711F64D82CF489573A2D335D810CB6A

Function 0064AF2D Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

qs, xrefs: 0064AF96

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID: qs
API String ID: 0-1399850505
Opcode ID: 8aaebf1e4c3640f5f3ce392bc9914373ba4fadcd76e73042caaaaaebe0853f7e
Instruction ID: 52ab35dde1a8d088d4203adb89170ce70ab4c7b51412aafaded05e00e9ae92c3
Opcode Fuzzy Hash: 8aaebf1e4c3640f5f3ce392bc9914373ba4fadcd76e73042caaaaaebe0853f7e
Instruction Fuzzy Hash: 753135B0100B008BC730CF64D991A63B7F2FF1A751B54AA4CE4AA8BBA5E335F844CB55

Function 006738E2 Relevance: 1.3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

, xrefs: 0067394E, 0067392B, 00673933

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3019521637
Opcode ID: 6755f9bab069ea5934903f8183f253ded6f2aca177a558b48b1de12272a79bcd
Instruction ID: 340014a6dec24caeb5aa6d358058835801b428d0102ff0715c0d3cfc4d3d80c1
Opcode Fuzzy Hash: 6755f9bab069ea5934903f8183f253ded6f2aca177a558b48b1de12272a79bcd
Instruction Fuzzy Hash: 8821DE70608301ABDB04DF08CC81B2AB7E6AB81711F64891CF2C99B3E2D3B1E900CB56

Function 0061CC4B Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0061CC4B

Memory Dump Source

Source File: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: a1ea30be6517d9ef4c1dd8008e8809cc7a26a631f38ee3749b8c548f07c5525d
Instruction ID: 8171c8cfe7e520920c341a7d9a9495cc34f66415c0bc800c2ff1ddeac480de39
Opcode Fuzzy Hash: a1ea30be6517d9ef4c1dd8008e8809cc7a26a631f38ee3749b8c548f07c5525d
Instruction Fuzzy Hash: 01A02430101100DF4300CF345F4F30C37D755105C030C70545440C4130D734C1505751

Function 00638F38 Relevance: .8, Instructions: 789COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55bdd7183e786f206f49eb0e89a9435e12bd88c65a2001897e8b962e1375b007
Instruction ID: 9942ffa410e5c68182db6f877aeea78313e157c9b4551cb3b7d5a52a4cf99704
Opcode Fuzzy Hash: 55bdd7183e786f206f49eb0e89a9435e12bd88c65a2001897e8b962e1375b007
Instruction Fuzzy Hash: FC42C4316087118BC725DF28D8806AEB3E2FFD5315F298A2DD99687381E774D851CFA2

Function 00651908 Relevance: .7, Instructions: 700COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16869c809fe6b9c013eb52f11e203e487ef228a061d05dc0c8baca727ee9c214
Instruction ID: 309f728e2381e9df20a0811f02321b2580ac5f989bf25c171b11bf6745f6d332
Opcode Fuzzy Hash: 16869c809fe6b9c013eb52f11e203e487ef228a061d05dc0c8baca727ee9c214
Instruction Fuzzy Hash: 5D72F7B0508B819ED371CF3C8849797BFE5AB1A324F044A5EE4EA8B3D2C3756505CB66

Function 00638428 Relevance: .7, Instructions: 670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 169fd697c981202875bdf4f7b877c3bbabddd2f5e73f7c32bbe4a1385d044f0b
Instruction ID: 68001f87d1cb6026df9aaea5e7d5e5e8db1a7aeeb2038b1a5d00e00ca7f61987
Opcode Fuzzy Hash: 169fd697c981202875bdf4f7b877c3bbabddd2f5e73f7c32bbe4a1385d044f0b
Instruction Fuzzy Hash: 8652A170908B848FE7358B24C4843EBBBE2EF92310F54496DE5E6077C2CB79A985C795

Function 00634278 Relevance: .7, Instructions: 657COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e65e6d0ec29a0286690b312841c0ba80701f8bb5ada55794a20425fd9e091869
Instruction ID: 3a202853c9e65d61746c6547be5a5e4bc80f622d8399eba159623c4d2018a369
Opcode Fuzzy Hash: e65e6d0ec29a0286690b312841c0ba80701f8bb5ada55794a20425fd9e091869
Instruction Fuzzy Hash: D252C1315083458FCB14CF19C0906EAFBE2FF89314F598A6DE8995B352DB35E889CB81

Function 00634C78 Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b4942d6c5a04db89343f61d2bd896b7a754b8bfa492006bc517a5ac4323522e
Instruction ID: f624699959874d74d7537edf6959dd99e1e4e88190d89f31a9ac3f193b00969d
Opcode Fuzzy Hash: 8b4942d6c5a04db89343f61d2bd896b7a754b8bfa492006bc517a5ac4323522e
Instruction Fuzzy Hash: 32321170915B108FC368CF29C59056AFBF2BF85710BA44A2ED6A787B90D776F845CB80

Function 00637338 Relevance: .5, Instructions: 504COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2ed25ed2ecece428dec3d662da4c49c86df14d0f0cac3c7bd7da9d139c37883
Instruction ID: ee993297aa3b943913ab08b0066b70e0a0ec572b52d0534b97b7ca049517ba51
Opcode Fuzzy Hash: c2ed25ed2ecece428dec3d662da4c49c86df14d0f0cac3c7bd7da9d139c37883
Instruction Fuzzy Hash: 8902A07560C7418FC728CF29C89166BFBE2EFD9300F08892DE4D687791E675A904CB96

Function 0065A438 Relevance: .4, Instructions: 380COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83d948c1b98276872fbedeb4ae571c7f1df7ffbfed0eb7000220ee8de56deee4
Instruction ID: 8feffd41396c9b9eb88c13ab01755ced817dc8868d7fcb9f010abe3bb69e8851
Opcode Fuzzy Hash: 83d948c1b98276872fbedeb4ae571c7f1df7ffbfed0eb7000220ee8de56deee4
Instruction Fuzzy Hash: 04B1F2B16083019BD714DB94C890A6FB7E3EF95306F184A2CE8C697391E335E909CB57

Function 0066143A Relevance: .4, Instructions: 358COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5e5a161c1ab45c4b1e480cfbddb13b76eded34dc1ce46f9e0b718e5efcd9d52
Instruction ID: b6766fba3104e36dd69aa175293a6570ecd9620660b07f650d7312101ce9e728
Opcode Fuzzy Hash: c5e5a161c1ab45c4b1e480cfbddb13b76eded34dc1ce46f9e0b718e5efcd9d52
Instruction Fuzzy Hash: 31D12AB4800B419FD320AF39C546656BFB0FB02300F548A9DE8EA5F686D335A45ACFD6

Function 00674DA8 Relevance: .3, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5adaadb379de4d0ac6695891303286d85bf5796d7f1c210cbcdbab9b523f8b94
Instruction ID: 9c4432b1604e74a0a61bbba17bde763d93e0cd45341e48bab7839e8a15be0598
Opcode Fuzzy Hash: 5adaadb379de4d0ac6695891303286d85bf5796d7f1c210cbcdbab9b523f8b94
Instruction Fuzzy Hash: 4CA115B2A083509BE7149F28CC8476BB7E6EBC5314F08896CF99D97341EB75DC058B92

Function 0061BB36 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID: ErrorLastProcess$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 3471368781-0
Opcode ID: 2406bd5f1804e58cb7f09c69db487e2a4fcdca1e864cd5d92ef5e57c5d9a835e
Instruction ID: fbb350b73eaba3b0f87bb991437bf93bfd9efad76590cafbcd2d6a29fab3ff57
Opcode Fuzzy Hash: 2406bd5f1804e58cb7f09c69db487e2a4fcdca1e864cd5d92ef5e57c5d9a835e
Instruction Fuzzy Hash: D0B107755007458BDB389F25CC92AF7B3AAEF54308F1C452DEA43C6690EB75A9C2CB50

Function 006434A4 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d6742bc921a87cbc0d7ecdfc3dd5ce11be376d8912454172b111acada42123f
Instruction ID: 17ac734ee6b7f3656ac56d282d2c56beede0815c4b1a8ec3c420140fe24e4000
Opcode Fuzzy Hash: 7d6742bc921a87cbc0d7ecdfc3dd5ce11be376d8912454172b111acada42123f
Instruction Fuzzy Hash: C1C1F2B0500B509FD7258F24C881BA7BBF2FF46300F14895DE99A8BB91E736B905CB64

Function 00666078 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6242de2c158a3e25abd914ef81a7081ec85dc90910a15599f474a425946f381
Instruction ID: 61c2d08ed4ad37d28957aeb7c5e8781448c5eb42bc95db8f94496558ea9a8115
Opcode Fuzzy Hash: c6242de2c158a3e25abd914ef81a7081ec85dc90910a15599f474a425946f381
Instruction Fuzzy Hash: 6881C837A1599147C3189E3D9C112AAAA875FD7330B3EC37AB9B6DB3E5D9258C024390

Function 00632302 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bb0e1251b43261e23572b6fe04e2d9b66b4d052610f955a5f7654400d35fefe
Instruction ID: 2d01c49bdb770d7beecbf5e0c370d53de54e1578ca43dd499dc6d44feb68b350
Opcode Fuzzy Hash: 9bb0e1251b43261e23572b6fe04e2d9b66b4d052610f955a5f7654400d35fefe
Instruction Fuzzy Hash: C391F6B5A083538BE7258E5598A036BB7D3BFA1308F1D856DD9854B391E3B0DC49C7C2

Function 0065BADA Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a435c7ff7e61a266175cc740b2df94f4f0bcffa5dc796596f52e14c951997eae
Instruction ID: e472359d5d784977ac3f387e11f0f1ebca3cc6a7b3253681804663c008f42fe6
Opcode Fuzzy Hash: a435c7ff7e61a266175cc740b2df94f4f0bcffa5dc796596f52e14c951997eae
Instruction Fuzzy Hash: AA71F873A14B254BC728892C8C517AAB6D29BC4215F4E873CDD9ADB386EB74AD0587C0

Function 00664A88 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8b4e1efa5495fb8a019b3a8f09c75cd24c53d3083fb3dc6746e68a82280d218
Instruction ID: 352f0f6558e3f17c8df222c4b1d557c7c9dcbe4d8daafd98d12e2b51856479db
Opcode Fuzzy Hash: e8b4e1efa5495fb8a019b3a8f09c75cd24c53d3083fb3dc6746e68a82280d218
Instruction Fuzzy Hash: E281F836A4A6914BD3189E3C9C513B96E934FD3334F2D876DE8F28B3E5DD6588028351

Function 00655108 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17b631a1ef9c90cdc196109c47057cb6dd3a7c54a8c9dd28249f1b39c8e723b3
Instruction ID: 445f3467a1106811091c811510fe71ebe34ccd1f9f8e5676fd201ea7ecde2aeb
Opcode Fuzzy Hash: 17b631a1ef9c90cdc196109c47057cb6dd3a7c54a8c9dd28249f1b39c8e723b3
Instruction Fuzzy Hash: A25105B06007049BDB209B64CCAABB737B6EF81365F084558F986CB391F375E909C762

Function 00632268 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f99aab2791bd1aba6dfb3b61b9a4968c41f01324f8c9ecb9249fe38aea401d4
Instruction ID: 192bee0d8aeaa0ff9a15bc33eb0cb1f05266315ed530bde7814197670bd23a0e
Opcode Fuzzy Hash: 5f99aab2791bd1aba6dfb3b61b9a4968c41f01324f8c9ecb9249fe38aea401d4
Instruction Fuzzy Hash: 927103B690874387E7258B18D87036ABBE3AFE1724F29865DD86A4B351E371DC09C3C1

Function 006722A8 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 260186d478aae003c652c9c0622f6da14b7ca9a12c80829d925b8ad8623de31d
Instruction ID: 5f7f886113697e42618cbc850cd4a38aa38d2aa89b23b87865ea225ea0420037
Opcode Fuzzy Hash: 260186d478aae003c652c9c0622f6da14b7ca9a12c80829d925b8ad8623de31d
Instruction Fuzzy Hash: 4C71BE716083429BDB11DF19C8A0B2AB7E7EF95310F18C92CE5D9973A1D735EC408B56

Function 006618D8 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2ecac1f06bdf61436ed265659ed9f52c64cc52bcee91badaf8e5f8c506a0b22
Instruction ID: 0346f641c8fa3acfabbeeddbcf93dbbd3212663a22dbf53101f1ab4a2a345905
Opcode Fuzzy Hash: b2ecac1f06bdf61436ed265659ed9f52c64cc52bcee91badaf8e5f8c506a0b22
Instruction Fuzzy Hash: A2716AB44047818FDB258F29C090A26BFB1EF13310B28868DD8D65F74BD335E849CBA5

Function 0063B2D8 Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78f57911bcbd89b49419ee3ef9dd8a7705bfb666a251f11caf1017bd8e3f52b3
Instruction ID: 6890861b2f351f9b5eef26c9f1b7eb352eb94bd4d419193b203ec808cf0bba00
Opcode Fuzzy Hash: 78f57911bcbd89b49419ee3ef9dd8a7705bfb666a251f11caf1017bd8e3f52b3
Instruction Fuzzy Hash: DA5147377486904BD3289D7D5C912B97AC34BD2330F2D937EEAB58B3E3EA5948025394

Function 0062E3F7 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 118f1cef26720b4861566893e0de54ebb40160411a9db2ff76e9d22af775da4a
Instruction ID: 7876893a379d94a40566ba656f02dfcb5d9a97c1c5e56dad6570b5346b8f0241
Opcode Fuzzy Hash: 118f1cef26720b4861566893e0de54ebb40160411a9db2ff76e9d22af775da4a
Instruction Fuzzy Hash: B771AC31A08B619BC718CB28D09476EBBE3AFC4754F18893DE88A97390D775DC458F82

Function 00664858 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b5a5ab0e6f08e1212459a1051d072897d816136cec1085f020d45d75109a894
Instruction ID: 8482f285b35fcafb6feb43d9ae0c5008fa654c99a0af6709c138972fd04f383a
Opcode Fuzzy Hash: 1b5a5ab0e6f08e1212459a1051d072897d816136cec1085f020d45d75109a894
Instruction Fuzzy Hash: 2551193BA99AC04BC7249EBC5C412A9AB535BD737473E837AD8B04B3D5DD268C038391

Function 0063BCB9 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98426d52609b44d71ace9bc0825109431283409a88027502b5f6118697708dcb
Instruction ID: fbc75618e02aac88b9eb8109538c0197bfc1b494eff9185a842178f0c47177c5
Opcode Fuzzy Hash: 98426d52609b44d71ace9bc0825109431283409a88027502b5f6118697708dcb
Instruction Fuzzy Hash: FA515CB1D015458FDB41CFA8DA95ABEBBB2EF46301F640068E401B7352D7359E14CB7A

Function 0066BCB8 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55836fbddb03cbdaf9cff1c314ca2634526aaf9b730aac6315943972a0646e05
Instruction ID: 29b3698e2200305e2f1d6a7bc4978220373672ac642deaaa095d63e54a6c711b
Opcode Fuzzy Hash: 55836fbddb03cbdaf9cff1c314ca2634526aaf9b730aac6315943972a0646e05
Instruction Fuzzy Hash: 2D516BB15087548FE714DF29C49479BBBE1BBC8314F044A2DE5E987390E37ADA488F82

Function 00666378 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b9b159b4f3877c8d9d6b0debf22a3b75361e34386abef763474a0b287f0c785
Instruction ID: 079d3dc87a5802bb7e61782f4aa450b89e326490e9582dd2b18a4ca16d3efc52
Opcode Fuzzy Hash: 6b9b159b4f3877c8d9d6b0debf22a3b75361e34386abef763474a0b287f0c785
Instruction Fuzzy Hash: 02510C37A0A5C04BCB159E7CAC562A46A535BE3334B3D836BF4B28B3E5D9268C039351

Function 00671048 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d0570097160aab1b68a550f4511c957a43b2e8abafe0f435217c9cb9528a807
Instruction ID: 1cec844b902806e3aef710023307aa909eaf9e803b59652ea7b1e30b2ee4ad2d
Opcode Fuzzy Hash: 2d0570097160aab1b68a550f4511c957a43b2e8abafe0f435217c9cb9528a807
Instruction Fuzzy Hash: 7D51BF746083809BDB24DF19C850A2ABBE7EF86705F14C82DE5C99B762D732DC50DB26

Function 0063A268 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 054442773fa85cc7e7f2bc6a691852260fd407d19e094a4ce9a9a5ee557263b7
Instruction ID: e303a60a4dfb5b8a9a09a29869fe312d4a7a64f6868bb99e5122467d12256902
Opcode Fuzzy Hash: 054442773fa85cc7e7f2bc6a691852260fd407d19e094a4ce9a9a5ee557263b7
Instruction Fuzzy Hash: 5341037040D3409BD701BFA8D588A2EFBE6EF56741F549D1CE5C497262C23AD810ABAB

Function 00632B08 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bda98c2f30a516d50807ce0b98e746189b08d9b89d3b03278e09447c629b6b2
Instruction ID: ca6cda84efad7d0e0e55ce788411394baae2a299e24529370e639a0a8c7c9142
Opcode Fuzzy Hash: 8bda98c2f30a516d50807ce0b98e746189b08d9b89d3b03278e09447c629b6b2
Instruction Fuzzy Hash: 2651D2B1A043129FC714DF18C89086AB7E2FF95324F19566CEC969B351D631EC42CBD2

Function 0063E3F3 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34b2c5dc47880b26d63c4cac224246904b14b76870b104fed36430456e3dcfb5
Instruction ID: 9899fcc9e932e7b625b1fee8d351f8a0f4409123ae4cd73bd4e3d3c9afdf43b8
Opcode Fuzzy Hash: 34b2c5dc47880b26d63c4cac224246904b14b76870b104fed36430456e3dcfb5
Instruction Fuzzy Hash: 90410CB49002669BDF018F94CC94BBEBBB1FF0A301F144859E811AB392D335A910CBA8

Function 0063E768 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5e34cb232997b27782127b8cd1ef61722e578a9a41e811742eb7c47ee6c68f4
Instruction ID: 80b54ad5867cb4d1ad5568012589fae4f1df65d2931f797d6fc8aca62d23a0e8
Opcode Fuzzy Hash: f5e34cb232997b27782127b8cd1ef61722e578a9a41e811742eb7c47ee6c68f4
Instruction Fuzzy Hash: DF412472B0C3944FD358CE7A889416A7BE3AFC5210F18C67EF4A5863C4E6718A05E7A0

Function 0065ABBB Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b10cf0e7097aa983af4eec26b10cdff308d4fbafdfb15f8fa67f104f1a184b0
Instruction ID: 367d7685d0e153848c50dd9a1185f088444543594bbd53ffede1ee2ea2ca2a08
Opcode Fuzzy Hash: 6b10cf0e7097aa983af4eec26b10cdff308d4fbafdfb15f8fa67f104f1a184b0
Instruction Fuzzy Hash: 9A41F7B1A083418FC714CB68C45166FB7E3AFDA301F485A6DF89697342D634E90ACB53

Function 00675EE8 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e225b96c8bf2e769cc8697a4cfbe4e2a1212ad77f5d165699b061e557b09fc9
Instruction ID: 07d7220a1114f3d6a2c506ccc70febd97798adf79a7861f9cc44b46912b3a429
Opcode Fuzzy Hash: 8e225b96c8bf2e769cc8697a4cfbe4e2a1212ad77f5d165699b061e557b09fc9
Instruction Fuzzy Hash: 50318B32A596004FD308DA29CD4165ABBE79BCA324F0DD96DE898D7391CA79C8018B42

Function 00661FF9 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d162afb33da07c4bd60f7c483336d076906e7f1409a5580b2f65c4fffe7ae7c
Instruction ID: 1c3db784b97ae87c3b6135a45c9b09bdbfb5b125d9ab0b9f810add852447d410
Opcode Fuzzy Hash: 0d162afb33da07c4bd60f7c483336d076906e7f1409a5580b2f65c4fffe7ae7c
Instruction Fuzzy Hash: 50318470504B818FD7268F258460B62BFE29F57345F2884CDD4D69F753C63AE80ACB65

Function 0066D598 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e41c94bf4b0e2099e2558e9e672031c0a6948b5c6cff94468f528954f99504a0
Instruction ID: ffdff24161ec100e6c366845f3409377307678f9540cb52797d19fc251c217b7
Opcode Fuzzy Hash: e41c94bf4b0e2099e2558e9e672031c0a6948b5c6cff94468f528954f99504a0
Instruction Fuzzy Hash: F0310A32F0D7244BC3259D38CC5026AB7939BC5330F19872DE9BA8B3C5DA344C429385

Function 00639AE8 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff721506fae7554bc00bc682493813926a926291962e7d101190d432c5989efe
Instruction ID: 8375d467a447585b12dd28f92592840a03d40cb4b9d1d0cd09cb7f45d5b1980b
Opcode Fuzzy Hash: ff721506fae7554bc00bc682493813926a926291962e7d101190d432c5989efe
Instruction Fuzzy Hash: 48315A298496F106D732893D94A04AEFF926DA6224B9942EDC8F20F7C3C5828946D7F1

Function 00670C08 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba455b42178d8c6815bdc6dc6395f760710097916b5094dc96ff09895023de6e
Instruction ID: b9678a2c73870d984e27d9e63e0c9fb9ea6327c3e23f5705c7881e797d416738
Opcode Fuzzy Hash: ba455b42178d8c6815bdc6dc6395f760710097916b5094dc96ff09895023de6e
Instruction Fuzzy Hash: B0314770508380EBE721DF59C584B1BFBE6AF86718F14C92CE4C89B251C376D909DBA6

Function 00631A58 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 592ae079f84e3206837f27edfef0d756db5bd63b1ae8b67b4edac06f6a01af03
Instruction ID: 2bebe806266fd4b164b1d0b03a9d5146ea315d231bed076c3feb1a8845183510
Opcode Fuzzy Hash: 592ae079f84e3206837f27edfef0d756db5bd63b1ae8b67b4edac06f6a01af03
Instruction Fuzzy Hash: 6B31C531B092009BD7149E59C88097AB7E2EFCA316F18896DE89ADF351D231DD52CBC2

Function 00642702 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d538187a92fb4ac2440c57b712b554e1d8159c40c43cb23878864ac6b56818ea
Instruction ID: 7b579b14f329fe88cce13998ca813f38eb2a261e2d8a0f5c59a3cc456de8c305
Opcode Fuzzy Hash: d538187a92fb4ac2440c57b712b554e1d8159c40c43cb23878864ac6b56818ea
Instruction Fuzzy Hash: 9F3189B0A007208FE725CF24C8C0ABAB7F6AF5A704F24896DD48A97741E730F945CB95

Function 0065B175 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d31ba30025e973e205b9eb2b84926fbe6cfd1052fcf67400e8907e88fc818d30
Instruction ID: 974aa2053b79e0503eb50f491324529265c861b672c656c8aa3065905823bd7a
Opcode Fuzzy Hash: d31ba30025e973e205b9eb2b84926fbe6cfd1052fcf67400e8907e88fc818d30
Instruction Fuzzy Hash: 23216DB05083409BD7549F55C89166BBBF2EF86391F44690DF8C28B760E375C984CB56

Function 00673F68 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b89c87bf8a49416322561c17cacfa981ac5946f4534b3d23e182106c98db3fcd
Instruction ID: cb1f998b1eeeef481a12e592741675df06dbd748e23d8479834f815a3b6d5dd8
Opcode Fuzzy Hash: b89c87bf8a49416322561c17cacfa981ac5946f4534b3d23e182106c98db3fcd
Instruction Fuzzy Hash: CB313C36A042E24FDB36CB3C44A056D7FA15E5622179A43EED8B08F3D3DAA5C980C7D5

Function 00639BF8 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732362d4dea3aa06521cfd35fc4552f794cef7578ca5345e22e1eca341dced0c
Instruction ID: f070054b1f2d4e291ec23f3b9d2a8a98cbcd84c1f1225583bb0b9954b72ad78e
Opcode Fuzzy Hash: 732362d4dea3aa06521cfd35fc4552f794cef7578ca5345e22e1eca341dced0c
Instruction Fuzzy Hash: 4E113D736497944AC71A89184C60077FBC697F2204B8DD5BDD5C653345D422EC0DC279

Function 00658278 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10fd84eb35d493625d844e637e1fb177c40288a20f3196d160322e86c00bf206
Instruction ID: 6358e1f40f3aca591aca6060d5bce4c197d1cf64a0b52913d1d9cb7cd99e7de9
Opcode Fuzzy Hash: 10fd84eb35d493625d844e637e1fb177c40288a20f3196d160322e86c00bf206
Instruction Fuzzy Hash: ED2134769002A9CACB248F5488002ADB7B1FF12752FA4D4D9D88877740EF359A89DFA5

Function 006566E6 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a4db2e7a7e6a4b6bfbd63caea179ea7f405d1524a8af3c95513a11a8f7ada3b
Instruction ID: 1d2851d9cf0200ef534333fc4041d5be58524a2de310d216b1db2fa0de9da69b
Opcode Fuzzy Hash: 5a4db2e7a7e6a4b6bfbd63caea179ea7f405d1524a8af3c95513a11a8f7ada3b
Instruction Fuzzy Hash: 781181705083459FDB40EF14CC80A6AB7FAEB9A316F94591CF4C197261E331E959CB16

Function 0065C198 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c51315b3c12bd18b55da43b597f25570391444391c721ad26d4c76662b1ac61
Instruction ID: cb07012d549ff26d933fb2a775abbaa059b14919b3fbea91cb133268b50a6b8a
Opcode Fuzzy Hash: 9c51315b3c12bd18b55da43b597f25570391444391c721ad26d4c76662b1ac61
Instruction Fuzzy Hash: 17210A71508341AFE754CB15C88061BBBF2BB86366F949C2CF8C497362D375D848CB56

Function 00641920 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b896b6d8164971cb7ba37414f80df5efc22a3a844d39286caadf7c5c62d1198
Instruction ID: adf90b13a5babac9cbf8106a50313b3739e88b214fc37667796a33bd6a202b4f
Opcode Fuzzy Hash: 5b896b6d8164971cb7ba37414f80df5efc22a3a844d39286caadf7c5c62d1198
Instruction Fuzzy Hash: 91212570400B508FD7628B34C891A67BBF2FF42301F44499DE6879BA92D736F805CBA4

Function 00668B78 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 6b41a51369e37f22ff55792631c7bdcab051c90b5115fd515f97fc345d6bf18f
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 1F11E573A451D40EC3168D3C84405B9BFA30AE3235F5983D9F4B89B2D6DA228D8A8364

Function 0065E2E8 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 960e2e00e3628e1f5e3ba26c325b6cc30fadb638be8208b4fd5208f2d766984d
Instruction ID: dc9d21991ac040e2ab7a0468e0df63f4937a993b7e9bb239526f08d33135cea1
Opcode Fuzzy Hash: 960e2e00e3628e1f5e3ba26c325b6cc30fadb638be8208b4fd5208f2d766984d
Instruction Fuzzy Hash: E201B1F1A0030147EF289EA584C177BB2AA6F91701F0C056CEC4457342DB77EE0987E9

Function 00656410 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad1a30c5f86df9b29ac032a507831b123af95fa9cc9c1ef612b51c76bc2b554d
Instruction ID: ed916c750fa57f3adfd730b9ef8885f276905cb59121430459db3449ace1e61d
Opcode Fuzzy Hash: ad1a30c5f86df9b29ac032a507831b123af95fa9cc9c1ef612b51c76bc2b554d
Instruction Fuzzy Hash: 371122714083189FC710EF14C8807EAB7E9AF06342F45982CFCC593261E779E688CB66

Function 0063C81B Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7537f5fd8384a83163d866f176097abd77cb40ec27a0881dcf1d300453dad3e
Instruction ID: bc030cd806f93000fe983baba6808164c04260088cbc14a9d68dc6c2116ff175
Opcode Fuzzy Hash: d7537f5fd8384a83163d866f176097abd77cb40ec27a0881dcf1d300453dad3e
Instruction Fuzzy Hash: 3611D6B1E042555BDB09CF64D8807BEFBB7AF9B314F284468E005B3341E774AA05C7A8

Function 0065C3AC Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc9d6f7422685d54ac9c4b229ea6dda6c46a3da1920c7261afbe68902de17981
Instruction ID: eceac0984e5287cd582f7c6a7a0d8ed01072b7c3d8ddd691e26767771c310dd6
Opcode Fuzzy Hash: cc9d6f7422685d54ac9c4b229ea6dda6c46a3da1920c7261afbe68902de17981
Instruction Fuzzy Hash: F501BC70E016068FCB14CF08C8506EAB3F2FF96321F089169E811E73A0E7389944CB50

Function 0063F058 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0bcc21ab59f3068ab92d7e069a64477687dc0058f8902c272e32a697d861a1d
Instruction ID: c63440f853c9597595619fa4ce77ea6bf8d3953273f841e4d94b7e73d783b460
Opcode Fuzzy Hash: e0bcc21ab59f3068ab92d7e069a64477687dc0058f8902c272e32a697d861a1d
Instruction Fuzzy Hash: 67012173A28921078748DD3DDC1156B7AD15BC5630F19873DB9BAC73D0D634C8458655

Function 00648948 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1feb0ecdb06b802b1560528e9a5af3474081b4572b374f0f40b5c4f3f9bd469
Instruction ID: 5a2e9a6fd4a2213b06884c3623018e5597a34c085a6dda788b794c85cd3c829a
Opcode Fuzzy Hash: c1feb0ecdb06b802b1560528e9a5af3474081b4572b374f0f40b5c4f3f9bd469
Instruction Fuzzy Hash: 5FF0ECB2A045119FDF2189999CC0B7BFBDDCF87314F1D1455E88567202D1715880C7E7

Function 00673A08 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 085a7920e2e5b4e779e34a684b632e4f4ebff8cfa837e5ac39cd2be3ef1db2f6
Instruction ID: a194074096558cb3c3f7c784648409e1cd9fa90f328d831ab677f79552f435de
Opcode Fuzzy Hash: 085a7920e2e5b4e779e34a684b632e4f4ebff8cfa837e5ac39cd2be3ef1db2f6
Instruction Fuzzy Hash: FDF0343450C380AFD309EB19C885A2EFBF6EB96205F558D1CE0C997322C735D890CB2A

Function 00676140 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dba64387f099f4ffb45be2b82222d83dc5fb2b584328ce1a123674adc3a9cf20
Instruction ID: 98ed62f69dfe5c41fd4f57c316300039b96878098d28039165f8d8fe72197298
Opcode Fuzzy Hash: dba64387f099f4ffb45be2b82222d83dc5fb2b584328ce1a123674adc3a9cf20
Instruction Fuzzy Hash: E9F01234508240ABC342AF18C48492EFBF2EF0A700F44981CE1C883222D336D820CB6A

Function 0061A64C Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d30a52f00f890bd01d6e84b1357bca7669443c8ff688bb46904ed1c21e63159d
Instruction ID: df6be50f18502566cc6f122d4611d387f1ba98b8b2843fd8386f5e2411df121a
Opcode Fuzzy Hash: d30a52f00f890bd01d6e84b1357bca7669443c8ff688bb46904ed1c21e63159d
Instruction Fuzzy Hash: 90E08C32922278EBCB15DBD8C9049CAF3EDEB48B04B19049AB501D3210C270DF80C7D0

Function 0066EC08 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction ID: 9a14a33d0bfa0bc77aa8b29e03b25df1a3ff9c6580f685870b44a06a127e9e92
Opcode Fuzzy Hash: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction Fuzzy Hash: A2D0A53550C32146DB748D199400CB7F7F1E9C7711F45555EF591E3244D231DC41C269

Function 00602003 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b006c61a739f59fbe7b8b62afac2802cf63951c48a87cddb4a8944d7474d4887
Instruction ID: 457b39e6bf81cfa4dd4c5d4030fe928afd77c1ed4da257fbe1293835d0baed7d
Opcode Fuzzy Hash: b006c61a739f59fbe7b8b62afac2802cf63951c48a87cddb4a8944d7474d4887
Instruction Fuzzy Hash: D5D0923A6059109FC310CF09E440941F7B5FB99630B164156E95493B20C334FC01CAD0

Function 00610F2E Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f509db719341cefea6c6c824f556d87c4149af31b656ab04d21882e9f704e7b0
Instruction ID: 1c9714ae42c76fbc6e8892c2935a3afce3171b78d0bc1caa1fbe56c88346e194
Opcode Fuzzy Hash: f509db719341cefea6c6c824f556d87c4149af31b656ab04d21882e9f704e7b0
Instruction Fuzzy Hash: 83C08C340019009ADE39A91083723F43397A3A2782F8C04CCDC1A8B782C55E9CC3DA01

Function 00642D4B Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a927264b8af54b329c315b56f05fbf2d8de1dbd38e325cfc03de9a518d2d83b6
Instruction ID: 59459a4ec9d75637f72a9a8484dec29af957446eabf937191b5f6220aa64fc52
Opcode Fuzzy Hash: a927264b8af54b329c315b56f05fbf2d8de1dbd38e325cfc03de9a518d2d83b6
Instruction Fuzzy Hash: B5B092E1C0030186EF902A212C5243AB06A0A23311F043434E80726263A526D51881AF

Function 0065D75B Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bde8e0a18542e65954db997d1931066d1f8d4cb0ee69fd957d26d9737444eaa
Instruction ID: a0bdc1fe2350deec5f71b4c391a8ad9886b6faa6a453d2baa04b71f5a18c38b4
Opcode Fuzzy Hash: 9bde8e0a18542e65954db997d1931066d1f8d4cb0ee69fd957d26d9737444eaa
Instruction Fuzzy Hash: 1DB092E1C025108698522E912D035EEB1262913301F0830B9E80622243AA96E21A8AFF

Function 00676343 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 005c4ba806c1f729e01d7b345e607bcf037a1a2af418616e2fc01539d0967c76
Instruction ID: 7795c8e62c6c1a2cba6d6766a4d5bb610867df3ac219b3c08ddfb2e365f90ae1
Opcode Fuzzy Hash: 005c4ba806c1f729e01d7b345e607bcf037a1a2af418616e2fc01539d0967c76
Instruction Fuzzy Hash: D2B092B09083409BE644CF04C4A053AF3B5FB87229F00A82CE15AA3152C330E808CF0E

Function 0067604C Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e353222c480a1e836f2e88ec6b0f54e01aefb973cbd9e2a65436a63ab80d9507
Instruction ID: 90b20a1011eb729eb64d159c706abf0f2e45b7b0e11e27798d7b31732cf018ce
Opcode Fuzzy Hash: e353222c480a1e836f2e88ec6b0f54e01aefb973cbd9e2a65436a63ab80d9507
Instruction Fuzzy Hash: F7A00225E5C10197C60CCF24A950571E2B95BBF205F513428C005BB852D510D440961C

Function 0064338E Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee70fe1013954b18253420cd7c879e3bafbcdc7016d02e7bb28bbb050ed5ff3e
Instruction ID: eb9c71f61387cf9290d7c446bbbdb1ba1a08eb420cde55b5b5e8e69408f34382
Opcode Fuzzy Hash: ee70fe1013954b18253420cd7c879e3bafbcdc7016d02e7bb28bbb050ed5ff3e
Instruction Fuzzy Hash: C0900224D4830086C2488E409490470E23A564F606E117018850D334924620E500850C

Function 0064165F Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0348c40113168c569ecdbaf33ce4c7ca3883923b3352dc9550a20db56e356de0
Instruction ID: 125aa2fd33e84a88d69890093f1abe8245766079576a578208108fcfe1822cf2
Opcode Fuzzy Hash: 0348c40113168c569ecdbaf33ce4c7ca3883923b3352dc9550a20db56e356de0
Instruction Fuzzy Hash: D9900228D582008A8100CE4494A0470F278620B206F1034109008F3012D210E804850C

Function 006053B1 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 006053B8
std::_Lockit::_Lockit.LIBCPMT ref: 006053C2
int.LIBCPMT ref: 006053D9

Part of subcall function 006016B4: std::_Lockit::_Lockit.LIBCPMT ref: 006016C5
Part of subcall function 006016B4: std::_Lockit::~_Lockit.LIBCPMT ref: 006016DF

std::_Facet_Register.LIBCPMT ref: 00605413
std::_Lockit::~_Lockit.LIBCPMT ref: 00605433
Concurrency::cancel_current_task.LIBCPMT ref: 00605440

Strings

R[`, xrefs: 00605420

Memory Dump Source

Source File: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID: R[`
API String ID: 55977855-2223293963
Opcode ID: 5365842756e8425dd6068b7bf72aa51189311a62ebdca5792102007b60b452d8
Instruction ID: 54ab98e326e9b057522b52684af6144f00c40b0d63e768b681023e6ae006432b
Opcode Fuzzy Hash: 5365842756e8425dd6068b7bf72aa51189311a62ebdca5792102007b60b452d8
Instruction Fuzzy Hash: 9411CD71950A249BCB59EF64D8056AFB7A7AF54320F54450DF802AB2D1DFB4AE008F88

Function 0060A5C8 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 0060A6E7
___TypeMatch.LIBVCRUNTIME ref: 0060A7F5
CallUnexpected.LIBVCRUNTIME ref: 0060A962

Strings

csm, xrefs: 0060A71E
csm, xrefs: 0060A672
csm, xrefs: 0060A605

Memory Dump Source

Source File: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID: CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 1206542248-393685449
Opcode ID: 1fc19b99819e03ab9f27490038e5ff532c04d4fc66ea036a014de1fcd92f48f7
Instruction ID: 24788394588bbfeed22b8b56c3d9926ab7bcdc669bca0339ad80a21a312c147d
Opcode Fuzzy Hash: 1fc19b99819e03ab9f27490038e5ff532c04d4fc66ea036a014de1fcd92f48f7
Instruction Fuzzy Hash: 61B17931880309EFCF19DFE4C8819AFB7B6BF14390B158169E8116B382D731DA52CB96

Function 00615F4A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,F8250000,?,00952EB8,?,00616057,0060C446,?,F8250000,00000000), ref: 0061600B

Strings

api-ms-, xrefs: 00615FA1
ext-ms-, xrefs: 00615FB5

Memory Dump Source

Source File: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 8f9e8aca99b3b58877ad94658b9a58ab2e55e9813b6596be6039757401180529
Instruction ID: 071903bdb8699784404c6372a8a37c6087af016bba036c72a8ff5bd02c718b74
Opcode Fuzzy Hash: 8f9e8aca99b3b58877ad94658b9a58ab2e55e9813b6596be6039757401180529
Instruction Fuzzy Hash: 6921DB32A00920EBD7319B64EC44ADAB7679F81760F291115F907A73D0DB30ED42CAA0

Function 0060507A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00605081
std::_Lockit::_Lockit.LIBCPMT ref: 0060508C
std::locale::_Setgloballocale.LIBCPMT ref: 006050A7
_Yarn.LIBCPMT ref: 006050BD
std::_Lockit::~_Lockit.LIBCPMT ref: 006050FA

Strings

R[`, xrefs: 006050C9, 006050ED

Memory Dump Source

Source File: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID: Lockitstd::_$H_prolog3Lockit::_Lockit::~_SetgloballocaleYarnstd::locale::_
String ID: R[`
API String ID: 156189095-2223293963
Opcode ID: e19c40cc63c70494a56b72f1e40344f8989404fb52b59219a2ddb7b498c5c2bd
Instruction ID: 9f71429c7d7e92690210fb3df3b5765667711b91426a1a51d515fd2b923e2ca3
Opcode Fuzzy Hash: e19c40cc63c70494a56b72f1e40344f8989404fb52b59219a2ddb7b498c5c2bd
Instruction Fuzzy Hash: D601BC71A409659BC719AB20EC56A7E7BA3BF85340B14504DFA12173C1CF34AE02CFC9

Function 00610F50 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,00952EB8,?,?,00000000,00621FC8,000000FF,?,00610EE0,00611010,?,00610EB4,00000000), ref: 00610F85
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00610F97
FreeLibrary.KERNEL32(00000000,?,?,00000000,00621FC8,000000FF,?,00610EE0,00611010,?,00610EB4,00000000), ref: 00610FB9

Strings

CorExitProcess, xrefs: 00610F8F
R[`, xrefs: 00610FA8
mscoree.dll, xrefs: 00610F7E

Memory Dump Source

Source File: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$R[`$mscoree.dll
API String ID: 4061214504-461565684
Opcode ID: 562192e67ce76739d32c56294cc48b02821e00ca92fb2eec8e9b9eba896f6779
Instruction ID: 4f87f4c76170a6fd2b71475956fdbd85dae7e20b1577682cc6c0332103e2c676
Opcode Fuzzy Hash: 562192e67ce76739d32c56294cc48b02821e00ca92fb2eec8e9b9eba896f6779
Instruction Fuzzy Hash: EE014F31904A25EFDB218F54DC0AFEEBBBAFB04B14F044529FC11A2790DBB99945CE90

Function 0061F356 Relevance: 9.3, APIs: 6, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 590d4ae8e5c71caa967e511dc31e8b12db1b2b5ec1c1ad45361836be9aa1931f
Instruction ID: 340c962da1e77167a74abf0fafda9140993b9bc95903b26bcad1d2c045957068
Opcode Fuzzy Hash: 590d4ae8e5c71caa967e511dc31e8b12db1b2b5ec1c1ad45361836be9aa1931f
Instruction Fuzzy Hash: 9CB1B770A04209AFDB15DF99D840BEE7BB3EF59310F184269E4159B3A2C7719D82CFA4

Function 0060A25A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0060A251,00608978,00607AFF), ref: 0060A268
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0060A276
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0060A28F
SetLastError.KERNEL32(00000000,0060A251,00608978,00607AFF), ref: 0060A2E1

Memory Dump Source

Source File: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 5002f467781bdf411f28b33aef3f58126b0748163cf8ba9ca58d8c64c343d9bc
Instruction ID: 3edffa12d6d4f7c48bc0172ea6ca899ef807564b6170bb69e8efe07fa07c6238
Opcode Fuzzy Hash: 5002f467781bdf411f28b33aef3f58126b0748163cf8ba9ca58d8c64c343d9bc
Instruction Fuzzy Hash: C401923228DB116ED76D2AB47C86AA72787EB027B4B34523DF510452F1EB524E03515A

Function 0060A371 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0060A438
___AdjustPointer.LIBCMT ref: 0060A45B
___AdjustPointer.LIBCMT ref: 0060A4F7

Strings

R[`, xrefs: 0060A3D0

Memory Dump Source

Source File: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID: AdjustPointer
String ID: R[`
API String ID: 1740715915-2223293963
Opcode ID: 4e6a072d58c561ae1835638e918430b8b12a8c4a57f1b45c054a47058756e221
Instruction ID: d215db01fde1230f05a3078024eab62a10f0fc4c693ab43bac2f49ecb0b97338
Opcode Fuzzy Hash: 4e6a072d58c561ae1835638e918430b8b12a8c4a57f1b45c054a47058756e221
Instruction Fuzzy Hash: F151CD7A6803069FDB2D8F94D845BAB73E7EF10390F24452DE8458A2D1E7B1AC41CB92

Function 00604436 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00604442
int.LIBCPMT ref: 00604455

Part of subcall function 006016B4: std::_Lockit::_Lockit.LIBCPMT ref: 006016C5
Part of subcall function 006016B4: std::_Lockit::~_Lockit.LIBCPMT ref: 006016DF

std::_Facet_Register.LIBCPMT ref: 00604488
std::_Lockit::~_Lockit.LIBCPMT ref: 0060449E
Concurrency::cancel_current_task.LIBCPMT ref: 006044A9

Memory Dump Source

Source File: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: fe45d35191e932afbf690e81cad119be6f69bb11f6e55d503b70645a828989de
Instruction ID: e4bc956e008b169940ee12ea4d97d3e17bb52361215f82fa4895c13dfe17c8e0
Opcode Fuzzy Hash: fe45d35191e932afbf690e81cad119be6f69bb11f6e55d503b70645a828989de
Instruction Fuzzy Hash: 6101A7B2540114ABCB2DEB54D8459EF77AADF81360B24015DF9056B2D1DF30AE41C794

Function 00603DB1 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00603DBD
int.LIBCPMT ref: 00603DD0

Part of subcall function 006016B4: std::_Lockit::_Lockit.LIBCPMT ref: 006016C5
Part of subcall function 006016B4: std::_Lockit::~_Lockit.LIBCPMT ref: 006016DF

std::_Facet_Register.LIBCPMT ref: 00603E03
std::_Lockit::~_Lockit.LIBCPMT ref: 00603E19
Concurrency::cancel_current_task.LIBCPMT ref: 00603E24

Memory Dump Source

Source File: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 4287afd075a8174be07d0fb11d85521152fe30773823eb91ac5d08e53d10d4fc
Instruction ID: 6b781e97c1ec8a834d2f827bde2d1149eff3417a17eb0f86828a6f4ad183ae2d
Opcode Fuzzy Hash: 4287afd075a8174be07d0fb11d85521152fe30773823eb91ac5d08e53d10d4fc
Instruction Fuzzy Hash: A7018472544124ABCB2DAB54DC4589F776A9F51760B24024DF9055B3D1EF31DE01CB84

Function 00604308 Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00604315
int.LIBCPMT ref: 00604328

Part of subcall function 006016B4: std::_Lockit::_Lockit.LIBCPMT ref: 006016C5
Part of subcall function 006016B4: std::_Lockit::~_Lockit.LIBCPMT ref: 006016DF

std::_Facet_Register.LIBCPMT ref: 0060435B
std::_Lockit::~_Lockit.LIBCPMT ref: 00604371
Concurrency::cancel_current_task.LIBCPMT ref: 0060437C

Memory Dump Source

Source File: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 4cda794c51c13841caf5eb90e6a42f7fcefeabf60b41ce526ac5abba123857c1
Instruction ID: 30dab2baa1fdeaa7fa3cee034bac0ba202923e186adf06d658f5c88921863953
Opcode Fuzzy Hash: 4cda794c51c13841caf5eb90e6a42f7fcefeabf60b41ce526ac5abba123857c1
Instruction Fuzzy Hash: 0C01D4B6540414A7CB2DAB6498458DF77679F90750B241158F9016B2D1EF309E01CBC4

Function 0060A060 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 0060A09F
__IsNonwritableInCurrentImage.LIBCMT ref: 0060A153

Strings

R[`, xrefs: 0060A16C
csm, xrefs: 0060A13D

Memory Dump Source

Source File: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: R[`$csm
API String ID: 3480331319-3357048434
Opcode ID: 921548a710121ab5a54e7945458b7e813292818efa8c922cdfb6593aee8b6668
Instruction ID: dabed4e1f6710aac0850057142dc367bfffd725b17a2b05f299c1f728b81cb3a
Opcode Fuzzy Hash: 921548a710121ab5a54e7945458b7e813292818efa8c922cdfb6593aee8b6668
Instruction Fuzzy Hash: 8E41C330A40318ABCF14DFA8C885AAF7BB2AF45354F148099E8155B3D2C731DE56CF91

Function 0060B3A2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,0060B353,00000000,?,006868CC,?,?,?,0060B4F6,00000004,InitializeCriticalSectionEx,00624BD8,InitializeCriticalSectionEx), ref: 0060B3AF
GetLastError.KERNEL32(?,0060B353,00000000,?,006868CC,?,?,?,0060B4F6,00000004,InitializeCriticalSectionEx,00624BD8,InitializeCriticalSectionEx,00000000,?,0060B2AD), ref: 0060B3B9
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 0060B3E1

Strings

api-ms-, xrefs: 0060B3C6

Memory Dump Source

Source File: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 167cecbac5f6304bd0bb96a450e1950f8aa37b3582814d9217df029c20186db5
Instruction ID: c63d31f26ed233dd547ef1019a2f908c1770265fcb4ebce39305d8b16c1e41e5
Opcode Fuzzy Hash: 167cecbac5f6304bd0bb96a450e1950f8aa37b3582814d9217df029c20186db5
Instruction Fuzzy Hash: 34E01A30384614B7EB251F71EC4AB9E3E5AAB00B41F209021FA0DE82E1EB659A518A94

Function 00617747 Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(00952EB8,00000000,00000000,00000000), ref: 006177AA

Part of subcall function 0061952A: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00618FD3,?,00000000,-00000008), ref: 006195D6

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00617A05
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00617A4D
GetLastError.KERNEL32 ref: 00617AF0

Memory Dump Source

Source File: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 28edfa666cf51f42b35ee7ea2e651857f4350c29841de8ee1ef7a489cc48cc97
Instruction ID: edc86dc9a18286bb1a7393a130c5fc2da633c456e72e7c4f15785e230ddce3fd
Opcode Fuzzy Hash: 28edfa666cf51f42b35ee7ea2e651857f4350c29841de8ee1ef7a489cc48cc97
Instruction Fuzzy Hash: 60D18C75E04258AFCF15CFA8C8809EDBBB6FF49310F18852AE855EB351D730A986CB50

Function 006206EF Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,00000000,?,0061F713,00000000,00000001,00000000,00000000,?,00617B44,00000000,00000000,00000000), ref: 00620706
GetLastError.KERNEL32(?,0061F713,00000000,00000001,00000000,00000000,?,00617B44,00000000,00000000,00000000,00000000,00000000,?,006180CB,00000000), ref: 00620712

Part of subcall function 006206D8: CloseHandle.KERNEL32(FFFFFFFE,00620722,?,0061F713,00000000,00000001,00000000,00000000,?,00617B44,00000000,00000000,00000000,00000000,00000000), ref: 006206E8

___initconout.LIBCMT ref: 00620722

Part of subcall function 0062069A: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,006206C9,0061F700,00000000,?,00617B44,00000000,00000000,00000000,00000000), ref: 006206AD

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,?,0061F713,00000000,00000001,00000000,00000000,?,00617B44,00000000,00000000,00000000,00000000), ref: 00620737

Memory Dump Source

Source File: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: ffebbadf597d258a7da1133cb54aa4f03378cc30821a0452e55da1e5ea771799
Instruction ID: 2c495464116010d93f96cee99ec95d1583b0e5abc1f63ddbd40102695b0acef2
Opcode Fuzzy Hash: ffebbadf597d258a7da1133cb54aa4f03378cc30821a0452e55da1e5ea771799
Instruction Fuzzy Hash: FDF01536100978BBDF622F95EC09ECA3FA7FB493A1B105010FA1995621CB328922DF94

Function 00621093 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,006209EF), ref: 006210AC

Strings

Lib, xrefs: 00621241
R[`, xrefs: 00621176, 00621220, 00621266

Memory Dump Source

Source File: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID: DecodePointer
String ID: Lib$R[`
API String ID: 3527080286-2254151100
Opcode ID: 36c96d38b3a9809ebc6516deaf58ecb79b9a6d704bf7576d9917b590ac92cb32
Instruction ID: 83fcf67feb6826994744f524e93eb18b253c81f518b06c4a0e2102e192dc9c86
Opcode Fuzzy Hash: 36c96d38b3a9809ebc6516deaf58ecb79b9a6d704bf7576d9917b590ac92cb32
Instruction Fuzzy Hash: DE516C70908D2ADBCB108FA8F94C1FD7FB6FB27300F114145E591AE254CB748AA68F54

Function 00605F4D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

_Fputc.LIBCPMT ref: 00606026

Strings

R[`, xrefs: 00606005

Memory Dump Source

Source File: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID: Fputc
String ID: R[`
API String ID: 3078413507-2223293963
Opcode ID: 121ec734f6e2ad95ed4c935e59345b2c8a3489b49cc1186f389c47ea4cf0ca88
Instruction ID: 515e94d70193c4ad962324dc1134e14f7bb93dab6027f7040248f20b06015192
Opcode Fuzzy Hash: 121ec734f6e2ad95ed4c935e59345b2c8a3489b49cc1186f389c47ea4cf0ca88
Instruction Fuzzy Hash: 08415C36950A1BABCB18DF64C5808EFBBBAFF08350B14442AE542A7780E735F951CF90

Function 0060A96D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 0060A992

Strings

MOC, xrefs: 0060A9A4
RCC, xrefs: 0060A9AC

Memory Dump Source

Source File: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 6c7524d0403fd51cf7e8d92641da3f5b31f3f7c90937f682c3d3435b2a2c63e7
Instruction ID: e4df7dbdbaf0e3d02dbaecc276c43e9411c8d924966d7ac2f48d7a1664fa12ef
Opcode Fuzzy Hash: 6c7524d0403fd51cf7e8d92641da3f5b31f3f7c90937f682c3d3435b2a2c63e7
Instruction Fuzzy Hash: FC417C31A40209AFCF1ADFD8CE81AEEBBB6FF48340F194059F904A7291D3359950DB52

Function 00606CA2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00607643
___raise_securityfailure.LIBCMT ref: 0060772B

Strings

heh, xrefs: 00607726

Memory Dump Source

Source File: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: heh
API String ID: 3761405300-3798349058
Opcode ID: 7673c07ac6ad5a4a8a98fb5aafcddbdf9fa3a62ec9519f5f634f0eaa52a92033
Instruction ID: 840910c74cebc3c69a26feade68dffd95afe8ccb8968ec2385abee7ca2c018f5
Opcode Fuzzy Hash: 7673c07ac6ad5a4a8a98fb5aafcddbdf9fa3a62ec9519f5f634f0eaa52a92033
Instruction Fuzzy Hash: 8221C2B4951280EAE714CF29F956B403BB6FB58300F10A72AF6058B3B1E3B55882CF06

Function 00605107 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00605113
std::_Lockit::~_Lockit.LIBCPMT ref: 0060516F

Strings

R[`, xrefs: 0060513A, 00605154

Memory Dump Source

Source File: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID: R[`
API String ID: 593203224-2223293963
Opcode ID: b8fad88d402a78264736eee98a837e2e76b6553919665725008b835d49c9a619
Instruction ID: e3b30861c34db565af8df86b45d26c7ca612acda55e78e65da3c4343354b989e
Opcode Fuzzy Hash: b8fad88d402a78264736eee98a837e2e76b6553919665725008b835d49c9a619
Instruction Fuzzy Hash: C6019E71640A14EFCB19DB14C885E9E77BAEF85710B040099E9029B3E1DF70EE01CF50

Function 00607740 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0060774B
___raise_securityfailure.LIBCMT ref: 00607808

Strings

heh, xrefs: 00607803

Memory Dump Source

Source File: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: heh
API String ID: 3761405300-3798349058
Opcode ID: 10931a168bf696d44809b8b123ec67d494fa8895efc2de03e375363862665ef6
Instruction ID: fd5d97347ada495282dbfe31d459881b8677771616743e08773f044081fa0440
Opcode Fuzzy Hash: 10931a168bf696d44809b8b123ec67d494fa8895efc2de03e375363862665ef6
Instruction Fuzzy Hash: 59116DB4951284EBD710DF29F956A407BB6BB18340F00A32AF9098B3A1F7B19981CF56

Function 006015DF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 006015E6
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0060161E

Part of subcall function 00605178: _Yarn.LIBCPMT ref: 00605197
Part of subcall function 00605178: _Yarn.LIBCPMT ref: 006051BB

Strings

bad locale name, xrefs: 0060162C

Memory Dump Source

Source File: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: 6b62b26b2b518c53c21988bb5f236ac32f856fb0f3945864689ce16e70da88b2
Instruction ID: b06429db55e580ad873830eb78c0076a53e7e11ab70afa6ec901141b3bc3ced7
Opcode Fuzzy Hash: 6b62b26b2b518c53c21988bb5f236ac32f856fb0f3945864689ce16e70da88b2
Instruction Fuzzy Hash: FCF017B1545B909EC3359F7A9481447FBE5BE293103948A2EE1DEC3A51D730A404CB6A

Function 006162A6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?), ref: 006162E6

Strings

InitializeCriticalSectionEx, xrefs: 006162B6
R[`, xrefs: 006162D6

Memory Dump Source

Source File: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx$R[`
API String ID: 2593887523-2802038405
Opcode ID: 47ad4ffbd3fb4dc52b93568b06ad7b52952898b8682221049c67701c147ece3d
Instruction ID: ab9fb5d9e125cd46e80aff1439239103762e122db81112177ec6ebc9a79493f5
Opcode Fuzzy Hash: 47ad4ffbd3fb4dc52b93568b06ad7b52952898b8682221049c67701c147ece3d
Instruction Fuzzy Hash: 60E0ED36644638B7CF112F61ED06EDA7E27EB447A1B054021FD1819260CBB6DA619BD4

Function 0061612C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 00616160

Strings

R[`, xrefs: 00616156
FlsAlloc, xrefs: 0061613C

Memory Dump Source

Source File: 00000000.00000002.1817376479.0000000000601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00600000, based on PE: true

Associated: 00000000.00000002.1817364784.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817394709.0000000000623000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817408835.000000000062D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817443667.0000000000685000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817456122.0000000000686000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1817468450.0000000000688000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_600000_PFW1cgN8EK.jbxd

Similarity

API ID: Alloc
String ID: FlsAlloc$R[`
API String ID: 2773662609-2451963224
Opcode ID: 63d004f821dec641a19a08925f1382db312cf4654f8261b58edb2f4c34e59e1c
Instruction ID: d40e20fbe2e066bc8cbf32556a44e04f81aa9fd1b9ba24c742722ccaf4438217
Opcode Fuzzy Hash: 63d004f821dec641a19a08925f1382db312cf4654f8261b58edb2f4c34e59e1c
Instruction Fuzzy Hash: B1E0CD39684A747393212664FD07EDE7A178B54B617094010F90415281CAE6995199D5

Analysis Process: MSBuild.exePID: 7380, Parent PID: 7348COMMON

Execution Graph

Execution Coverage:	1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.3%
Total number of Nodes:	44
Total number of Limit Nodes:	6

Executed Functions

Function 0040D390 Relevance: 6.2, APIs: 4, Instructions: 154
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetInputState.USER32 ref: 0040D3A1
GetCurrentThreadId.KERNEL32 ref: 0040D3B6
GetCurrentProcessId.KERNEL32 ref: 0040D3BC
ExitProcess.KERNEL32 ref: 0040D580

Memory Dump Source

Source File: 00000003.00000002.1713298694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Similarity

API ID: CurrentProcess$ExitInputStateThread
String ID:
API String ID: 1029096631-0
Opcode ID: 91b0cbc643e4b4ebeb18023be9ae76da3501924d19314061550aa6d351ab72eb
Instruction ID: 7fe0d86d4b211a0ed1928a564c0dc3b48ff1420feaec6627cd99d8fdc632b15c
Opcode Fuzzy Hash: 91b0cbc643e4b4ebeb18023be9ae76da3501924d19314061550aa6d351ab72eb
Instruction Fuzzy Hash: CE41277480C240ABD301BFA9D544A1EFBF5EF56708F148D2EE5C4A7392D23AD8148B6B

Function 004464F0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(00449A1D,005C003F,00000006,?,?,00000018,,?,?), ref: 0044651E

Strings

, xrefs: 004464F0, 0044650C, 0044651A

Memory Dump Source

Source File: 00000003.00000002.1713298694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-3019521637
Opcode ID: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction ID: fb6f357373f259be8b0e83fffc5d2a3912a28e0da7d2036ce94b71e982b3a7e9
Opcode Fuzzy Hash: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction Fuzzy Hash: 76E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82

Function 00446040 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 72
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlReAllocateHeap.NTDLL(?,00000000), ref: 004460C4

Strings

;:9, xrefs: 004460B6, 00446093, 0044609B
aD, xrefs: 004460CA

Memory Dump Source

Source File: 00000003.00000002.1713298694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Similarity

API ID: AllocateHeap
String ID: aD$;:9
API String ID: 1279760036-3784982549
Opcode ID: b2b91b6383baed23bd5779aad5e8932164b52d5e1660306671fc792bfb274a1b
Instruction ID: 81d8e38a202773684cb26477d2aab6f794b7f55265c2f37ac0847f9732ca8712
Opcode Fuzzy Hash: b2b91b6383baed23bd5779aad5e8932164b52d5e1660306671fc792bfb274a1b
Instruction Fuzzy Hash: 70119D75508200EBD301EF28E900A1ABBF5AF86B16F05483DE5C58B212E73AD854CB9B

Function 00446709 Relevance: 3.0, APIs: 2, Instructions: 22
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32 ref: 00446709
GetForegroundWindow.USER32 ref: 00446720

Memory Dump Source

Source File: 00000003.00000002.1713298694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 61e954c21ccda2bc507880c9326b32b816de450e3ecc2bacd25776dc5b00f227
Instruction ID: 906c729b96ff40db5e6bb0cb1f2bfce635365c04e2c32f2be8addff1d813b1a5
Opcode Fuzzy Hash: 61e954c21ccda2bc507880c9326b32b816de450e3ecc2bacd25776dc5b00f227
Instruction Fuzzy Hash: 4ED05EACA12240A7EA04FB37FC1E85B3615E79221E7464838E40686312D636E851C65B

Function 00445C4A Relevance: 1.6, APIs: 1, Instructions: 71
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(33A03193,00000000,00000800), ref: 00445CD7

Memory Dump Source

Source File: 00000003.00000002.1713298694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 72bf814f0518dc5835282787a3600c9ebb27de0fde571f4b41e5eadb2c516951
Instruction ID: 1ed73a75136f75e105c7bb7e785e3dfd24c55cc57a7816ce4e470644bd5d90c0
Opcode Fuzzy Hash: 72bf814f0518dc5835282787a3600c9ebb27de0fde571f4b41e5eadb2c516951
Instruction Fuzzy Hash: 7A218C7520C380AFE745CF29E99061BBBE1ABC9205F58C82DF5C987352C238D905DB6A

Function 00443A20 Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 00443A83

Memory Dump Source

Source File: 00000003.00000002.1713298694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: bbe3c0725eeb12269a4fd9373789c992c7f1f0aafca5c16579677f982f5a7c14
Instruction ID: 208812190be25b9880a5f29952ef9a922b1c788544e9e186d94aa430ee1b0748
Opcode Fuzzy Hash: bbe3c0725eeb12269a4fd9373789c992c7f1f0aafca5c16579677f982f5a7c14
Instruction Fuzzy Hash: 67F0373410C2409BE301EF19D954A0EBBF4EF9A701F14886CE4C89B2A2C335E814CBAB

Function 00443AA0 Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000), ref: 00443B03

Memory Dump Source

Source File: 00000003.00000002.1713298694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 5c61f5cf0f16499e49ba7738a8fe8bc67c56cab5a0bd252042df475734ab51e5
Instruction ID: 302f255876a8acf85142c7b8a32416b12f9909014dbe577f3d47d642ddc48781
Opcode Fuzzy Hash: 5c61f5cf0f16499e49ba7738a8fe8bc67c56cab5a0bd252042df475734ab51e5
Instruction Fuzzy Hash: 84F04F3450C2509BD701AF18E945A1EFBF5EF56706F454C68F4C4AB261C339DD60CB9A

Non-executed Functions

Function 0042D9A0 Relevance: 14.4, APIs: 1, Strings: 7, Instructions: 396COMMON

Download Yara Rule

Strings

Dtgr, xrefs: 0042E5C6
US, xrefs: 0042E1C3
WJL{, xrefs: 0042E5FA, 0042E604, 0042E464, 0042E46D, 0042E60D, 0042E62F
sLlS, xrefs: 0042E5D6
9u9s, xrefs: 0042E183
RB, xrefs: 0042E64C
sB, xrefs: 0042E66D

Memory Dump Source

Source File: 00000003.00000002.1713298694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Similarity

API ID:
String ID: 9u9s$Dtgr$RB$WJL{$sLlS$sB$US
API String ID: 0-3351958040
Opcode ID: 276c1ab203addd20c735120bb759d55bade8af3356c5969ab96734506833bd0c
Instruction ID: cba3938b4c7428f4d552087925c859a69b1ab55a6ae02eac8884ff4f61b23fd4
Opcode Fuzzy Hash: 276c1ab203addd20c735120bb759d55bade8af3356c5969ab96734506833bd0c
Instruction Fuzzy Hash: B1F167B4508340DFD710AF66E89061BBBF0AF86345F54892EF5848B362D3B9C844CF9A

Function 004396A0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 004396B0
GetWindowLongW.USER32 ref: 004396D5
GetClipboardData.USER32 ref: 004396E5
GlobalLock.KERNEL32 ref: 004396FE
GlobalUnlock.KERNEL32 ref: 004397EC
CloseClipboard.USER32 ref: 004397F5

Strings

=, xrefs: 00439773

Memory Dump Source

Source File: 00000003.00000002.1713298694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID: =
API String ID: 2832541153-2322244508
Opcode ID: 78c8dc26131ed5dac9393a6ada90e30b4fdfd99cd617a6bba74dde0b2099fdf1
Instruction ID: 322da3c77394848e095178107a49c73a551c132a77b07a9a0bf135f40f579efd
Opcode Fuzzy Hash: 78c8dc26131ed5dac9393a6ada90e30b4fdfd99cd617a6bba74dde0b2099fdf1
Instruction Fuzzy Hash: 4941537551C381CED311AF7C944831EBFE09B96224F044E6DF4E5862D1D3788945C797

Function 00428230 Relevance: 1.7, APIs: 1, Instructions: 242comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(0044DB80,00000000,00000001,0044DB70), ref: 00428259

Memory Dump Source

Source File: 00000003.00000002.1713298694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: e7c828e8500b304e47737f2c036b73e87bd74cd8a23869b162ce918d436332e7
Instruction ID: 8b374b447a84a3eb6516e4531b44e52363fa817f3f4265ccba2139a59f939f2f
Opcode Fuzzy Hash: e7c828e8500b304e47737f2c036b73e87bd74cd8a23869b162ce918d436332e7
Instruction Fuzzy Hash: C651EDB07002209BDB20EB64EC92B6B33B4EF81758F54455DF9858B390FB79E801C76A

Function 0043FDBB Relevance: 31.9, APIs: 11, Strings: 7, Instructions: 425memorycomCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(0044DCE0,00000000,00000001,0044DCD0,?), ref: 0043FE41
SysAllocString.OLEAUT32(?), ref: 0043FEC5
CoSetProxyBlanket.OLE32(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0043FF03
SysAllocString.OLEAUT32(?), ref: 0043FF65
SysAllocString.OLEAUT32(?), ref: 00440015
VariantInit.OLEAUT32(6D3F6B39), ref: 0044007E
VariantClear.OLEAUT32(?), ref: 00440123
SysFreeString.OLEAUT32(?), ref: 00440145
SysFreeString.OLEAUT32(?), ref: 0044014E
SysFreeString.OLEAUT32(?), ref: 00440181

Strings

l3u5, xrefs: 0043FF77
hKpM, xrefs: 0043FF85
q7bI, xrefs: 0043FF7E
9k?m, xrefs: 0043FFBD
bS3U, xrefs: 0043FFAF
1[!], xrefs: 0043FFA1
"_kQ, xrefs: 0043FFA8

Memory Dump Source

Source File: 00000003.00000002.1713298694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Similarity

API ID: String$AllocFree$Variant$BlanketClearCreateInitInstanceProxy
String ID: "_kQ$1[!]$9k?m$bS3U$hKpM$l3u5$q7bI
API String ID: 2485776651-1023481837
Opcode ID: 3b03e2147dce430a0f8925663908d52cba351bca58096ea1b67891df1644cd7a
Instruction ID: abc33ae36a095545e2bb41dcd0e979c6fcd6de482cd85a6a90bd509a0ecf98e9
Opcode Fuzzy Hash: 3b03e2147dce430a0f8925663908d52cba351bca58096ea1b67891df1644cd7a
Instruction Fuzzy Hash: 1FE16974100B01EFE3208F15C985B16BBF1FF4AB02F148969E59A8BAA1C775F855CF98

Function 004365E8 Relevance: 19.3, APIs: 2, Strings: 9, Instructions: 78COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 004365F4
VariantInit.OLEAUT32 ref: 00436606

Strings

_, xrefs: 0043665F
Y, xrefs: 00436647
O, xrefs: 0043661F
[, xrefs: 0043664F
U, xrefs: 00436637
], xrefs: 00436657
S, xrefs: 0043662F
W, xrefs: 0043663F
Q, xrefs: 00436627

Memory Dump Source

Source File: 00000003.00000002.1713298694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Similarity

API ID: Variant$ClearInit
String ID: O$Q$S$U$W$Y$[$]$_
API String ID: 2610073882-3709029455
Opcode ID: bf4df09837cc0999f8912889e458b68c9d6c2582af1171711b600cbe8bd283c9
Instruction ID: 617472aee6f7647b6791f64ddb482ed0964e05965680e50c34387cf75e2fd40f
Opcode Fuzzy Hash: bf4df09837cc0999f8912889e458b68c9d6c2582af1171711b600cbe8bd283c9
Instruction Fuzzy Hash: 8041E970008B81CED721DF38C894756BFE0AB56314F08869DD8EA4F3D6C775A549CB66

Function 004360C9 Relevance: 19.3, APIs: 2, Strings: 9, Instructions: 73COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 004360DA
VariantInit.OLEAUT32 ref: 004360EC

Strings

O, xrefs: 00436105
U, xrefs: 0043611D
W, xrefs: 00436125
_, xrefs: 00436145
], xrefs: 0043613D
[, xrefs: 00436135
Q, xrefs: 0043610D
Y, xrefs: 0043612D
S, xrefs: 00436115

Memory Dump Source

Source File: 00000003.00000002.1713298694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Similarity

API ID: Variant$ClearInit
String ID: O$Q$S$U$W$Y$[$]$_
API String ID: 2610073882-3709029455
Opcode ID: f7635afb3bd54eb494f8a0a77bb65c5c2b8a5d4eaa981fde32eb2f6ea89c106d
Instruction ID: 3870ab933f990c28619918e5480d85312f3f30b48fe24ca90a854e860725b9d7
Opcode Fuzzy Hash: f7635afb3bd54eb494f8a0a77bb65c5c2b8a5d4eaa981fde32eb2f6ea89c106d
Instruction Fuzzy Hash: 9C41B474009BC1CEE725DF38C898B46BFA06B56314F088A9DD8E94F296C375A515CB62

Function 00438B2F Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 95COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00438B74

Strings

d, xrefs: 00438B8E
i, xrefs: 00438B96
t, xrefs: 00438BD6
}, xrefs: 00438BDE
|, xrefs: 00438BB6
p, xrefs: 00438BC6

Memory Dump Source

Source File: 00000003.00000002.1713298694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Similarity

API ID: InitVariant
String ID: d$i$p$t$|$}
API String ID: 1927566239-2434808017
Opcode ID: 554a65b0e6783a8a587c5d9d5a1a59090ef91d405a8573379fac870fe920457a
Instruction ID: 0b84109ddb38ce271a869d6b766c0ab2b1e4120020a45687ac22dc4c2f8272eb
Opcode Fuzzy Hash: 554a65b0e6783a8a587c5d9d5a1a59090ef91d405a8573379fac870fe920457a
Instruction Fuzzy Hash: FE411870508781CED725CF28C494716BFE0AB66324F08869DD8EA4F397C775E515CBA2

Function 00438417 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 82COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00438444

Strings

|, xrefs: 00438486
}, xrefs: 004384AE
d, xrefs: 0043845E
t, xrefs: 004384A6
i, xrefs: 00438466
p, xrefs: 00438496

Memory Dump Source

Source File: 00000003.00000002.1713298694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Similarity

API ID: InitVariant
String ID: d$i$p$t$|$}
API String ID: 1927566239-2434808017
Opcode ID: 752ed3a4123867835ced7968c358781d81873fa4b79cdbc7d9d63c2e707b67c3
Instruction ID: 90d411813917745457a09f1c6fb0e7b6a5668ded3b473b778bf00fa4b3dd6296
Opcode Fuzzy Hash: 752ed3a4123867835ced7968c358781d81873fa4b79cdbc7d9d63c2e707b67c3
Instruction Fuzzy Hash: 9541D760108781CED721DF2CC484716BFE06B66214F088A8DD8EA4F7D7C375D519CB62

Function 004126B3 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 301COMMON

Download Yara Rule

Strings

GD, xrefs: 004126C0
fch%, xrefs: 00412788
tBA, xrefs: 00412AE7
wCA, xrefs: 00412B66

Memory Dump Source

Source File: 00000003.00000002.1713298694.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Similarity

API ID:
String ID: GD$fch%$tBA$wCA
API String ID: 0-2815851639
Opcode ID: 18b95ce0547799c8335b9632188030b7790c54437027a763add69c76ec3f01d7
Instruction ID: d035267a3a9853f3dfc0ceb4180196f553011948bb1c76c1f0fbabd1dc92564a
Opcode Fuzzy Hash: 18b95ce0547799c8335b9632188030b7790c54437027a763add69c76ec3f01d7
Instruction Fuzzy Hash: F6B158B04093C1CBE7318F149554BEFBBE0BB8A348F140A6EE4C99B242D7799545CB66

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PFW1cgN8EK.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_PFW1cgN8EK.exe_24c51d7e9c7cc263e148c8bd21fb26a70761fdd_bb6d8bc3_70f64a5d-1e3c-4de4-ade7-ef42e76c9336\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6B73.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6BF1.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6C21.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Windows Analysis Report
PFW1cgN8EK.exe

Function 00602021 Relevance: 9.4, APIs: 1, Strings: 4, Instructions: 631
memoryCOMMON

Function 00616368 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34
COMMONLIBRARYCODE

Function 00618E2E Relevance: 4.7, APIs: 3, Instructions: 202
COMMON

Function 0061A3A6 Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Function 00619FAA Relevance: 1.6, APIs: 1, Instructions: 147
COMMON