Edit tour

Windows Analysis Report
lHHfXU6Y37.exe

Overview

General Information

Sample name:	lHHfXU6Y37.exe renamed because original name is a hash value
Original sample name:	7544bc22211629c705bf9d778cc00479.exe
Analysis ID:	1528629
MD5:	7544bc22211629c705bf9d778cc00479
SHA1:	47259a54213078a59ae67c9aee49e50c87312029
SHA256:	4a69b0742f47207178fb84b6470429b536a3b6250c37a248cff1b68444d26e63
Tags:	32exe
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Sigma detected: Silenttrinity Stager Msbuild Activity

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

lHHfXU6Y37.exe (PID: 7436 cmdline: "C:\Users\user\Desktop\lHHfXU6Y37.exe" MD5: 7544BC22211629C705BF9D778CC00479)

MSBuild.exe (PID: 7452 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

MSBuild.exe (PID: 7460 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

WerFault.exe (PID: 7548 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7436 -s 280 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["dissapoiznw.stor", "studennotediw.stor", "clearancek.site", "spirittunek.stor", "eaglepawnoy.stor", "bathdoomgaz.stor", "trustterwowqm.shop", "licendfilteo.site", "mobbipenju.stor"], "Build id": "tLYMe5--deli333"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Silenttrinity Stager Msbuild Activity

Source: Network Connection

Author: Kiran kumar s, oscd.community: Data: DestinationIp: 104.102.49.254, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 7460, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49730

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T05:48:03.620047+0200	2054653	1	A Network Trojan was detected	192.168.2.4	49733	172.67.206.204	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T05:48:03.620047+0200	2049836	1	A Network Trojan was detected	192.168.2.4	49733	172.67.206.204	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T05:48:01.193250+0200	2056477	1	Domain Observed Used for C2 Detected	192.168.2.4	63416	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T05:48:01.223837+0200	2056471	1	Domain Observed Used for C2 Detected	192.168.2.4	56218	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T05:48:01.173319+0200	2056481	1	Domain Observed Used for C2 Detected	192.168.2.4	59807	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T05:48:01.161561+0200	2056483	1	Domain Observed Used for C2 Detected	192.168.2.4	49684	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T05:48:01.214625+0200	2056473	1	Domain Observed Used for C2 Detected	192.168.2.4	64808	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T05:48:01.151734+0200	2056485	1	Domain Observed Used for C2 Detected	192.168.2.4	54145	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T05:48:01.203289+0200	2056475	1	Domain Observed Used for C2 Detected	192.168.2.4	51455	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T05:48:01.183306+0200	2056479	1	Domain Observed Used for C2 Detected	192.168.2.4	62362	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (trustterwowqm .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T05:48:01.140438+0200	2056174	1	Domain Observed Used for C2 Detected	192.168.2.4	50697	1.1.1.1	53	UDP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: lHHfXU6Y37.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://steamcommunity.com/profiles/76561199724331900	URL Reputation: Label: malware
Source: https://steamcommunity.com/profiles/76561199724331900/inventory/	URL Reputation: Label: malware
Source: https://steamcommunity.com/profiles/76561199724331900/badges	URL Reputation: Label: malware

Found malware configuration

Source: 0.2.lHHfXU6Y37.exe.3b0000.0.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["dissapoiznw.stor", "studennotediw.stor", "clearancek.site", "spirittunek.stor", "eaglepawnoy.stor", "bathdoomgaz.stor", "trustterwowqm.shop", "licendfilteo.site", "mobbipenju.stor"], "Build id": "tLYMe5--deli333"}

Multi AV Scanner detection for domain / URL

Source: sergei-esenin.com	Virustotal: Detection: 11%	Perma Link
Source: eaglepawnoy.store	Virustotal: Detection: 17%	Perma Link
Source: trustterwowqm.shop	Virustotal: Detection: 13%	Perma Link
Source: studennotediw.store	Virustotal: Detection: 17%	Perma Link
Source: licendfilteo.site	Virustotal: Detection: 15%	Perma Link
Source: spirittunek.store	Virustotal: Detection: 13%	Perma Link
Source: bathdoomgaz.store	Virustotal: Detection: 13%	Perma Link
Source: mobbipenju.store	Virustotal: Detection: 13%	Perma Link
Source: dissapoiznw.store	Virustotal: Detection: 13%	Perma Link
Source: clearancek.site	Virustotal: Detection: 17%	Perma Link
Source: licendfilteo.site	Virustotal: Detection: 15%	Perma Link
Source: trustterwowqm.shop	Virustotal: Detection: 13%	Perma Link
Source: https://sergei-esenin.com:443/api	Virustotal: Detection: 13%	Perma Link

Multi AV Scanner detection for submitted file

Source: lHHfXU6Y37.exe

Virustotal: Detection: 41%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: lHHfXU6Y37.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp	String decryptor: clearancek.site
Source: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp	String decryptor: licendfilteo.site
Source: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp	String decryptor: spirittunek.stor
Source: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp	String decryptor: bathdoomgaz.stor
Source: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp	String decryptor: studennotediw.stor
Source: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp	String decryptor: dissapoiznw.stor
Source: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp	String decryptor: eaglepawnoy.stor
Source: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp	String decryptor: mobbipenju.stor
Source: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp	String decryptor: trustterwowqm.shop
Source: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp	String decryptor: tLYMe5--deli333

Source: lHHfXU6Y37.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.4:49837 version: TLS 1.2

Source: lHHfXU6Y37.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\lHHfXU6Y37.exe

Code function: 0_2_003C9ABF FindFirstFileExW,

0_2_003C9ABF

Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then jmp ecx	0_2_0042604C
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00426140
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	0_2_0040C198
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then mov word ptr [esi], ax	0_2_00408278
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_003EA268
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	0_2_0040C224
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	0_2_0040E2E8
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	0_2_004222A8
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then jmp eax	0_2_00426343
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	0_2_0040E388
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then mov edx, dword ptr [esp]	0_2_003DE3F7
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	0_2_003EE3F3
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then cmp word ptr [eax+esi+02h], 0000h	0_2_0040C3AC
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then cmp byte ptr [esi], 00000000h	0_2_00406410
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], C85F7986h	0_2_0040A438
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C85F7986h	0_2_0040A438
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then mov word ptr [ebx], ax	0_2_0040C568
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then push 00000000h	0_2_003E05B8
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then mov eax, edi	0_2_004066E6
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then mov eax, dword ptr [esi+0Ch]	0_2_0041074E
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then cmp byte ptr [edi], 00000000h	0_2_003F2702
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 7789B0CBh	0_2_004247F8
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then cmp byte ptr [esi+01h], 00000000h	0_2_003EC81B
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then movzx edx, byte ptr [ecx+eax]	0_2_003EC938
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	0_2_003F8948
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	0_2_004249F8
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then mov byte ptr [ecx], al	0_2_00410AD4
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_00410AD4
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_00410AD4
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	0_2_003E2B08
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	0_2_00418B78
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_003FCB98
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_00426B98
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	0_2_00426B98
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then lea eax, dword ptr [edi+04h]	0_2_0040ABBB
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	0_2_0041EC08
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00420C08
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	0_2_00426D28
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	0_2_00426D28
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then push ebx	0_2_003F2D4B
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then cmp word ptr [ecx+edx+02h], 0000h	0_2_00426EA8
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 9ECF05EBh	0_2_00426EA8
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_003FAF2D
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then mov word ptr [ebx], ax	0_2_003FEF70
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00426FD8
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 62429966h	0_2_00421048
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_0040B175
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	0_2_00405108
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	0_2_00425288
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then mov word ptr [eax], cx	0_2_00405368
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then mov byte ptr [ecx], al	0_2_00411327
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_00411327
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then mov byte ptr [ebx], al	0_2_00411327
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then jmp ecx	0_2_003F338E
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then mov eax, dword ptr [esi+0Ch]	0_2_0041143A
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then mov byte ptr [ecx], al	0_2_0041143A
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then inc edi	0_2_003F34A4
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_004274F8
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	0_2_00423642
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then jmp eax	0_2_003F165F
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	0_2_004236EE
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then push esi	0_2_0040D75B
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	0_2_00421798
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then mov byte ptr [edi], al	0_2_004118D8
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	0_2_004238E2
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then mov eax, dword ptr [esi+40h]	0_2_003F1920
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then mov eax, dword ptr [esp]	0_2_00423A08
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	0_2_003E1A58
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then mov eax, dword ptr [esp+000000C0h]	0_2_003EFA44
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+esi]	0_2_003E9AE8
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then mov word ptr [eax], dx	0_2_003FFAE2
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then mov eax, dword ptr [ebp-18h]	0_2_003EBB58
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then mov byte ptr [esi+edx], bl	0_2_003E9BF8
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	0_2_003EBCB9
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then mov eax, dword ptr [esp+000001C0h]	0_2_003EFCD4
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then cmp byte ptr [eax+01h], 00000000h	0_2_00405EC3
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then mov dword ptr [esp+2Ch], ebp	0_2_00425EE8
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+esi]	0_2_00423F68
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 4x nop then mov eax, dword ptr [esi+0Ch]	0_2_00411FF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	2_2_0040D390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	2_2_0044676A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	2_2_00446A0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+esi]	2_2_00447082
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 62429966h	2_2_00444170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	2_2_0044A100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+0Ch]	2_2_00435121
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	2_2_004491F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	2_2_004491F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	2_2_00428230
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	2_2_0042F2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	2_2_004453D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [esi], ax	2_2_0042B3A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	2_2_004483B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	2_2_0042F46A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	2_2_00431410
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp word ptr [eax+esi+02h], 0000h	2_2_0042F4D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_00428490
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	2_2_004314B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], C85F7986h	2_2_0042D560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C85F7986h	2_2_0042D560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+0Ch]	2_2_0043456A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [ecx], al	2_2_0043456A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	2_2_0041151B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov edx, dword ptr [esp]	2_2_0040151F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then inc edi	2_2_004165CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	2_2_0044A620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	2_2_0041463D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+40h]	2_2_0041463D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then push 00000000h	2_2_004036E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [ebx], ax	2_2_0042F690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esi+0Ch]	2_2_0043387B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	2_2_00446816
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp byte ptr [edi], 00000000h	2_2_0041582B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	2_2_004448C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then push esi	2_2_00430883
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp byte ptr [esi+01h], 00000000h	2_2_0040F943
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 7789B0CBh	2_2_00447920
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], cx	2_2_0042D9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [ecx+eax]	2_2_0040FA60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	2_2_0041BA70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [edi], al	2_2_00434A00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then lea eax, dword ptr [edi+04h]	2_2_0042DB64
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+000000C0h]	2_2_00412B6C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [ebx], ax	2_2_00421B20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	2_2_00447B20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	2_2_00446B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [ecx], al	2_2_00433BD3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [ebx], al	2_2_00433BD3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [ebx], al	2_2_00433BD3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], dx	2_2_00422BEF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	2_2_00404B80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+esi]	2_2_0040CC10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	2_2_00405C30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [ebx], al	2_2_0041FCC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	2_2_00449CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	2_2_00449CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-18h]	2_2_0040EC80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [ebx], al	2_2_00434C90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [ebx], al	2_2_00434C90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	2_2_0043BCA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [esi+edx], bl	2_2_0040CD20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	2_2_00443D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	2_2_00441D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	2_2_0040EDE1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp ecx	2_2_00448DE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	2_2_00448DE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	2_2_00448DE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+000001C0h]	2_2_00412DFC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], dx	2_2_0041DD90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	2_2_00449E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	2_2_00449E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov dword ptr [esp+2Ch], ebp	2_2_00448ED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp ecx	2_2_00448ED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr [esp]	2_2_00448ED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp eax	2_2_00448ED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp word ptr [ecx+edx+02h], 0000h	2_2_00449FD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 9ECF05EBh	2_2_00449FD0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.4:49684 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.4:62362 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.4:54145 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.4:63416 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.4:51455 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.4:64808 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.4:56218 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056174 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (trustterwowqm .shop) : 192.168.2.4:50697 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.4:59807 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49733 -> 172.67.206.204:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49733 -> 172.67.206.204:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: dissapoiznw.stor
Source: Malware configuration extractor	URLs: studennotediw.stor
Source: Malware configuration extractor	URLs: clearancek.site
Source: Malware configuration extractor	URLs: spirittunek.stor
Source: Malware configuration extractor	URLs: eaglepawnoy.stor
Source: Malware configuration extractor	URLs: bathdoomgaz.stor
Source: Malware configuration extractor	URLs: trustterwowqm.shop
Source: Malware configuration extractor	URLs: licendfilteo.site
Source: Malware configuration extractor	URLs: mobbipenju.stor

Source: Joe Sandbox View	IP Address: 104.102.49.254 104.102.49.254
Source: Joe Sandbox View	IP Address: 172.67.206.204 172.67.206.204

Source: Joe Sandbox View	ASN Name: AKAMAI-ASUS AKAMAI-ASUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: sergei-esenin.com

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: global traffic	DNS traffic detected: DNS query: trustterwowqm.shop
Source: global traffic	DNS traffic detected: DNS query: mobbipenju.store
Source: global traffic	DNS traffic detected: DNS query: eaglepawnoy.store
Source: global traffic	DNS traffic detected: DNS query: dissapoiznw.store
Source: global traffic	DNS traffic detected: DNS query: studennotediw.store
Source: global traffic	DNS traffic detected: DNS query: bathdoomgaz.store
Source: global traffic	DNS traffic detected: DNS query: spirittunek.store
Source: global traffic	DNS traffic detected: DNS query: licendfilteo.site
Source: global traffic	DNS traffic detected: DNS query: clearancek.site
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: sergei-esenin.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: sergei-esenin.com

Source: MSBuild.exe, 00000002.00000002.1727922900.0000000000C9C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1727746029.0000000000BFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: MSBuild.exe, 00000002.00000002.1727922900.0000000000C9C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1727746029.0000000000BFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: MSBuild.exe, 00000002.00000002.1727922900.0000000000C9C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1727746029.0000000000BFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: Amcache.hve.5.dr	String found in binary or memory: http://upx.sf.net
Source: MSBuild.exe, 00000002.00000002.1727746029.0000000000BFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: MSBuild.exe, 00000002.00000002.1727746029.0000000000BFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=Ev2sBLgkgyWJ&a
Source: MSBuild.exe, 00000002.00000002.1727746029.0000000000BFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: MSBuild.exe, 00000002.00000002.1727746029.0000000000BFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: MSBuild.exe, 00000002.00000002.1727746029.0000000000BFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: MSBuild.exe, 00000002.00000002.1727746029.0000000000BFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=10oP_O2R
Source: MSBuild.exe, 00000002.00000002.1727746029.0000000000BFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=cdfm
Source: MSBuild.exe, 00000002.00000002.1727746029.0000000000C40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/
Source: MSBuild.exe, 00000002.00000002.1727746029.0000000000C40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/api
Source: MSBuild.exe, 00000002.00000002.1727746029.0000000000C23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com:443/api
Source: MSBuild.exe, 00000002.00000002.1727746029.0000000000C23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: MSBuild.exe, 00000002.00000002.1727922900.0000000000C9C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1727746029.0000000000BFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: MSBuild.exe, 00000002.00000002.1727746029.0000000000C23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: MSBuild.exe, 00000002.00000002.1727746029.0000000000BFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: MSBuild.exe, 00000002.00000002.1727746029.0000000000BFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: MSBuild.exe, 00000002.00000002.1727922900.0000000000C9C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1727746029.0000000000BFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.206.204:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.4:49837 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_004396A0 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

2_2_004396A0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_004396A0 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

2_2_004396A0

Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 0_2_003B2021	0_2_003B2021
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 0_2_0040A059	0_2_0040A059
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 0_2_00416078	0_2_00416078
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 0_2_003DE175	0_2_003DE175
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 0_2_003DE212	0_2_003DE212
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 0_2_003E4278	0_2_003E4278
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 0_2_003E2268	0_2_003E2268
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 0_2_003DE2D5	0_2_003DE2D5
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 0_2_00416378	0_2_00416378
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 0_2_003E2302	0_2_003E2302
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 0_2_003E8428	0_2_003E8428
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 0_2_0040A438	0_2_0040A438
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 0_2_003E05B8	0_2_003E05B8
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 0_2_003EE768	0_2_003EE768
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 0_2_00414858	0_2_00414858
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 0_2_003BCAF2	0_2_003BCAF2
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 0_2_00414A88	0_2_00414A88
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 0_2_003FCB98	0_2_003FCB98
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 0_2_003E6C29	0_2_003E6C29
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 0_2_003E4C78	0_2_003E4C78
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 0_2_00424DA8	0_2_00424DA8
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 0_2_003E8F38	0_2_003E8F38
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 0_2_003EF058	0_2_003EF058
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 0_2_003B729C	0_2_003B729C
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 0_2_00425288	0_2_00425288
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 0_2_003EB2D8	0_2_003EB2D8
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 0_2_003E7338	0_2_003E7338
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 0_2_003CD39B	0_2_003CD39B
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 0_2_0041D598	0_2_0041D598
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 0_2_003C572C	0_2_003C572C
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 0_2_00421798	0_2_00421798
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 0_2_00401908	0_2_00401908
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 0_2_0040BADA	0_2_0040BADA
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 0_2_003CBB36	0_2_003CBB36
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 0_2_003C3C92	0_2_003C3C92
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 0_2_0041BCB8	0_2_0041BCB8
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 0_2_003B1D79	0_2_003B1D79
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 0_2_003BFEF0	0_2_003BFEF0
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 0_2_003DDED8	0_2_003DDED8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040FFE0	2_2_0040FFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040C060	2_2_0040C060
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00401000	2_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00447082	2_2_00447082
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00409110	2_2_00409110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004491F0	2_2_004491F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00412180	2_2_00412180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042D181	2_2_0042D181
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004391A0	2_2_004391A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040129D	2_2_0040129D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00405340	2_2_00405340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042D181	2_2_0042D181
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004073A0	2_2_004073A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004483B0	2_2_004483B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040A460	2_2_0040A460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040E400	2_2_0040E400
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004394A0	2_2_004394A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0040B550	2_2_0040B550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042D560	2_2_0042D560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004305E0	2_2_004305E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004406C0	2_2_004406C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004036E0	2_2_004036E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042B69D	2_2_0042B69D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004448C0	2_2_004448C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004298E2	2_2_004298E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00411890	2_2_00411890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042E977	2_2_0042E977
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00409903	2_2_00409903
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_004489D7	2_2_004489D7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00437980	2_2_00437980
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042D9A0	2_2_0042D9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042FA20	2_2_0042FA20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00424A30	2_2_00424A30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042CAF0	2_2_0042CAF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00406B60	2_2_00406B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042DB64	2_2_0042DB64
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00448B00	2_2_00448B00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00409B1C	2_2_00409B1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00437BB0	2_2_00437BB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0042EC02	2_2_0042EC02
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0041FCC0	2_2_0041FCC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0043EDE0	2_2_0043EDE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00448DE0	2_2_00448DE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00407DA0	2_2_00407DA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00432E33	2_2_00432E33
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00448ED0	2_2_00448ED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00447ED0	2_2_00447ED0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 0040CB10 appears 45 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 0041D970 appears 155 times
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: String function: 003B7B80 appears 49 times
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: String function: 003E99E8 appears 96 times
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: String function: 003FA848 appears 155 times

Source: C:\Users\user\Desktop\lHHfXU6Y37.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7436 -s 280

Source: lHHfXU6Y37.exe, 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameproquota.exej% vs lHHfXU6Y37.exe
Source: lHHfXU6Y37.exe	Binary or memory string: OriginalFilenameproquota.exej% vs lHHfXU6Y37.exe

Source: lHHfXU6Y37.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: lHHfXU6Y37.exe

Static PE information: Section: .data ZLIB complexity 0.991109725140056

Source: classification engine

Classification label: mal100.troj.evad.winEXE@6/5@11/2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_00428230 CoCreateInstance,

2_2_00428230

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7436

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\0eade630-aca8-437c-b982-942d476eca26

Jump to behavior

Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Command line argument: MZx	0_2_003B2021
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Command line argument: MZx	0_2_003B2021
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Command line argument: MZx	0_2_003B2021

Source: lHHfXU6Y37.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\lHHfXU6Y37.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: lHHfXU6Y37.exe

Virustotal: Detection: 41%

Source: unknown	Process created: C:\Users\user\Desktop\lHHfXU6Y37.exe "C:\Users\user\Desktop\lHHfXU6Y37.exe"
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7436 -s 280
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior

Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll	Jump to behavior

Source: lHHfXU6Y37.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: lHHfXU6Y37.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: lHHfXU6Y37.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: lHHfXU6Y37.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: lHHfXU6Y37.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: lHHfXU6Y37.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: lHHfXU6Y37.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: lHHfXU6Y37.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: lHHfXU6Y37.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: lHHfXU6Y37.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: lHHfXU6Y37.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: lHHfXU6Y37.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: lHHfXU6Y37.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 0_2_003F2722 push eax; retf	0_2_003F2727
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 0_2_003B71AD push ecx; ret	0_2_003B71C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0041584A push eax; retf	2_2_0041584F

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\lHHfXU6Y37.exe

API coverage: 4.2 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7500

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\lHHfXU6Y37.exe

Code function: 0_2_003C9ABF FindFirstFileExW,

0_2_003C9ABF

Source: Amcache.hve.5.dr	Binary or memory string: VMware
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.5.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.5.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.5.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: MSBuild.exe, 00000002.00000002.1727746029.0000000000C40000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.5.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.5.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.5.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.5.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.5.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.5.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.5.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.5.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.5.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: MSBuild.exe, 00000002.00000002.1727746029.0000000000BFC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWx;
Source: Amcache.hve.5.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_004464F0 LdrInitializeThunk,

2_2_004464F0

Source: C:\Users\user\Desktop\lHHfXU6Y37.exe

Code function: 0_2_003B7922 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_003B7922

Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 0_2_003B2003 mov edi, dword ptr fs:[00000030h]	0_2_003B2003
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 0_2_003CA64C mov eax, dword ptr fs:[00000030h]	0_2_003CA64C
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 0_2_003C0F2E mov ecx, dword ptr fs:[00000030h]	0_2_003C0F2E

Source: C:\Users\user\Desktop\lHHfXU6Y37.exe

Code function: 0_2_003CCC4B GetProcessHeap,

0_2_003CCC4B

Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 0_2_003B7610 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_003B7610
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 0_2_003B7922 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_003B7922
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 0_2_003BDA73 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_003BDA73
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: 0_2_003B7AAF SetUnhandledExceptionFilter,	0_2_003B7AAF

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\lHHfXU6Y37.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\lHHfXU6Y37.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: lHHfXU6Y37.exe	String found in binary or memory: spirittunek.stor
Source: lHHfXU6Y37.exe	String found in binary or memory: bathdoomgaz.stor
Source: lHHfXU6Y37.exe	String found in binary or memory: studennotediw.stor
Source: lHHfXU6Y37.exe	String found in binary or memory: dissapoiznw.stor
Source: lHHfXU6Y37.exe	String found in binary or memory: eaglepawnoy.stor
Source: lHHfXU6Y37.exe	String found in binary or memory: mobbipenju.stor
Source: lHHfXU6Y37.exe	String found in binary or memory: trustterwowqm.shop
Source: lHHfXU6Y37.exe	String found in binary or memory: clearancek.site
Source: lHHfXU6Y37.exe	String found in binary or memory: licendfilteo.site

Writes to foreign memory regions

Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 44C000	Jump to behavior
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 44F000	Jump to behavior
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 45F000	Jump to behavior
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 7E0008	Jump to behavior

Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"			Jump to behavior
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"			Jump to behavior

Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_003CC085
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: GetLocaleInfoW,	0_2_003C622B
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: EnumSystemLocalesW,	0_2_003CC327
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: EnumSystemLocalesW,	0_2_003CC372
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: EnumSystemLocalesW,	0_2_003CC40D
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_003CC498
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: GetLocaleInfoW,	0_2_003CC6EB
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_003CC814
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: GetLocaleInfoW,	0_2_003CC91A
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_003CC9E9
Source: C:\Users\user\Desktop\lHHfXU6Y37.exe	Code function: EnumSystemLocalesW,	0_2_003C5D7F

Source: C:\Users\user\Desktop\lHHfXU6Y37.exe

Code function: 0_2_003B7815 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_003B7815

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.5.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	311 Process Injection	2 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	311 Process Injection	LSASS Memory	41 Security Software Discovery	Remote Desktop Protocol	2 Clipboard Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	2 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	13 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
lHHfXU6Y37.exe	42%	Virustotal		Browse
lHHfXU6Y37.exe	100%	Avira	HEUR/AGEN.1310458
lHHfXU6Y37.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
bg.microsoft.map.fastly.net	0%	Virustotal	Browse
steamcommunity.com	0%	Virustotal	Browse
sergei-esenin.com	11%	Virustotal	Browse
eaglepawnoy.store	18%	Virustotal	Browse
trustterwowqm.shop	14%	Virustotal	Browse
studennotediw.store	18%	Virustotal	Browse
s-part-0032.t-0009.t-msedge.net	0%	Virustotal	Browse
licendfilteo.site	16%	Virustotal	Browse
spirittunek.store	14%	Virustotal	Browse
fp2e7a.wpc.phicdn.net	0%	Virustotal	Browse
bathdoomgaz.store	14%	Virustotal	Browse
mobbipenju.store	14%	Virustotal	Browse
dissapoiznw.store	14%	Virustotal	Browse
clearancek.site	18%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://steamcommunity.com/profiles/76561199724331900	100%	URL Reputation	malware
http://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
http://upx.sf.net	0%	URL Reputation	safe
http://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900/inventory/	100%	URL Reputation	malware
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	0%	URL Reputation	safe
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	0%	URL Reputation	safe
http://store.steampowered.com/account/cookiepreferences/	0%	URL Reputation	safe
https://store.steampowered.com/legal/	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199724331900/badges	100%	URL Reputation	malware
licendfilteo.site	16%	Virustotal		Browse
https://sergei-esenin.com/	0%	Virustotal		Browse
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	0%	Virustotal		Browse
https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=Ev2sBLgkgyWJ&a	0%	Virustotal		Browse
https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=cdfm	0%	Virustotal		Browse
https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=10oP_O2R	0%	Virustotal		Browse
trustterwowqm.shop	14%	Virustotal		Browse
https://sergei-esenin.com:443/api	14%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	0%, Virustotal, Browse	unknown
steamcommunity.com	104.102.49.254	true	true	0%, Virustotal, Browse	unknown
sergei-esenin.com	172.67.206.204	true	true	11%, Virustotal, Browse	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	0%, Virustotal, Browse	unknown
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true	false	0%, Virustotal, Browse	unknown
trustterwowqm.shop	unknown	unknown	true	14%, Virustotal, Browse	unknown
eaglepawnoy.store	unknown	unknown	false	18%, Virustotal, Browse	unknown
bathdoomgaz.store	unknown	unknown	false	14%, Virustotal, Browse	unknown
spirittunek.store	unknown	unknown	false	14%, Virustotal, Browse	unknown
licendfilteo.site	unknown	unknown	true	16%, Virustotal, Browse	unknown
studennotediw.store	unknown	unknown	false	18%, Virustotal, Browse	unknown
mobbipenju.store	unknown	unknown	false	14%, Virustotal, Browse	unknown
clearancek.site	unknown	unknown	true	18%, Virustotal, Browse	unknown
dissapoiznw.store	unknown	unknown	false	14%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://steamcommunity.com/profiles/76561199724331900	true	URL Reputation: malware	unknown
licendfilteo.site	true	16%, Virustotal, Browse	unknown
studennotediw.stor	true		unknown
spirittunek.stor	true		unknown
bathdoomgaz.stor	true		unknown
trustterwowqm.shop	true	14%, Virustotal, Browse	unknown
dissapoiznw.stor	true		unknown
eaglepawnoy.stor	true		unknown
https://sergei-esenin.com/api	true		unknown
clearancek.site	true		unknown
mobbipenju.stor	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=cdfm	MSBuild.exe, 00000002.00000002.1727746029.0000000000BFC000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://store.steampowered.com/privacy_agreement/	MSBuild.exe, 00000002.00000002.1727922900.0000000000C9C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1727746029.0000000000BFC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sergei-esenin.com/	MSBuild.exe, 00000002.00000002.1727746029.0000000000C40000.00000004.00000020.00020000.00000000.sdmp	true	0%, Virustotal, Browse	unknown
http://upx.sf.net	Amcache.hve.5.dr	false	URL Reputation: safe	unknown
http://store.steampowered.com/subscriber_agreement/	MSBuild.exe, 00000002.00000002.1727922900.0000000000C9C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1727746029.0000000000BFC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	MSBuild.exe, 00000002.00000002.1727922900.0000000000C9C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1727746029.0000000000BFC000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	MSBuild.exe, 00000002.00000002.1727746029.0000000000BFC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	MSBuild.exe, 00000002.00000002.1727746029.0000000000BFC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199724331900/inventory/	MSBuild.exe, 00000002.00000002.1727746029.0000000000BFC000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=Ev2sBLgkgyWJ&a	MSBuild.exe, 00000002.00000002.1727746029.0000000000BFC000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	MSBuild.exe, 00000002.00000002.1727746029.0000000000BFC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sergei-esenin.com:443/api	MSBuild.exe, 00000002.00000002.1727746029.0000000000C23000.00000004.00000020.00020000.00000000.sdmp	true	14%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=10oP_O2R	MSBuild.exe, 00000002.00000002.1727746029.0000000000BFC000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	MSBuild.exe, 00000002.00000002.1727746029.0000000000BFC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://store.steampowered.com/account/cookiepreferences/	MSBuild.exe, 00000002.00000002.1727922900.0000000000C9C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1727746029.0000000000BFC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/	MSBuild.exe, 00000002.00000002.1727746029.0000000000C23000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://store.steampowered.com/legal/	MSBuild.exe, 00000002.00000002.1727922900.0000000000C9C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1727746029.0000000000BFC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/profiles/76561199724331900/badges	MSBuild.exe, 00000002.00000002.1727746029.0000000000BFC000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.102.49.254	steamcommunity.com	United States		16625	AKAMAI-ASUS	true
172.67.206.204	sergei-esenin.com	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528629
Start date and time:	2024-10-08 05:47:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	lHHfXU6Y37.exe renamed because original name is a hash value
Original Sample Name:	7544bc22211629c705bf9d778cc00479.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@6/5@11/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 70% Number of executed functions: 12 Number of non-executed functions: 155
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.190.160.17, 40.126.32.72, 40.126.32.133, 40.126.32.140, 40.126.32.76, 40.126.32.134, 20.190.160.20, 40.126.32.136, 199.232.214.172, 192.229.221.95, 20.12.23.50, 52.168.117.173, 20.3.187.198, 20.189.173.20, 13.85.23.206
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, prdv4a.aadg.msidentity.com, ctldl.windowsupdate.com.delivery.microsoft.com, slscr.update.microsoft.com, otelrules.azureedge.net, www.tm.v4.a.prd.aadg.akadns.net, otelrules.afd.azureedge.net, onedsblobprdwus15.westus.cloudapp.azure.com, ctldl.windowsupdate.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, ocsp.digicert.com, login.live.com, ocsp.edge.digicert.com, blobcollector.events.data.trafficmanager.net, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, azureedge-t-prod.trafficmanager.net, umwatson.events.data.microsoft.com, wu-b-net.trafficmanager.net, www.tm.lg.prod.aadmsa.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
23:48:00	API Interceptor	2x Sleep call for process: MSBuild.exe modified
23:48:16	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.102.49.254	http://gtm-cn-j4g3qqvf603.steamproxy1.com/	Get hash	malicious	Unknown	Browse	www.valvesoftware.com/legal.htm
172.67.206.204	j8zJ5Jwja4.exe	Get hash	malicious	LummaC	Browse
	SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Get hash	malicious	LummaC	Browse
	9Y6R8fs0wd.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	PFW1cgN8EK.exe	Get hash	malicious	LummaC	Browse
	Bn7LPdQA1s.exe	Get hash	malicious	LummaC, Vidar	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
sergei-esenin.com	VmRHSCaiyc.exe	Get hash	malicious	LummaC, Vidar	Browse	104.21.53.8
	j8zJ5Jwja4.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	SecuriteInfo.com.Trojan.DownLoader47.43340.9153.30810.exe	Get hash	malicious	LummaC	Browse	104.21.53.8
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	SecuriteInfo.com.Win32.Evo-gen.11282.4102.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	9Y6R8fs0wd.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
steamcommunity.com	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	7AeSqNv1rC.exe	Get hash	malicious	MicroClip, Vidar	Browse	104.102.49.254
	VmRHSCaiyc.exe	Get hash	malicious	LummaC, Vidar	Browse	23.197.127.21
	j8zJ5Jwja4.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	T2bmenoX1o.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	SecuriteInfo.com.Trojan.DownLoader47.43340.9153.30810.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
bg.microsoft.map.fastly.net	SteamCleanz Marlborough Limited.xlsx	Get hash	malicious	Unknown	Browse	199.232.210.172
	SKGOzZRZGX.exe	Get hash	malicious	Stealc	Browse	199.232.214.172
	MmcJhaiYNh.exe	Get hash	malicious	Stealc	Browse	199.232.214.172
	ctMI3TYXpX.exe	Get hash	malicious	SmokeLoader	Browse	199.232.214.172
	https://starylasfe.com.de/6SZZr/	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172
	T2bmenoX1o.exe	Get hash	malicious	LummaC, Vidar	Browse	199.232.210.172
	SecuriteInfo.com.Trojan.DownLoader47.43340.9153.30810.exe	Get hash	malicious	LummaC	Browse	199.232.210.172
	http://pay.christinagstewart.com/	Get hash	malicious	Unknown	Browse	199.232.214.172
	http://hans.uniformeslaamistad.com/prog/66ce237125ba7_vjrew2ge.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	http://hans.uniformeslaamistad.com/prog/66f5db9e54794_vfkagks.exe	Get hash	malicious	Unknown	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Products Order Catalogs20242.exe	Get hash	malicious	FormBook	Browse	104.21.48.76
	SteamCleanz Marlborough Limited.xlsx	Get hash	malicious	Unknown	Browse	188.114.97.3
	SteamCleanz Marlborough Limited.xlsx	Get hash	malicious	Unknown	Browse	188.114.96.3
	VmRHSCaiyc.exe	Get hash	malicious	LummaC, Vidar	Browse	104.21.53.8
	j8zJ5Jwja4.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	M13W1o3scc.exe	Get hash	malicious	Stealc	Browse	172.67.179.207
	rfc[1].html	Get hash	malicious	Unknown	Browse	104.18.86.42
	rPedidoactualizado.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Get hash	malicious	RDPWrap Tool	Browse	172.67.140.92
	SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Get hash	malicious	RDPWrap Tool	Browse	172.67.140.92
AKAMAI-ASUS	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	7AeSqNv1rC.exe	Get hash	malicious	MicroClip, Vidar	Browse	104.102.49.254
	j8zJ5Jwja4.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	T2bmenoX1o.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254
	copyright_infringement_evidence_1.exe	Get hash	malicious	Unknown	Browse	23.47.168.24
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	Copyright_Infringement_Evidence.exe	Get hash	malicious	Unknown	Browse	96.17.64.189

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	SteamCleanz Marlborough Limited.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.60
	SKGOzZRZGX.exe	Get hash	malicious	Stealc	Browse	13.107.246.60
	VmRHSCaiyc.exe	Get hash	malicious	LummaC, Vidar	Browse	13.107.246.60
	MmcJhaiYNh.exe	Get hash	malicious	Stealc	Browse	13.107.246.60
	https://starylasfe.com.de/6SZZr/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	T2bmenoX1o.exe	Get hash	malicious	LummaC, Vidar	Browse	13.107.246.60
	SecuriteInfo.com.Trojan.DownLoader47.43340.9153.30810.exe	Get hash	malicious	LummaC	Browse	13.107.246.60
	https://Vv.ndlevesio.com/vrbU/	Get hash	malicious	Unknown	Browse	13.107.246.60
	http://hans.uniformeslaamistad.com/yuop/66e6ea133c92f_crypted.exe#xin	Get hash	malicious	PureLog Stealer, RedLine, zgRAT	Browse	13.107.246.60
	http://pay.christinagstewart.com/	Get hash	malicious	Unknown	Browse	13.107.246.60
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	SteamCleanz Marlborough Limited.xlsx	Get hash	malicious	Unknown	Browse	104.102.49.254 172.67.206.204
	VmRHSCaiyc.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254 172.67.206.204
	j8zJ5Jwja4.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	ctMI3TYXpX.exe	Get hash	malicious	SmokeLoader	Browse	104.102.49.254 172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204
	T2bmenoX1o.exe	Get hash	malicious	LummaC, Vidar	Browse	104.102.49.254 172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 172.67.206.204

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_lHHfXU6Y37.exe_4289d0cc4794ef2997c7d675cb426ccda579c0_7ceae026_cbacde44-b5eb-4fb9-a198-c9ae2168e41a\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6548251168705344
Encrypted:	false
SSDEEP:	96:jiFUd+WW0y8VdsRy/DAif8QXIDcQvc6QcEVcw3cE//+HbHg/5hZAX/d5FMT2SlPg:2HWWAVd90BU/YjhzuiFxZ24IO8e
MD5:	DE0E58659F35C2E99DD21CCB04A3C99D
SHA1:	EE6AF13C69CAA9634BFA5094F8899104D2BDE943
SHA-256:	6CE76D4896D6BF5B24E8D468B4DF34362F41854FDAA46275B7CE15838A3A9FD6
SHA-512:	7F805595C35C6405E2C40AEF059831EC8E6686AF75C99DAECDC39432BF0612E6BCC820C08456BFB15F30C07FDFE708CE85144CC434B0EF742009555938815F90
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.8.3.2.8.8.0.3.6.3.5.5.1.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.8.3.2.8.8.0.6.4.4.7.9.4.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.b.a.c.d.e.4.4.-.b.5.e.b.-.4.f.b.9.-.a.1.9.8.-.c.9.a.e.2.1.6.8.e.4.1.a.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.5.a.5.a.c.3.b.-.7.2.5.d.-.4.9.9.0.-.8.d.5.1.-.0.1.d.d.8.0.0.5.5.c.9.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.l.H.H.f.X.U.6.Y.3.7...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.p.r.o.q.u.o.t.a...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.0.c.-.0.0.0.1.-.0.0.1.4.-.a.6.d.5.-.6.7.d.e.3.4.1.9.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.7.d.0.3.f.6.a.1.a.a.4.5.0.5.0.f.7.b.e.5.5.f.8.7.6.f.e.a.2.d.c.0.0.0.0.0.9.0.4.!.0.0.0.0.4.7.2.5.9.a.5.4.2.1.3.0.7.8.a.5.9.a.e.6.7.c.9.a.e.e.4.9.e.5.0.c.8.7.3.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER26D0.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Oct 8 03:48:00 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	34530
Entropy (8bit):	1.6981704612795356
Encrypted:	false
SSDEEP:	96:5j8MVpm6zJWsExynci77VnpT/83DEgmgZJgY2giS+jWIkWIszITWKuikkm5F:GyPcOLkECO7S+UWKuNkm5
MD5:	63DBACF57CF338C1829E00A2EC8CDFC8
SHA1:	048BBB54E1E865BC0F3689EB73F0CE90F213D01E
SHA-256:	1646A8F0CB452C88B282735534C4F31844512F40D69AD7B4A2C4D2D34D0D1263
SHA-512:	05E283ABA089B6BC8B68F4CBA128873C9A1828A2AC3B8B956DDB86DA592FACE2C1945D3F55D067554FFDE0C2673E324FD7B3C03D13439B393EB7890FBB3E23FC
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .......p..g........................d...........................T.......8...........T................{......................................................................................................eJ..............GenuineIntel............T...........o..g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER271F.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8328
Entropy (8bit):	3.7020088755060225
Encrypted:	false
SSDEEP:	192:R6l7wVeJ7r6whK6Y9VSUnqgmfT0oTprr89b4Msf7om:R6lXJH6b6YfSUnqgmfT0oC4ffB
MD5:	10674E1BB7E4D062C19B2F0782627B8F
SHA1:	1D776C20BDDDFE6A28771E6DC2C7040D953BED84
SHA-256:	2705CD80BC8B3E36ADD95A017D614DE55FA5C95EF75CEF1195E5A653210A9007
SHA-512:	D99FAA01DDCAC7ACC3A27B35AEE88AD911EC92E120A4D82280DA73600E3DD21083D1D54BFC0B8BA8782B3851781E04A2684305DBE8BEC3B80B3B89154871535B
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.4.3.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER274F.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4678
Entropy (8bit):	4.492276346391235
Encrypted:	false
SSDEEP:	48:cvIwWl8zszNJg77aI9ReWpW8VYxYm8M4JX1FR+q8mnaIsjYd:uIjfznI7Pf7V1Jx7aIsjYd
MD5:	25597019720923131C797F283E80B192
SHA1:	9EF72C5A6B2C7F04EDE8A041CC9271C60E3D9956
SHA-256:	573DDABB038E3CC65B51725A46DB4F4F0AB79034432EDA8EE32223EED7E8F120
SHA-512:	54002350597998769C141577069E93ADC860F15844492045C7214444B92B1462CF10AE106716B4FF0F545027EED433B8901277E0F7C5A7C7B06C6667FE75E9CF
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="533930" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.466076690130814
Encrypted:	false
SSDEEP:	6144:aIXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uN6dwBCswSbH:vXD94+WlLZMM6YFHM+H
MD5:	4B5914EE5B768A411F86C191B9E182F3
SHA1:	05503EA53269B3AED23E67E28483E39DF378A8AE
SHA-256:	4FD367B8EE83A2D45F326B69EEE0353AE0BB2712216D16B64129BF1D07CEE1E8
SHA-512:	FEB64D217BCE9ED95312D17EEE26DD52BEFDADCA8CBC38167FE0663762FC898EA3CC387D5EAD28FA22BE145EC9316F1712A5D89562427D4EE22374821A9C965D
Malicious:	false
Reputation:	low
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.K..4..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.722046916764263
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	lHHfXU6Y37.exe
File size:	550'912 bytes
MD5:	7544bc22211629c705bf9d778cc00479
SHA1:	47259a54213078a59ae67c9aee49e50c87312029
SHA256:	4a69b0742f47207178fb84b6470429b536a3b6250c37a248cff1b68444d26e63
SHA512:	b9a4c2d96bb691d5a978c2dfbb16c4724e5607ab0bc3fbd8a5d87f2185291d01c48711fd3c83ba2c4b28540d7514cb36b499721012d2c24babb8e59592f7a2a7
SSDEEP:	6144:O578AljUJEXLq7xhZLxj7EtVCUpysNR3VigbJL4eY9TDOJIFqB6fpvee+2s4S:O5YAljUKb0F7EtZyKlNbJl0TDnpS4S
TLSH:	D2C4F10275C1C036D57215324AF4DB709E3EBCB04E659EDF2B980FAE4F34291DA25A6B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=.9.y.WUy.WUy.WU..TTu.WU..RT..WU..STl.WU..VTz.WUy.VU!.WUilTTm.WUilSTk.WUilRT4.WU1m^Tx.WU1m.Ux.WU1mUTx.WURichy.WU...............

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x406f52
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6704A5A3 [Tue Oct 8 03:23:15 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	d10af643340e1121562abe3e6bd5b0e1

Entrypoint Preview

Instruction
call 00007FDFA4F2F200h
jmp 00007FDFA4F2E76Fh
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
cmp edx, esi
je 00007FDFA4F2E90Bh
mov ecx, dword ptr [ebp+0Ch]
cmp ecx, dword ptr [edx+0Ch]
jc 00007FDFA4F2E8FCh
mov eax, dword ptr [edx+08h]
add eax, dword ptr [edx+0Ch]
cmp ecx, eax
jc 00007FDFA4F2E8FEh
add edx, 28h
cmp edx, esi
jne 00007FDFA4F2E8DCh
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 00007FDFA4F2E8EBh
push esi
call 00007FDFA4F2F514h
test eax, eax
je 00007FDFA4F2E912h
mov eax, dword ptr fs:[00000018h]
mov esi, 00486544h
mov edx, dword ptr [eax+04h]
jmp 00007FDFA4F2E8F6h
cmp edx, eax
je 00007FDFA4F2E902h
xor eax, eax
mov ecx, edx
lock cmpxchg dword ptr [esi], ecx
test eax, eax
jne 00007FDFA4F2E8E2h
xor al, al
pop esi
ret
mov al, 01h
pop esi
ret
push ebp
mov ebp, esp
cmp dword ptr [ebp+08h], 00000000h
jne 00007FDFA4F2E8F9h
mov byte ptr [00486548h], 00000001h
call 00007FDFA4F2EBAAh
call 00007FDFA4F31AC7h
test al, al
jne 00007FDFA4F2E8F6h
xor al, al
pop ebp
ret
call 00007FDFA4F3A529h
test al, al
jne 00007FDFA4F2E8FCh
push 00000000h
call 00007FDFA4F31ACEh
pop ecx
jmp 00007FDFA4F2E8DBh
mov al, 01h
pop ebp
ret
push ebp
mov ebp, esp
cmp byte ptr [00486549h], 00000000h
je 00007FDFA4F2E8F6h
mov al, 01h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2c6c0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x88000	0x3d8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x89000	0x1ad4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2abc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2ab00	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x23000	0x12c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x210f0	0x21200	4dd671f7dd64bd8866d230598a6a1c1e	False	0.5865492334905661	data	6.667282075354081	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x23000	0x9d78	0x9e00	c6e6b7becce6a757bf82158d7ccb35c6	False	0.43515130537974683	data	4.957590127656248	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2d000	0x5a170	0x59400	57ec9c8c699ccc1c3c1c4d48f9bd43e7	False	0.991109725140056	DOS executable (block device driver \377\377\377\377,32-bit sector-support)	7.992535351087067	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x88000	0x3d8	0x400	c67ba8481d4e7c92e5fe9f152983a3f3	False	0.439453125	data	3.287044161603086	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x89000	0x1ad4	0x1c00	501eb50a8156a7d3b65d5e46fd215b9e	False	0.7271205357142857	data	6.389924447379968	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x88058	0x380	data	English	United States	0.46205357142857145

Imports

DLL

Import

KERNEL32.dll

AttachConsole, MultiByteToWideChar, GetStringTypeW, WideCharToMultiByte, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, LCMapStringEx, GetCPInfo, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, CreateFileW, RaiseException, RtlUnwind, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, HeapAlloc, HeapFree, GetFileType, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileSizeEx, SetFilePointerEx, CloseHandle, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, GetProcessHeap, ReadConsoleW, HeapSize, WriteConsoleW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-08T05:48:01.140438+0200	2056174	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (trustterwowqm .shop)	1	192.168.2.4	50697	1.1.1.1	53	UDP
2024-10-08T05:48:01.151734+0200	2056485	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)	1	192.168.2.4	54145	1.1.1.1	53	UDP
2024-10-08T05:48:01.161561+0200	2056483	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)	1	192.168.2.4	49684	1.1.1.1	53	UDP
2024-10-08T05:48:01.173319+0200	2056481	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)	1	192.168.2.4	59807	1.1.1.1	53	UDP
2024-10-08T05:48:01.183306+0200	2056479	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)	1	192.168.2.4	62362	1.1.1.1	53	UDP
2024-10-08T05:48:01.193250+0200	2056477	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)	1	192.168.2.4	63416	1.1.1.1	53	UDP
2024-10-08T05:48:01.203289+0200	2056475	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)	1	192.168.2.4	51455	1.1.1.1	53	UDP
2024-10-08T05:48:01.214625+0200	2056473	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)	1	192.168.2.4	64808	1.1.1.1	53	UDP
2024-10-08T05:48:01.223837+0200	2056471	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)	1	192.168.2.4	56218	1.1.1.1	53	UDP
2024-10-08T05:48:03.620047+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49733	172.67.206.204	443	TCP
2024-10-08T05:48:03.620047+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49733	172.67.206.204	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 05:48:01.248667002 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 8, 2024 05:48:01.248754978 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 8, 2024 05:48:01.248847961 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 8, 2024 05:48:01.251837015 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 8, 2024 05:48:01.251872063 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 8, 2024 05:48:01.922013998 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 8, 2024 05:48:01.922127008 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 8, 2024 05:48:01.924868107 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 8, 2024 05:48:01.924899101 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 8, 2024 05:48:01.925178051 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 8, 2024 05:48:01.963074923 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 8, 2024 05:48:02.003417969 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 8, 2024 05:48:02.425182104 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 8, 2024 05:48:02.425245047 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 8, 2024 05:48:02.425272942 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 8, 2024 05:48:02.425287962 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 8, 2024 05:48:02.425314903 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 8, 2024 05:48:02.425316095 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 8, 2024 05:48:02.425350904 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 8, 2024 05:48:02.425375938 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 8, 2024 05:48:02.533521891 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 8, 2024 05:48:02.533588886 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 8, 2024 05:48:02.533623934 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 8, 2024 05:48:02.533673048 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 8, 2024 05:48:02.533713102 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 8, 2024 05:48:02.533740997 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 8, 2024 05:48:02.539572954 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 8, 2024 05:48:02.539647102 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 8, 2024 05:48:02.539679050 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 8, 2024 05:48:02.539733887 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 8, 2024 05:48:02.539767981 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 8, 2024 05:48:02.539823055 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 8, 2024 05:48:02.539880037 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 8, 2024 05:48:02.540572882 CEST	49730	443	192.168.2.4	104.102.49.254
Oct 8, 2024 05:48:02.540606022 CEST	443	49730	104.102.49.254	192.168.2.4
Oct 8, 2024 05:48:02.718014002 CEST	49733	443	192.168.2.4	172.67.206.204
Oct 8, 2024 05:48:02.718096018 CEST	443	49733	172.67.206.204	192.168.2.4
Oct 8, 2024 05:48:02.718198061 CEST	49733	443	192.168.2.4	172.67.206.204
Oct 8, 2024 05:48:02.718563080 CEST	49733	443	192.168.2.4	172.67.206.204
Oct 8, 2024 05:48:02.718595982 CEST	443	49733	172.67.206.204	192.168.2.4
Oct 8, 2024 05:48:03.188836098 CEST	443	49733	172.67.206.204	192.168.2.4
Oct 8, 2024 05:48:03.188985109 CEST	49733	443	192.168.2.4	172.67.206.204
Oct 8, 2024 05:48:03.191102028 CEST	49733	443	192.168.2.4	172.67.206.204
Oct 8, 2024 05:48:03.191129923 CEST	443	49733	172.67.206.204	192.168.2.4
Oct 8, 2024 05:48:03.191420078 CEST	443	49733	172.67.206.204	192.168.2.4
Oct 8, 2024 05:48:03.197145939 CEST	49733	443	192.168.2.4	172.67.206.204
Oct 8, 2024 05:48:03.197185993 CEST	49733	443	192.168.2.4	172.67.206.204
Oct 8, 2024 05:48:03.197252035 CEST	443	49733	172.67.206.204	192.168.2.4
Oct 8, 2024 05:48:03.521076918 CEST	49675	443	192.168.2.4	173.222.162.32
Oct 8, 2024 05:48:03.620100021 CEST	443	49733	172.67.206.204	192.168.2.4
Oct 8, 2024 05:48:03.620362997 CEST	443	49733	172.67.206.204	192.168.2.4
Oct 8, 2024 05:48:03.620414972 CEST	49733	443	192.168.2.4	172.67.206.204
Oct 8, 2024 05:48:03.620507956 CEST	49733	443	192.168.2.4	172.67.206.204
Oct 8, 2024 05:48:03.620532990 CEST	443	49733	172.67.206.204	192.168.2.4
Oct 8, 2024 05:48:03.620542049 CEST	49733	443	192.168.2.4	172.67.206.204
Oct 8, 2024 05:48:03.620547056 CEST	443	49733	172.67.206.204	192.168.2.4
Oct 8, 2024 05:48:55.627657890 CEST	49745	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:55.627675056 CEST	443	49745	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:55.627741098 CEST	49745	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:55.627995014 CEST	49745	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:55.628001928 CEST	443	49745	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:56.189769983 CEST	443	49745	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:56.189860106 CEST	49745	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:56.192476988 CEST	49745	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:56.192485094 CEST	443	49745	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:56.192714930 CEST	443	49745	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:56.208844900 CEST	49745	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:56.255394936 CEST	443	49745	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:56.306090117 CEST	443	49745	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:56.306106091 CEST	443	49745	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:56.306159019 CEST	443	49745	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:56.306174040 CEST	49745	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:56.306185961 CEST	443	49745	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:56.306216002 CEST	49745	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:56.306230068 CEST	49745	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:56.391289949 CEST	443	49745	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:56.391303062 CEST	443	49745	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:56.391354084 CEST	49745	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:56.391359091 CEST	443	49745	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:56.391490936 CEST	49745	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:56.393124104 CEST	443	49745	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:56.393135071 CEST	443	49745	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:56.393181086 CEST	49745	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:56.393186092 CEST	443	49745	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:56.393210888 CEST	49745	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:56.393223047 CEST	49745	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:56.477231979 CEST	443	49745	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:56.477246046 CEST	443	49745	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:56.477319002 CEST	49745	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:56.477323055 CEST	443	49745	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:56.477543116 CEST	49745	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:56.478250027 CEST	443	49745	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:56.478260994 CEST	443	49745	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:56.478354931 CEST	49745	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:56.478358984 CEST	443	49745	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:56.478425026 CEST	49745	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:56.479218006 CEST	443	49745	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:56.479229927 CEST	443	49745	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:56.479275942 CEST	49745	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:56.479279041 CEST	443	49745	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:56.479348898 CEST	49745	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:56.480449915 CEST	443	49745	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:56.480460882 CEST	443	49745	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:56.480501890 CEST	49745	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:56.480504036 CEST	443	49745	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:56.480534077 CEST	49745	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:56.480547905 CEST	49745	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:56.563956022 CEST	443	49745	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:56.563967943 CEST	443	49745	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:56.564151049 CEST	49745	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:56.564153910 CEST	443	49745	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:56.564192057 CEST	49745	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:56.564459085 CEST	443	49745	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:56.564470053 CEST	443	49745	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:56.564528942 CEST	49745	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:56.564532042 CEST	443	49745	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:56.564599037 CEST	49745	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:56.565007925 CEST	443	49745	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:56.565018892 CEST	443	49745	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:56.565073967 CEST	49745	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:56.565077066 CEST	443	49745	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:56.565160990 CEST	49745	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:56.565990925 CEST	443	49745	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:56.566003084 CEST	443	49745	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:56.566061020 CEST	49745	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:56.566066980 CEST	443	49745	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:56.566163063 CEST	49745	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:56.566361904 CEST	443	49745	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:56.566379070 CEST	443	49745	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:56.566414118 CEST	49745	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:56.566416979 CEST	443	49745	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:56.566442013 CEST	49745	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:56.566452026 CEST	49745	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:56.567003012 CEST	443	49745	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:56.567014933 CEST	443	49745	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:56.567069054 CEST	49745	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:56.567071915 CEST	443	49745	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:56.567101955 CEST	443	49745	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:56.567140102 CEST	443	49745	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:56.567150116 CEST	49745	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:56.567176104 CEST	49745	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:56.567279100 CEST	49745	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:56.567286968 CEST	443	49745	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:56.567296028 CEST	49745	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:56.567300081 CEST	443	49745	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:56.618351936 CEST	49746	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:56.618380070 CEST	443	49746	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:56.618463039 CEST	49746	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:56.618541002 CEST	49747	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:56.618578911 CEST	443	49747	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:56.618639946 CEST	49747	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:56.618904114 CEST	49746	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:56.618912935 CEST	443	49746	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:56.619405985 CEST	49748	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:56.619436979 CEST	443	49748	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:56.619534016 CEST	49747	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:56.619553089 CEST	443	49747	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:56.619559050 CEST	49748	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:56.619693041 CEST	49749	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:56.619718075 CEST	49748	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:56.619731903 CEST	443	49748	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:56.619752884 CEST	443	49749	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:56.619817972 CEST	49749	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:56.619913101 CEST	49749	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:56.619927883 CEST	443	49749	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:56.620415926 CEST	49750	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:56.620436907 CEST	443	49750	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:56.620505095 CEST	49750	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:56.620575905 CEST	49750	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:56.620587111 CEST	443	49750	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:57.268986940 CEST	443	49749	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:57.269612074 CEST	49749	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:57.269689083 CEST	443	49749	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:57.270072937 CEST	49749	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:57.270086050 CEST	443	49749	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:57.275932074 CEST	443	49747	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:57.276293039 CEST	49747	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:57.276360989 CEST	443	49747	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:57.276618004 CEST	49747	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:57.276632071 CEST	443	49747	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:57.294612885 CEST	443	49748	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:57.294992924 CEST	49748	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:57.295012951 CEST	443	49748	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:57.295337915 CEST	49748	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:57.295342922 CEST	443	49748	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:57.300601006 CEST	443	49750	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:57.301103115 CEST	49750	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:57.301160097 CEST	443	49750	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:57.301628113 CEST	49750	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:57.301640987 CEST	443	49750	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:57.375313044 CEST	443	49747	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:57.375487089 CEST	443	49747	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:57.375592947 CEST	49747	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:57.375679016 CEST	49747	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:57.375679016 CEST	49747	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:57.375724077 CEST	443	49747	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:57.375754118 CEST	443	49747	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:57.378789902 CEST	49751	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:57.378824949 CEST	443	49751	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:57.378896952 CEST	49751	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:57.379081964 CEST	49751	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:57.379097939 CEST	443	49751	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:57.379229069 CEST	443	49749	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:57.379255056 CEST	443	49749	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:57.379314899 CEST	49749	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:57.379374981 CEST	443	49749	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:57.379445076 CEST	49749	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:57.379487991 CEST	443	49749	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:57.379508972 CEST	49749	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:57.379508972 CEST	49749	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:57.379528046 CEST	443	49749	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:57.379555941 CEST	443	49749	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:57.381855965 CEST	49752	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:57.381886959 CEST	443	49752	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:57.381961107 CEST	49752	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:57.382118940 CEST	49752	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:57.382131100 CEST	443	49752	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:57.393095970 CEST	443	49748	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:57.393148899 CEST	443	49748	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:57.393270969 CEST	443	49746	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:57.393276930 CEST	443	49748	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:57.393281937 CEST	49748	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:57.393332958 CEST	49748	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:57.393476963 CEST	49748	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:57.393482924 CEST	443	49748	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:57.393492937 CEST	49748	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:57.393496990 CEST	443	49748	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:57.393704891 CEST	49746	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:57.393722057 CEST	443	49746	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:57.394279957 CEST	49746	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:57.394284010 CEST	443	49746	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:57.395827055 CEST	49753	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:57.395916939 CEST	443	49753	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:57.396003962 CEST	49753	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:57.396142960 CEST	49753	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:57.396163940 CEST	443	49753	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:57.400871992 CEST	443	49750	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:57.401010990 CEST	443	49750	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:57.401078939 CEST	49750	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:57.401124001 CEST	49750	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:57.401124001 CEST	49750	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:57.401153088 CEST	443	49750	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:57.401175976 CEST	443	49750	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:57.402930975 CEST	49754	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:57.402952909 CEST	443	49754	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:57.403027058 CEST	49754	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:57.403177023 CEST	49754	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:57.403203964 CEST	443	49754	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:57.496988058 CEST	443	49746	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:57.497001886 CEST	443	49746	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:57.497030020 CEST	443	49746	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:57.497170925 CEST	49746	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:57.497328997 CEST	49746	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:57.497333050 CEST	443	49746	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:57.497342110 CEST	49746	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:57.497344971 CEST	443	49746	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:57.499639988 CEST	49755	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:57.499663115 CEST	443	49755	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:57.499741077 CEST	49755	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:57.499860048 CEST	49755	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:57.499866009 CEST	443	49755	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:57.968708038 CEST	443	49753	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:57.969758034 CEST	49753	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:57.969825029 CEST	443	49753	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:57.970513105 CEST	49753	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:57.970536947 CEST	443	49753	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.054574013 CEST	443	49751	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.055058956 CEST	49751	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.055073023 CEST	443	49751	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.055533886 CEST	49751	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.055537939 CEST	443	49751	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.056550980 CEST	443	49754	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.056966066 CEST	49754	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.057029963 CEST	443	49754	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.057385921 CEST	49754	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.057404041 CEST	443	49754	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.066858053 CEST	443	49753	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.066998005 CEST	443	49753	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.067075014 CEST	49753	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.067378044 CEST	49753	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.067414045 CEST	443	49753	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.067471027 CEST	49753	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.067487001 CEST	443	49753	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.068196058 CEST	443	49752	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.068598986 CEST	49752	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.068614006 CEST	443	49752	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.068978071 CEST	49752	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.068983078 CEST	443	49752	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.071047068 CEST	49756	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.071132898 CEST	443	49756	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.071223021 CEST	49756	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.071330070 CEST	49756	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.071350098 CEST	443	49756	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.165215969 CEST	443	49751	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.165366888 CEST	443	49751	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.165391922 CEST	443	49754	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.165419102 CEST	49751	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.165510893 CEST	443	49754	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.165581942 CEST	49754	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.165587902 CEST	49751	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.165606976 CEST	443	49751	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.165618896 CEST	49751	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.165625095 CEST	443	49751	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.166644096 CEST	49754	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.166644096 CEST	49754	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.166712999 CEST	443	49754	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.166749954 CEST	443	49754	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.168787956 CEST	49757	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.168838024 CEST	443	49757	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.168903112 CEST	49757	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.169759035 CEST	49758	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.169770002 CEST	443	49758	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.169826984 CEST	49758	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.169913054 CEST	49757	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.169933081 CEST	443	49757	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.170011997 CEST	49758	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.170027971 CEST	443	49758	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.171638012 CEST	443	49752	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.171763897 CEST	443	49752	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.171854973 CEST	49752	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.171986103 CEST	49752	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.172003984 CEST	443	49752	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.172017097 CEST	49752	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.172023058 CEST	443	49752	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.174812078 CEST	49759	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.174880981 CEST	443	49759	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.174952030 CEST	49759	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.175081015 CEST	49759	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.175117016 CEST	443	49759	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.190026999 CEST	443	49755	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.190545082 CEST	49755	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.190558910 CEST	443	49755	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.191265106 CEST	49755	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.191270113 CEST	443	49755	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.295758009 CEST	443	49755	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.295789003 CEST	443	49755	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.295830965 CEST	49755	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.296118021 CEST	49755	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.296132088 CEST	443	49755	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.296147108 CEST	49755	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.296153069 CEST	443	49755	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.299273968 CEST	49760	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.299335003 CEST	443	49760	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.299422979 CEST	49760	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.299557924 CEST	49760	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.299575090 CEST	443	49760	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.743232965 CEST	443	49756	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.744211912 CEST	49756	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.744256020 CEST	443	49756	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.744890928 CEST	49756	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.744904041 CEST	443	49756	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.812804937 CEST	443	49757	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.813286066 CEST	49757	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.813350916 CEST	443	49757	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.813903093 CEST	49757	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.813924074 CEST	443	49757	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.822294950 CEST	443	49759	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.822879076 CEST	49759	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.822926998 CEST	443	49759	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.823656082 CEST	49759	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.823668957 CEST	443	49759	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.839950085 CEST	443	49758	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.840339899 CEST	49758	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.840375900 CEST	443	49758	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.840934992 CEST	49758	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.840946913 CEST	443	49758	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.846088886 CEST	443	49756	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.846221924 CEST	443	49756	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.846286058 CEST	49756	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.846384048 CEST	49756	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.846415997 CEST	443	49756	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.846443892 CEST	49756	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.846457958 CEST	443	49756	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.849802971 CEST	49761	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.849880934 CEST	443	49761	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.849967957 CEST	49761	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.850109100 CEST	49761	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.850121975 CEST	443	49761	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.912728071 CEST	443	49757	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.912867069 CEST	443	49757	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.913083076 CEST	49757	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.913393974 CEST	49757	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.913393974 CEST	49757	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.913444042 CEST	443	49757	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.913489103 CEST	443	49757	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.916445971 CEST	49762	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.916501999 CEST	443	49762	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.916578054 CEST	49762	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.916718960 CEST	49762	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.916738033 CEST	443	49762	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.921365976 CEST	443	49759	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.921509027 CEST	443	49759	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.921653986 CEST	49759	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.921737909 CEST	49759	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.921737909 CEST	49759	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.921771049 CEST	443	49759	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.921793938 CEST	443	49759	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.924624920 CEST	49763	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.924668074 CEST	443	49763	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.924758911 CEST	49763	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.924892902 CEST	49763	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.924921036 CEST	443	49763	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.941549063 CEST	443	49760	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.941982031 CEST	49760	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.942013025 CEST	443	49760	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.942704916 CEST	49760	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.942715883 CEST	443	49760	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.943595886 CEST	443	49758	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.943737030 CEST	443	49758	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.943818092 CEST	49758	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.943861961 CEST	49758	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.943883896 CEST	443	49758	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.943907976 CEST	49758	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.943919897 CEST	443	49758	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.946480989 CEST	49764	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.946508884 CEST	443	49764	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:58.946580887 CEST	49764	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.946763992 CEST	49764	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:58.946778059 CEST	443	49764	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:59.045051098 CEST	443	49760	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:59.045084953 CEST	443	49760	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:59.045248985 CEST	49760	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:59.045295000 CEST	49760	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:59.045295000 CEST	49760	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:59.045319080 CEST	443	49760	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:59.045341015 CEST	443	49760	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:59.047525883 CEST	49765	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:59.047611952 CEST	443	49765	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:59.047694921 CEST	49765	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:59.047853947 CEST	49765	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:59.047890902 CEST	443	49765	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:59.491806030 CEST	443	49761	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:59.492500067 CEST	49761	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:59.492588043 CEST	443	49761	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:59.492834091 CEST	49761	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:59.492850065 CEST	443	49761	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:59.582211018 CEST	443	49763	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:59.582948923 CEST	49763	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:59.583008051 CEST	443	49763	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:59.583098888 CEST	49763	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:59.583115101 CEST	443	49763	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:59.593611002 CEST	443	49762	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:59.594001055 CEST	49762	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:59.594059944 CEST	443	49762	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:59.594227076 CEST	49762	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:59.594240904 CEST	443	49762	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:59.594918013 CEST	443	49761	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:59.595062017 CEST	443	49761	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:59.595128059 CEST	49761	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:59.595186949 CEST	49761	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:59.595186949 CEST	49761	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:59.595220089 CEST	443	49761	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:59.595242023 CEST	443	49761	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:59.598015070 CEST	49766	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:59.598104954 CEST	443	49766	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:59.598196030 CEST	49766	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:59.598330021 CEST	49766	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:59.598350048 CEST	443	49766	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:59.617301941 CEST	443	49764	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:59.617779016 CEST	49764	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:59.617796898 CEST	443	49764	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:59.618335962 CEST	49764	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:59.618341923 CEST	443	49764	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:59.681674957 CEST	443	49763	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:59.681819916 CEST	443	49763	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:59.681914091 CEST	49763	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:59.682179928 CEST	49763	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:59.682179928 CEST	49763	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:59.682197094 CEST	443	49763	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:59.682209015 CEST	443	49763	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:59.685316086 CEST	49767	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:59.685350895 CEST	443	49767	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:59.685444117 CEST	49767	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:59.685597897 CEST	49767	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:59.685607910 CEST	443	49767	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:59.696233988 CEST	443	49762	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:59.696371078 CEST	443	49762	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:59.696446896 CEST	49762	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:59.696532011 CEST	49762	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:59.696532011 CEST	49762	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:59.696576118 CEST	443	49762	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:59.696604013 CEST	443	49762	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:59.699367046 CEST	49768	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:59.699404001 CEST	443	49768	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:59.699578047 CEST	49768	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:59.699578047 CEST	49768	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:59.699606895 CEST	443	49768	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:59.715352058 CEST	443	49765	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:59.715740919 CEST	49765	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:59.715785980 CEST	443	49765	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:59.716160059 CEST	49765	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:59.716169119 CEST	443	49765	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:59.721910000 CEST	443	49764	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:59.722049952 CEST	443	49764	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:59.722110987 CEST	49764	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:59.722131014 CEST	49764	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:59.722143888 CEST	443	49764	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:59.722156048 CEST	49764	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:59.722162008 CEST	443	49764	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:59.723925114 CEST	49769	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:59.724008083 CEST	443	49769	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:59.724090099 CEST	49769	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:59.724235058 CEST	49769	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:59.724275112 CEST	443	49769	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:59.822560072 CEST	443	49765	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:59.822599888 CEST	443	49765	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:59.822804928 CEST	49765	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:59.822805882 CEST	49765	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:59.822805882 CEST	49765	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:59.824807882 CEST	49770	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:59.824831009 CEST	443	49770	13.107.246.60	192.168.2.4
Oct 8, 2024 05:48:59.824920893 CEST	49770	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:59.825048923 CEST	49770	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:48:59.825072050 CEST	443	49770	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:00.130501032 CEST	49765	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:00.130523920 CEST	443	49765	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:00.270462990 CEST	443	49766	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:00.271006107 CEST	49766	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:00.271023989 CEST	443	49766	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:00.271477938 CEST	49766	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:00.271485090 CEST	443	49766	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:00.350068092 CEST	443	49768	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:00.350528002 CEST	443	49767	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:00.350939989 CEST	49767	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:00.350956917 CEST	443	49767	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:00.351103067 CEST	49768	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:00.351128101 CEST	443	49768	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:00.351366997 CEST	49768	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:00.351372957 CEST	443	49768	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:00.351375103 CEST	49767	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:00.351380110 CEST	443	49767	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:00.373784065 CEST	443	49766	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:00.373931885 CEST	443	49766	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:00.374002934 CEST	49766	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:00.374073982 CEST	49766	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:00.374105930 CEST	443	49766	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:00.374119043 CEST	49766	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:00.374131918 CEST	443	49766	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:00.377516985 CEST	49771	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:00.377553940 CEST	443	49771	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:00.377756119 CEST	49771	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:00.377756119 CEST	49771	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:00.377787113 CEST	443	49771	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:00.383517981 CEST	443	49769	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:00.383845091 CEST	49769	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:00.383867979 CEST	443	49769	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:00.384238958 CEST	49769	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:00.384249926 CEST	443	49769	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:00.448575020 CEST	443	49768	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:00.448714018 CEST	443	49768	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:00.448838949 CEST	49768	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:00.448873997 CEST	49768	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:00.448873997 CEST	49768	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:00.448887110 CEST	443	49768	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:00.448895931 CEST	443	49768	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:00.450567007 CEST	443	49767	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:00.450720072 CEST	443	49767	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:00.450787067 CEST	49767	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:00.450825930 CEST	49767	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:00.450845957 CEST	443	49767	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:00.450860023 CEST	49767	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:00.450866938 CEST	443	49767	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:00.451546907 CEST	49772	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:00.451618910 CEST	443	49772	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:00.451700926 CEST	49772	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:00.451839924 CEST	49772	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:00.451870918 CEST	443	49772	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:00.452812910 CEST	49773	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:00.452842951 CEST	443	49773	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:00.452914000 CEST	49773	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:00.453039885 CEST	49773	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:00.453048944 CEST	443	49773	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:00.481934071 CEST	443	49769	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:00.482072115 CEST	443	49769	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:00.482295036 CEST	49769	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:00.482295036 CEST	49769	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:00.482295036 CEST	49769	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:00.483999968 CEST	49774	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:00.484004974 CEST	443	49774	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:00.484070063 CEST	49774	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:00.484179020 CEST	49774	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:00.484189034 CEST	443	49774	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:00.493556023 CEST	443	49770	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:00.494031906 CEST	49770	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:00.494066954 CEST	443	49770	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:00.494456053 CEST	49770	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:00.494467974 CEST	443	49770	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:00.597914934 CEST	443	49770	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:00.597950935 CEST	443	49770	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:00.598005056 CEST	49770	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:00.598154068 CEST	49770	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:00.598154068 CEST	49770	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:00.598177910 CEST	443	49770	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:00.598201036 CEST	443	49770	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:00.601599932 CEST	49775	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:00.601654053 CEST	443	49775	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:00.601727962 CEST	49775	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:00.604439020 CEST	49775	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:00.604470968 CEST	443	49775	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:00.786744118 CEST	49769	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:00.786758900 CEST	443	49769	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:01.077389002 CEST	443	49771	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:01.077956915 CEST	49771	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:01.077991962 CEST	443	49771	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:01.078454018 CEST	49771	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:01.078464985 CEST	443	49771	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:01.186036110 CEST	443	49771	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:01.186116934 CEST	443	49771	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:01.186534882 CEST	49771	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:01.186534882 CEST	49771	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:01.186561108 CEST	49771	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:01.186577082 CEST	443	49771	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:01.187727928 CEST	443	49773	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:01.188291073 CEST	49773	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:01.188297033 CEST	443	49773	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:01.188905954 CEST	49773	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:01.188909054 CEST	443	49773	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:01.189111948 CEST	443	49774	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:01.189505100 CEST	49774	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:01.189512014 CEST	443	49774	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:01.190138102 CEST	49774	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:01.190143108 CEST	443	49774	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:01.191530943 CEST	49776	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:01.191626072 CEST	443	49776	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:01.191720009 CEST	49776	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:01.191873074 CEST	49776	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:01.191891909 CEST	443	49776	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:01.192159891 CEST	443	49772	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:01.192550898 CEST	49772	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:01.192614079 CEST	443	49772	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:01.193104029 CEST	49772	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:01.193118095 CEST	443	49772	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:01.277802944 CEST	443	49775	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:01.278275967 CEST	49775	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:01.278333902 CEST	443	49775	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:01.279448032 CEST	49775	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:01.279460907 CEST	443	49775	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:01.289874077 CEST	443	49774	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:01.290015936 CEST	443	49774	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:01.290072918 CEST	49774	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:01.290484905 CEST	49774	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:01.290493011 CEST	443	49774	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:01.290524960 CEST	49774	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:01.290529966 CEST	443	49774	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:01.292011976 CEST	443	49773	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:01.292150974 CEST	443	49773	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:01.292202950 CEST	49773	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:01.292607069 CEST	49773	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:01.292610884 CEST	443	49773	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:01.292619944 CEST	49773	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:01.292624950 CEST	443	49773	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:01.296586990 CEST	49777	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:01.296617031 CEST	443	49777	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:01.296681881 CEST	49777	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:01.296905041 CEST	49777	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:01.296914101 CEST	443	49777	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:01.297508001 CEST	443	49772	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:01.297646999 CEST	443	49772	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:01.297714949 CEST	49772	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:01.297780037 CEST	49772	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:01.297780037 CEST	49772	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:01.297816038 CEST	443	49772	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:01.297837973 CEST	443	49772	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:01.298022032 CEST	49778	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:01.298033953 CEST	443	49778	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:01.298099041 CEST	49778	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:01.298227072 CEST	49778	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:01.298238993 CEST	443	49778	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:01.300689936 CEST	49779	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:01.300781965 CEST	443	49779	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:01.300860882 CEST	49779	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:01.301105022 CEST	49779	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:01.301141977 CEST	443	49779	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:01.379426956 CEST	443	49775	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:01.379467964 CEST	443	49775	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:01.379647970 CEST	49775	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:01.379980087 CEST	49775	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:01.380007982 CEST	443	49775	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:01.380032063 CEST	49775	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:01.380047083 CEST	443	49775	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:01.383691072 CEST	49780	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:01.383704901 CEST	443	49780	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:01.383799076 CEST	49780	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:01.383958101 CEST	49780	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:01.383963108 CEST	443	49780	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:01.831923962 CEST	443	49776	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:01.880585909 CEST	49776	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:01.960678101 CEST	443	49778	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:01.975640059 CEST	443	49777	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.005059004 CEST	443	49779	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.005451918 CEST	49778	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:02.021080017 CEST	49777	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:02.051114082 CEST	443	49780	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.052351952 CEST	49779	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:02.099253893 CEST	49780	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:02.148237944 CEST	49780	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:02.148257017 CEST	443	49780	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.149327040 CEST	49780	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:02.149338007 CEST	443	49780	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.149828911 CEST	49779	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:02.149893045 CEST	443	49779	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.155209064 CEST	49779	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:02.155227900 CEST	443	49779	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.155523062 CEST	49776	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:02.155554056 CEST	443	49776	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.156336069 CEST	49776	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:02.156347990 CEST	443	49776	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.157026052 CEST	49778	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:02.157036066 CEST	443	49778	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.157773018 CEST	49778	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:02.157779932 CEST	443	49778	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.158102989 CEST	49777	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:02.158108950 CEST	443	49777	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.159481049 CEST	49777	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:02.159487009 CEST	443	49777	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.244677067 CEST	443	49780	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.244718075 CEST	443	49780	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.244780064 CEST	49780	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:02.245362043 CEST	49780	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:02.245381117 CEST	443	49780	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.245404005 CEST	49780	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:02.245418072 CEST	443	49780	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.252000093 CEST	443	49776	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.252319098 CEST	443	49776	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.252393007 CEST	49776	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:02.252966881 CEST	49781	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:02.253051996 CEST	443	49781	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.253134966 CEST	49781	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:02.253376007 CEST	49776	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:02.253429890 CEST	443	49776	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.253459930 CEST	49776	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:02.253475904 CEST	443	49776	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.254754066 CEST	443	49778	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.254882097 CEST	49781	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:02.254914999 CEST	443	49781	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.255264044 CEST	443	49778	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.255319118 CEST	49778	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:02.256632090 CEST	443	49779	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.256777048 CEST	443	49779	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.256845951 CEST	49779	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:02.257812977 CEST	49778	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:02.257827044 CEST	443	49778	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.259819984 CEST	443	49777	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.259970903 CEST	443	49777	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.260027885 CEST	49777	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:02.260231972 CEST	49777	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:02.260237932 CEST	443	49777	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.260263920 CEST	49777	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:02.260270119 CEST	443	49777	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.263542891 CEST	49779	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:02.263556004 CEST	443	49779	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.263581991 CEST	49779	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:02.263592005 CEST	443	49779	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.270855904 CEST	49782	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:02.270941973 CEST	443	49782	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.271034002 CEST	49782	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:02.271332026 CEST	49782	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:02.271367073 CEST	443	49782	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.273437023 CEST	49783	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:02.273458958 CEST	443	49783	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.273528099 CEST	49783	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:02.273659945 CEST	49783	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:02.273685932 CEST	443	49783	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.275249958 CEST	49784	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:02.275269985 CEST	443	49784	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.275322914 CEST	49784	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:02.276263952 CEST	49784	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:02.276273966 CEST	443	49784	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.278414011 CEST	49785	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:02.278477907 CEST	443	49785	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.278547049 CEST	49785	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:02.278731108 CEST	49785	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:02.278763056 CEST	443	49785	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.835613012 CEST	443	49781	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.836170912 CEST	49781	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:02.836194038 CEST	443	49781	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.836723089 CEST	49781	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:02.836735010 CEST	443	49781	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.917936087 CEST	443	49784	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.918418884 CEST	49784	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:02.918437958 CEST	443	49784	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.918939114 CEST	49784	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:02.918942928 CEST	443	49784	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.924149036 CEST	443	49785	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.924510002 CEST	49785	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:02.924577951 CEST	443	49785	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.924936056 CEST	49785	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:02.924948931 CEST	443	49785	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.926337957 CEST	443	49782	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.926686049 CEST	49782	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:02.926727057 CEST	443	49782	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.927093983 CEST	49782	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:02.927109957 CEST	443	49782	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.939019918 CEST	443	49781	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.939060926 CEST	443	49781	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.939114094 CEST	49781	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:02.939290047 CEST	49781	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:02.939310074 CEST	443	49781	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.939333916 CEST	49781	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:02.939347029 CEST	443	49781	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.942040920 CEST	49786	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:02.942104101 CEST	443	49786	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.942163944 CEST	49786	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:02.942272902 CEST	49786	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:02.942286968 CEST	443	49786	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.954027891 CEST	443	49783	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.954328060 CEST	49783	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:02.954346895 CEST	443	49783	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:02.954727888 CEST	49783	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:02.954741001 CEST	443	49783	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:03.018995047 CEST	443	49784	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:03.019140005 CEST	443	49784	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:03.019212008 CEST	49784	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:03.019371033 CEST	49784	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:03.019392014 CEST	443	49784	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:03.019404888 CEST	49784	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:03.019409895 CEST	443	49784	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:03.022525072 CEST	49787	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:03.022536993 CEST	443	49787	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:03.022614002 CEST	49787	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:03.022742033 CEST	49787	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:03.022747040 CEST	443	49787	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:03.023964882 CEST	443	49785	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:03.024107933 CEST	443	49785	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:03.024182081 CEST	49785	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:03.024255037 CEST	49785	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:03.024255037 CEST	49785	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:03.024291992 CEST	443	49785	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:03.024315119 CEST	443	49785	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:03.026206970 CEST	49788	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:03.026290894 CEST	443	49788	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:03.026369095 CEST	49788	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:03.026510954 CEST	49788	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:03.026546001 CEST	443	49788	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:03.026776075 CEST	443	49782	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:03.026916027 CEST	443	49782	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:03.026993990 CEST	49782	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:03.027075052 CEST	49782	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:03.027075052 CEST	49782	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:03.027117968 CEST	443	49782	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:03.027144909 CEST	443	49782	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:03.028665066 CEST	49789	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:03.028702021 CEST	443	49789	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:03.028775930 CEST	49789	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:03.028873920 CEST	49789	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:03.028887033 CEST	443	49789	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:03.058717012 CEST	443	49783	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:03.058859110 CEST	443	49783	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:03.058917046 CEST	49783	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:03.058973074 CEST	49783	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:03.058974028 CEST	49783	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:03.059005022 CEST	443	49783	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:03.059029102 CEST	443	49783	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:03.060866117 CEST	49790	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:03.060875893 CEST	443	49790	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:03.060940981 CEST	49790	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:03.061045885 CEST	49790	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:03.061050892 CEST	443	49790	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:03.619461060 CEST	443	49786	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:03.620095968 CEST	49786	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:03.620158911 CEST	443	49786	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:03.620567083 CEST	49786	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:03.620580912 CEST	443	49786	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:03.669286966 CEST	443	49787	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:03.669693947 CEST	49787	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:03.669708967 CEST	443	49787	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:03.670051098 CEST	49787	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:03.670053959 CEST	443	49787	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:03.696192980 CEST	443	49788	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:03.696544886 CEST	49788	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:03.696603060 CEST	443	49788	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:03.696861029 CEST	49788	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:03.696876049 CEST	443	49788	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:03.723481894 CEST	443	49786	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:03.723510981 CEST	443	49786	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:03.723577023 CEST	49786	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:03.723773956 CEST	49786	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:03.723818064 CEST	443	49786	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:03.723851919 CEST	49786	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:03.723866940 CEST	443	49786	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:03.727056980 CEST	49791	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:03.727114916 CEST	443	49791	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:03.727205992 CEST	49791	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:03.727353096 CEST	49791	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:03.727365971 CEST	443	49791	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:03.729588032 CEST	443	49790	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:03.729861975 CEST	49790	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:03.729882956 CEST	443	49790	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:03.730190992 CEST	49790	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:03.730197906 CEST	443	49790	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:03.768665075 CEST	443	49787	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:03.768807888 CEST	443	49787	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:03.768884897 CEST	49787	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:03.769032001 CEST	49787	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:03.769041061 CEST	443	49787	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:03.769092083 CEST	49787	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:03.769097090 CEST	443	49787	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:03.771528006 CEST	49792	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:03.771614075 CEST	443	49792	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:03.771708965 CEST	49792	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:03.771823883 CEST	49792	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:03.771846056 CEST	443	49792	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:03.799000978 CEST	443	49788	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:03.799144983 CEST	443	49788	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:03.799220085 CEST	49788	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:03.799280882 CEST	49788	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:03.799305916 CEST	443	49788	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:03.799329996 CEST	49788	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:03.799343109 CEST	443	49788	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:03.801845074 CEST	49793	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:03.801959038 CEST	443	49793	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:03.802037001 CEST	49793	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:03.802166939 CEST	49793	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:03.802205086 CEST	443	49793	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:03.833230972 CEST	443	49790	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:03.833378077 CEST	443	49790	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:03.833472967 CEST	49790	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:03.833868980 CEST	49790	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:03.833893061 CEST	443	49790	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:03.833905935 CEST	49790	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:03.833913088 CEST	443	49790	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:03.837219954 CEST	49794	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:03.837323904 CEST	443	49794	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:03.837424040 CEST	49794	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:03.837594986 CEST	49794	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:03.837630987 CEST	443	49794	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:04.373359919 CEST	443	49791	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:04.374079943 CEST	49791	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:04.374140978 CEST	443	49791	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:04.374481916 CEST	49791	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:04.374495029 CEST	443	49791	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:04.457750082 CEST	443	49793	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:04.458573103 CEST	49793	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:04.458636999 CEST	443	49793	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:04.458864927 CEST	49793	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:04.458882093 CEST	443	49793	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:04.467587948 CEST	443	49792	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:04.467899084 CEST	49792	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:04.467978954 CEST	443	49792	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:04.468364954 CEST	49792	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:04.468420029 CEST	443	49792	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:04.477114916 CEST	443	49791	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:04.477180004 CEST	443	49791	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:04.477255106 CEST	49791	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:04.479453087 CEST	49791	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:04.479500055 CEST	443	49791	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:04.479531050 CEST	49791	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:04.479547977 CEST	443	49791	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:04.483087063 CEST	49795	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:04.483155966 CEST	443	49795	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:04.483392954 CEST	49795	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:04.483392954 CEST	49795	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:04.483522892 CEST	443	49795	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:04.517395973 CEST	443	49794	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:04.518028021 CEST	49794	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:04.518100977 CEST	443	49794	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:04.518557072 CEST	49794	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:04.518574953 CEST	443	49794	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:04.559746027 CEST	443	49793	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:04.559894085 CEST	443	49793	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:04.559967041 CEST	49793	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:04.560059071 CEST	49793	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:04.560102940 CEST	443	49793	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:04.563144922 CEST	49796	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:04.563164949 CEST	443	49796	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:04.563230991 CEST	49796	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:04.563361883 CEST	49796	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:04.563365936 CEST	443	49796	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:04.573049068 CEST	443	49792	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:04.573196888 CEST	443	49792	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:04.573270082 CEST	49792	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:04.573348045 CEST	49792	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:04.573348045 CEST	49792	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:04.573389053 CEST	443	49792	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:04.573421001 CEST	443	49792	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:04.575333118 CEST	49797	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:04.575388908 CEST	443	49797	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:04.575457096 CEST	49797	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:04.575579882 CEST	49797	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:04.575596094 CEST	443	49797	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:04.622402906 CEST	443	49794	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:04.622550964 CEST	443	49794	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:04.622636080 CEST	49794	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:04.622718096 CEST	49794	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:04.622718096 CEST	49794	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:04.622759104 CEST	443	49794	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:04.622796059 CEST	443	49794	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:04.624382973 CEST	49798	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:04.624468088 CEST	443	49798	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:04.624557018 CEST	49798	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:04.624655008 CEST	49798	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:04.624679089 CEST	443	49798	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:04.732193947 CEST	443	49789	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:04.732569933 CEST	49789	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:04.732584000 CEST	443	49789	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:04.732981920 CEST	49789	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:04.732989073 CEST	443	49789	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:04.833364010 CEST	443	49789	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:04.833522081 CEST	443	49789	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:04.833672047 CEST	49789	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:04.841739893 CEST	49789	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:04.841763973 CEST	443	49789	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:04.841775894 CEST	49789	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:04.841783047 CEST	443	49789	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:04.849205971 CEST	49799	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:04.849241018 CEST	443	49799	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:04.849328995 CEST	49799	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:04.850053072 CEST	49799	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:04.850064039 CEST	443	49799	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:05.129909992 CEST	443	49795	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:05.130532026 CEST	49795	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:05.130592108 CEST	443	49795	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:05.131149054 CEST	49795	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:05.131165028 CEST	443	49795	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:05.203804016 CEST	443	49796	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:05.204478979 CEST	49796	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:05.204499006 CEST	443	49796	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:05.204827070 CEST	49796	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:05.204833031 CEST	443	49796	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:05.232656956 CEST	443	49795	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:05.232729912 CEST	443	49795	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:05.232898951 CEST	49795	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:05.232983112 CEST	49795	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:05.232984066 CEST	49795	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:05.233026028 CEST	443	49795	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:05.233055115 CEST	443	49795	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:05.235884905 CEST	49800	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:05.235933065 CEST	443	49800	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:05.236004114 CEST	49800	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:05.236201048 CEST	49800	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:05.236218929 CEST	443	49800	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:05.276307106 CEST	443	49797	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:05.276791096 CEST	49797	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:05.276856899 CEST	443	49797	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:05.277177095 CEST	49797	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:05.277193069 CEST	443	49797	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:05.293414116 CEST	443	49798	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:05.293761969 CEST	49798	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:05.293823957 CEST	443	49798	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:05.294110060 CEST	49798	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:05.294125080 CEST	443	49798	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:05.302728891 CEST	443	49796	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:05.302874088 CEST	443	49796	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:05.302933931 CEST	49796	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:05.302952051 CEST	49796	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:05.302952051 CEST	49796	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:05.302962065 CEST	443	49796	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:05.302969933 CEST	443	49796	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:05.305053949 CEST	49801	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:05.305136919 CEST	443	49801	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:05.305224895 CEST	49801	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:05.305350065 CEST	49801	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:05.305370092 CEST	443	49801	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:05.379141092 CEST	443	49797	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:05.379280090 CEST	443	49797	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:05.379482031 CEST	49797	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:05.379482985 CEST	49797	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:05.379482985 CEST	49797	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:05.381613016 CEST	49802	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:05.381695986 CEST	443	49802	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:05.381782055 CEST	49802	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:05.381903887 CEST	49802	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:05.381923914 CEST	443	49802	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:05.398689985 CEST	443	49798	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:05.398833036 CEST	443	49798	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:05.398890972 CEST	49798	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:05.398967028 CEST	49798	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:05.398967028 CEST	49798	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:05.399009943 CEST	443	49798	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:05.399040937 CEST	443	49798	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:05.400686026 CEST	49803	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:05.400717020 CEST	443	49803	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:05.400789022 CEST	49803	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:05.400901079 CEST	49803	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:05.400918007 CEST	443	49803	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:05.554336071 CEST	443	49799	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:05.554989100 CEST	49799	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:05.555002928 CEST	443	49799	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:05.555449963 CEST	49799	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:05.555453062 CEST	443	49799	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:05.658878088 CEST	443	49799	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:05.659013987 CEST	443	49799	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:05.659071922 CEST	49799	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:05.659194946 CEST	49799	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:05.659214020 CEST	443	49799	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:05.659225941 CEST	49799	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:05.659229994 CEST	443	49799	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:05.662123919 CEST	49804	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:05.662221909 CEST	443	49804	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:05.662301064 CEST	49804	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:05.662445068 CEST	49804	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:05.662463903 CEST	443	49804	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:05.693058968 CEST	49797	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:05.693130016 CEST	443	49797	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:05.897459984 CEST	443	49800	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:05.898101091 CEST	49800	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:05.898123026 CEST	443	49800	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:05.898670912 CEST	49800	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:05.898705006 CEST	443	49800	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:05.927721977 CEST	49724	80	192.168.2.4	93.184.221.240
Oct 8, 2024 05:49:05.927788019 CEST	49723	80	192.168.2.4	93.184.221.240
Oct 8, 2024 05:49:05.933644056 CEST	80	49724	93.184.221.240	192.168.2.4
Oct 8, 2024 05:49:05.933706999 CEST	49724	80	192.168.2.4	93.184.221.240
Oct 8, 2024 05:49:05.933789015 CEST	80	49723	93.184.221.240	192.168.2.4
Oct 8, 2024 05:49:05.933849096 CEST	49723	80	192.168.2.4	93.184.221.240
Oct 8, 2024 05:49:05.971529961 CEST	443	49801	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:05.971946955 CEST	49801	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:05.972027063 CEST	443	49801	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:05.972346067 CEST	49801	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:05.972359896 CEST	443	49801	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:05.997787952 CEST	443	49800	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:05.997853994 CEST	443	49800	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:05.997909069 CEST	49800	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:05.998061895 CEST	49800	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:05.998076916 CEST	443	49800	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:05.998106956 CEST	49800	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:05.998114109 CEST	443	49800	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.000685930 CEST	49805	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:06.000715971 CEST	443	49805	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.000818014 CEST	49805	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:06.000941038 CEST	49805	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:06.000948906 CEST	443	49805	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.047116041 CEST	443	49802	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.047466993 CEST	49802	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:06.047523975 CEST	443	49802	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.047844887 CEST	49802	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:06.047859907 CEST	443	49802	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.053855896 CEST	443	49803	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.054218054 CEST	49803	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:06.054235935 CEST	443	49803	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.054599047 CEST	49803	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:06.054605007 CEST	443	49803	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.072288036 CEST	443	49801	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.072423935 CEST	443	49801	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.072487116 CEST	49801	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:06.072640896 CEST	49801	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:06.072640896 CEST	49801	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:06.072674036 CEST	443	49801	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.072695971 CEST	443	49801	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.075042963 CEST	49806	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:06.075083971 CEST	443	49806	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.075165033 CEST	49806	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:06.075273037 CEST	49806	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:06.075280905 CEST	443	49806	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.152153015 CEST	443	49803	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.152298927 CEST	443	49803	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.152360916 CEST	49803	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:06.152405977 CEST	49803	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:06.152405977 CEST	49803	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:06.152415037 CEST	443	49803	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.152425051 CEST	443	49803	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.153084993 CEST	443	49802	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.153227091 CEST	443	49802	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.153296947 CEST	49802	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:06.153371096 CEST	49802	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:06.153372049 CEST	49802	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:06.153413057 CEST	443	49802	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.153444052 CEST	443	49802	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.154381990 CEST	49807	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:06.154436111 CEST	443	49807	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.154499054 CEST	49807	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:06.154597044 CEST	49807	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:06.154616117 CEST	443	49807	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.154995918 CEST	49808	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:06.155088902 CEST	443	49808	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.155167103 CEST	49808	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:06.155237913 CEST	49808	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:06.155257940 CEST	443	49808	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.317995071 CEST	443	49804	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.327786922 CEST	49804	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:06.327845097 CEST	443	49804	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.328587055 CEST	49804	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:06.328598976 CEST	443	49804	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.426404953 CEST	443	49804	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.426538944 CEST	443	49804	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.426601887 CEST	49804	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:06.426719904 CEST	49804	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:06.426744938 CEST	443	49804	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.426753998 CEST	49804	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:06.426759005 CEST	443	49804	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.429658890 CEST	49809	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:06.429678917 CEST	443	49809	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.429750919 CEST	49809	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:06.429908037 CEST	49809	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:06.429913044 CEST	443	49809	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.675096035 CEST	443	49805	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.675677061 CEST	49805	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:06.675697088 CEST	443	49805	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.676136971 CEST	49805	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:06.676142931 CEST	443	49805	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.755620003 CEST	443	49806	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.757519007 CEST	49806	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:06.757534981 CEST	443	49806	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.757977962 CEST	49806	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:06.757983923 CEST	443	49806	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.781147003 CEST	443	49805	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.781213045 CEST	443	49805	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.781335115 CEST	49805	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:06.782747030 CEST	49805	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:06.782761097 CEST	443	49805	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.782773972 CEST	49805	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:06.782780886 CEST	443	49805	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.796389103 CEST	443	49807	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.796781063 CEST	49807	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:06.796817064 CEST	443	49807	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.799822092 CEST	49807	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:06.799827099 CEST	443	49807	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.810211897 CEST	49810	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:06.810241938 CEST	443	49810	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.810327053 CEST	49810	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:06.810434103 CEST	49810	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:06.810441017 CEST	443	49810	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.825953007 CEST	443	49808	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.826597929 CEST	49808	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:06.826664925 CEST	443	49808	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.826952934 CEST	49808	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:06.826968908 CEST	443	49808	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.859625101 CEST	443	49806	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.859819889 CEST	443	49806	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.859877110 CEST	49806	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:06.867389917 CEST	49806	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:06.867407084 CEST	443	49806	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.867424011 CEST	49806	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:06.867429972 CEST	443	49806	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.884432077 CEST	49811	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:06.884531975 CEST	443	49811	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.884625912 CEST	49811	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:06.884732962 CEST	49811	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:06.884756088 CEST	443	49811	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.895526886 CEST	443	49807	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.895673037 CEST	443	49807	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.895719051 CEST	49807	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:06.897978067 CEST	49807	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:06.897978067 CEST	49807	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:06.897993088 CEST	443	49807	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.898000002 CEST	443	49807	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.928817034 CEST	443	49808	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.928971052 CEST	443	49808	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:06.929069042 CEST	49808	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:07.000874043 CEST	49808	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:07.000874043 CEST	49808	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:07.000953913 CEST	443	49808	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:07.000998020 CEST	443	49808	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:07.004024982 CEST	49812	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:07.004126072 CEST	443	49812	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:07.004221916 CEST	49812	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:07.004759073 CEST	49812	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:07.004796982 CEST	443	49812	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:07.005884886 CEST	49813	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:07.005970001 CEST	443	49813	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:07.006052971 CEST	49813	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:07.006146908 CEST	49813	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:07.006170988 CEST	443	49813	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:07.074256897 CEST	443	49809	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:07.074706078 CEST	49809	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:07.074716091 CEST	443	49809	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:07.075112104 CEST	49809	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:07.075115919 CEST	443	49809	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:07.173823118 CEST	443	49809	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:07.173959017 CEST	443	49809	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:07.174026966 CEST	49809	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:07.174103975 CEST	49809	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:07.174118042 CEST	443	49809	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:07.174127102 CEST	49809	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:07.174130917 CEST	443	49809	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:07.176599026 CEST	49814	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:07.176683903 CEST	443	49814	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:07.176829100 CEST	49814	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:07.176985025 CEST	49814	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:07.177006960 CEST	443	49814	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:07.460932016 CEST	443	49810	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:07.461498976 CEST	49810	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:07.461510897 CEST	443	49810	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:07.461971998 CEST	49810	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:07.461976051 CEST	443	49810	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:07.536514044 CEST	443	49811	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:07.537008047 CEST	49811	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:07.537055016 CEST	443	49811	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:07.537236929 CEST	49811	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:07.537245035 CEST	443	49811	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:07.564251900 CEST	443	49810	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:07.564310074 CEST	443	49810	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:07.564465046 CEST	49810	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:07.564551115 CEST	49810	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:07.564563036 CEST	443	49810	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:07.564593077 CEST	49810	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:07.564596891 CEST	443	49810	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:07.567265987 CEST	49815	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:07.567363977 CEST	443	49815	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:07.567475080 CEST	49815	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:07.567627907 CEST	49815	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:07.567663908 CEST	443	49815	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:07.636951923 CEST	443	49811	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:07.637095928 CEST	443	49811	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:07.637188911 CEST	49811	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:07.639262915 CEST	49811	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:07.639308929 CEST	443	49811	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:07.639324903 CEST	49811	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:07.639332056 CEST	443	49811	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:07.642293930 CEST	49816	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:07.642328978 CEST	443	49816	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:07.642390966 CEST	49816	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:07.642564058 CEST	49816	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:07.642576933 CEST	443	49816	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:07.657696962 CEST	443	49812	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:07.658088923 CEST	49812	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:07.658123970 CEST	443	49812	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:07.658512115 CEST	49812	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:07.658524036 CEST	443	49812	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:07.696964979 CEST	443	49813	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:07.697511911 CEST	49813	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:07.697594881 CEST	443	49813	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:07.697843075 CEST	49813	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:07.697858095 CEST	443	49813	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:07.756680012 CEST	443	49812	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:07.756823063 CEST	443	49812	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:07.756926060 CEST	49812	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:07.757029057 CEST	49812	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:07.757066965 CEST	443	49812	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:07.757098913 CEST	49812	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:07.757112980 CEST	443	49812	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:07.759712934 CEST	49817	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:07.759794950 CEST	443	49817	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:07.759890079 CEST	49817	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:07.760027885 CEST	49817	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:07.760051966 CEST	443	49817	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:07.801270008 CEST	443	49813	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:07.801454067 CEST	443	49813	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:07.801639080 CEST	49813	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:07.801639080 CEST	49813	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:07.801716089 CEST	49813	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:07.801753998 CEST	443	49813	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:07.803755045 CEST	49818	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:07.803792000 CEST	443	49818	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:07.803874016 CEST	49818	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:07.803992033 CEST	49818	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:07.804013968 CEST	443	49818	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:07.852802992 CEST	443	49814	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:07.853257895 CEST	49814	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:07.853336096 CEST	443	49814	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:07.853637934 CEST	49814	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:07.853652954 CEST	443	49814	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:07.955559969 CEST	443	49814	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:07.955698013 CEST	443	49814	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:07.955900908 CEST	49814	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:07.955900908 CEST	49814	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:07.955900908 CEST	49814	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:07.958204985 CEST	49819	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:07.958246946 CEST	443	49819	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:07.958322048 CEST	49819	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:07.958455086 CEST	49819	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:07.958466053 CEST	443	49819	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:08.223476887 CEST	443	49815	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:08.224035978 CEST	49815	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:08.224071980 CEST	443	49815	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:08.224736929 CEST	49815	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:08.224741936 CEST	443	49815	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:08.271246910 CEST	49814	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:08.271308899 CEST	443	49814	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:08.283704996 CEST	443	49816	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:08.284245014 CEST	49816	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:08.284266949 CEST	443	49816	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:08.284828901 CEST	49816	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:08.284835100 CEST	443	49816	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:08.324351072 CEST	443	49815	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:08.324404955 CEST	443	49815	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:08.324470043 CEST	49815	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:08.326947927 CEST	49815	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:08.326968908 CEST	443	49815	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:08.326977968 CEST	49815	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:08.326982021 CEST	443	49815	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:08.329879999 CEST	49820	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:08.329962015 CEST	443	49820	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:08.330041885 CEST	49820	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:08.330229998 CEST	49820	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:08.330264091 CEST	443	49820	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:08.416207075 CEST	443	49816	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:08.416347980 CEST	443	49816	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:08.416610956 CEST	49816	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:08.416610956 CEST	49816	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:08.416610956 CEST	49816	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:08.419100046 CEST	49821	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:08.419157028 CEST	443	49821	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:08.419229984 CEST	49821	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:08.419342041 CEST	49821	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:08.419367075 CEST	443	49821	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:08.446058035 CEST	443	49817	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:08.446444035 CEST	49817	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:08.446525097 CEST	443	49817	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:08.446871042 CEST	49817	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:08.446886063 CEST	443	49817	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:08.458204985 CEST	443	49818	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:08.458535910 CEST	49818	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:08.458563089 CEST	443	49818	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:08.459075928 CEST	49818	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:08.459086895 CEST	443	49818	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:08.537996054 CEST	443	49819	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:08.538419008 CEST	49819	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:08.538459063 CEST	443	49819	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:08.538780928 CEST	49819	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:08.538788080 CEST	443	49819	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:08.548372984 CEST	443	49817	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:08.548515081 CEST	443	49817	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:08.548588037 CEST	49817	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:08.548635960 CEST	49817	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:08.548635960 CEST	49817	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:08.548671961 CEST	443	49817	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:08.548693895 CEST	443	49817	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:08.550791979 CEST	49822	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:08.550808907 CEST	443	49822	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:08.550879002 CEST	49822	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:08.550980091 CEST	49822	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:08.550996065 CEST	443	49822	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:08.559742928 CEST	443	49818	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:08.559919119 CEST	443	49818	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:08.559979916 CEST	49818	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:08.560108900 CEST	49818	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:08.560126066 CEST	443	49818	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:08.560148001 CEST	49818	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:08.560159922 CEST	443	49818	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:08.561868906 CEST	49823	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:08.561952114 CEST	443	49823	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:08.562036991 CEST	49823	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:08.562148094 CEST	49823	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:08.562170029 CEST	443	49823	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:08.637049913 CEST	443	49819	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:08.637187004 CEST	443	49819	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:08.637367964 CEST	49819	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:08.637482882 CEST	49819	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:08.637502909 CEST	443	49819	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:08.637516975 CEST	49819	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:08.637523890 CEST	443	49819	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:08.640218019 CEST	49824	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:08.640300989 CEST	443	49824	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:08.640384912 CEST	49824	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:08.640526056 CEST	49824	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:08.640547037 CEST	443	49824	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:08.724291086 CEST	49816	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:08.724320889 CEST	443	49816	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:08.988846064 CEST	443	49820	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:08.989612103 CEST	49820	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:08.989671946 CEST	443	49820	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:08.990287066 CEST	49820	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:08.990340948 CEST	443	49820	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:09.089164972 CEST	443	49820	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:09.089225054 CEST	443	49820	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:09.089318991 CEST	49820	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:09.090203047 CEST	49820	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:09.090248108 CEST	443	49820	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:09.090276957 CEST	49820	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:09.090292931 CEST	443	49820	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:09.094481945 CEST	49825	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:09.094522953 CEST	443	49825	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:09.094600916 CEST	49825	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:09.094966888 CEST	49825	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:09.094985962 CEST	443	49825	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:09.109045029 CEST	443	49821	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:09.109436989 CEST	49821	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:09.109450102 CEST	443	49821	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:09.109870911 CEST	49821	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:09.109877110 CEST	443	49821	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:09.213773966 CEST	443	49821	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:09.213829041 CEST	443	49821	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:09.213886976 CEST	49821	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:09.213923931 CEST	443	49821	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:09.213949919 CEST	443	49821	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:09.213999033 CEST	49821	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:09.214118958 CEST	49821	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:09.214135885 CEST	443	49821	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:09.214148045 CEST	49821	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:09.214154005 CEST	443	49821	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:09.216757059 CEST	49826	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:09.216778994 CEST	443	49826	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:09.216851950 CEST	49826	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:09.216974974 CEST	49826	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:09.216994047 CEST	443	49826	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:09.224580050 CEST	443	49822	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:09.224889040 CEST	49822	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:09.224899054 CEST	443	49822	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:09.225295067 CEST	49822	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:09.225301981 CEST	443	49822	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:09.241592884 CEST	443	49823	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:09.241976023 CEST	49823	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:09.242033005 CEST	443	49823	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:09.242398977 CEST	49823	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:09.242410898 CEST	443	49823	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:09.326848030 CEST	443	49824	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:09.354032993 CEST	49824	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:09.354089975 CEST	443	49824	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:09.354774952 CEST	49824	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:09.354789019 CEST	443	49824	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:09.360275984 CEST	443	49822	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:09.360419989 CEST	443	49822	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:09.360471964 CEST	49822	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:09.360723019 CEST	49822	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:09.360755920 CEST	443	49822	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:09.360769987 CEST	49822	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:09.360778093 CEST	443	49822	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:09.369720936 CEST	49827	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:09.369772911 CEST	443	49827	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:09.369842052 CEST	49827	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:09.377136946 CEST	49827	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:09.377166986 CEST	443	49827	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:09.379060030 CEST	443	49823	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:09.379225016 CEST	443	49823	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:09.379278898 CEST	49823	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:09.420826912 CEST	49823	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:09.420860052 CEST	443	49823	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:09.420886993 CEST	49823	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:09.420900106 CEST	443	49823	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:09.452792883 CEST	443	49824	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:09.452855110 CEST	443	49824	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:09.452915907 CEST	49824	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:09.452933073 CEST	443	49824	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:09.452974081 CEST	443	49824	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:09.453027964 CEST	49824	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:09.469738960 CEST	49824	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:09.469750881 CEST	443	49824	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:09.469798088 CEST	49824	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:09.469809055 CEST	443	49824	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:09.544521093 CEST	49828	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:09.544553995 CEST	443	49828	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:09.544610977 CEST	49828	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:09.552786112 CEST	49828	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:09.552804947 CEST	443	49828	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:09.561028957 CEST	49829	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:09.561110020 CEST	443	49829	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:09.561187029 CEST	49829	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:09.561341047 CEST	49829	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:09.561364889 CEST	443	49829	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:09.761852026 CEST	443	49825	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:09.762381077 CEST	49825	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:09.762419939 CEST	443	49825	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:09.762847900 CEST	49825	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:09.762856007 CEST	443	49825	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:09.861080885 CEST	443	49825	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:09.861109018 CEST	443	49825	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:09.861224890 CEST	49825	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:09.861255884 CEST	443	49825	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:09.861269951 CEST	443	49825	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:09.861351013 CEST	49825	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:09.862616062 CEST	49825	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:09.862616062 CEST	49825	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:09.862639904 CEST	49825	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:09.862651110 CEST	443	49825	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:09.869961023 CEST	49830	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:09.870073080 CEST	443	49830	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:09.870162010 CEST	49830	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:09.870301008 CEST	49830	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:09.870337963 CEST	443	49830	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:09.914714098 CEST	443	49826	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:09.915168047 CEST	49826	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:09.915200949 CEST	443	49826	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:09.915611029 CEST	49826	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:09.915618896 CEST	443	49826	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.021886110 CEST	443	49826	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.021914005 CEST	443	49826	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.021972895 CEST	443	49826	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.022023916 CEST	49826	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:10.022073030 CEST	49826	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:10.022269964 CEST	49826	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:10.022294998 CEST	443	49826	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.022305012 CEST	49826	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:10.022310019 CEST	443	49826	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.025075912 CEST	49831	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:10.025126934 CEST	443	49831	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.025218010 CEST	49831	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:10.025337934 CEST	49831	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:10.025350094 CEST	443	49831	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.053730965 CEST	443	49827	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.054243088 CEST	49827	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:10.054301977 CEST	443	49827	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.054819107 CEST	49827	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:10.054833889 CEST	443	49827	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.156166077 CEST	443	49827	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.156311989 CEST	443	49827	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.156440020 CEST	49827	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:10.156517982 CEST	49827	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:10.156558990 CEST	443	49827	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.156588078 CEST	49827	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:10.156604052 CEST	443	49827	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.159251928 CEST	49832	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:10.159291983 CEST	443	49832	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.159358978 CEST	49832	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:10.159482956 CEST	49832	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:10.159491062 CEST	443	49832	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.212183952 CEST	443	49829	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.212644100 CEST	49829	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:10.212666035 CEST	443	49829	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.213165998 CEST	49829	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:10.213171959 CEST	443	49829	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.221380949 CEST	443	49828	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.221733093 CEST	49828	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:10.221750975 CEST	443	49828	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.222301006 CEST	49828	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:10.222304106 CEST	443	49828	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.310667038 CEST	443	49829	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.310828924 CEST	443	49829	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.310899973 CEST	49829	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:10.310965061 CEST	49829	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:10.310965061 CEST	49829	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:10.310986042 CEST	443	49829	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.310997963 CEST	443	49829	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.313606977 CEST	49833	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:10.313693047 CEST	443	49833	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.313785076 CEST	49833	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:10.313932896 CEST	49833	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:10.313958883 CEST	443	49833	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.320400953 CEST	443	49828	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.320538044 CEST	443	49828	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.320590973 CEST	49828	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:10.320626974 CEST	49828	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:10.320633888 CEST	443	49828	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.320646048 CEST	49828	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:10.320648909 CEST	443	49828	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.322650909 CEST	49834	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:10.322674036 CEST	443	49834	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.322743893 CEST	49834	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:10.322892904 CEST	49834	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:10.322917938 CEST	443	49834	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.502861977 CEST	443	49830	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.503714085 CEST	49830	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:10.503799915 CEST	443	49830	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.504185915 CEST	49830	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:10.504199982 CEST	443	49830	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.602176905 CEST	443	49830	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.602399111 CEST	443	49830	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.602485895 CEST	49830	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:10.602533102 CEST	49830	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:10.602567911 CEST	443	49830	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.602595091 CEST	49830	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:10.602610111 CEST	443	49830	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.605144024 CEST	49835	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:10.605242968 CEST	443	49835	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.605336905 CEST	49835	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:10.605451107 CEST	49835	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:10.605473995 CEST	443	49835	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.675736904 CEST	443	49831	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.676176071 CEST	49831	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:10.676189899 CEST	443	49831	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.676594019 CEST	49831	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:10.676598072 CEST	443	49831	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.774732113 CEST	443	49831	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.774877071 CEST	443	49831	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.774936914 CEST	49831	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:10.775121927 CEST	49831	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:10.775132895 CEST	443	49831	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.775146008 CEST	49831	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:10.775151014 CEST	443	49831	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.778120041 CEST	49836	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:10.778228998 CEST	443	49836	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.778311968 CEST	49836	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:10.778426886 CEST	49836	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:10.778445005 CEST	443	49836	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.824703932 CEST	443	49832	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.825122118 CEST	49832	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:10.825170994 CEST	443	49832	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.825555086 CEST	49832	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:10.825568914 CEST	443	49832	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.925379992 CEST	443	49832	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.925574064 CEST	443	49832	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.925664902 CEST	49832	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:10.925839901 CEST	49832	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:10.925884008 CEST	443	49832	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.925919056 CEST	49832	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:10.925932884 CEST	443	49832	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.929020882 CEST	49837	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:10.929049015 CEST	443	49837	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.929128885 CEST	49837	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:10.929264069 CEST	49837	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:10.929269075 CEST	443	49837	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.955519915 CEST	443	49833	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.956202030 CEST	49833	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:10.956262112 CEST	443	49833	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.956736088 CEST	49833	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:10.956749916 CEST	443	49833	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.975265980 CEST	443	49834	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.975929976 CEST	49834	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:10.975990057 CEST	443	49834	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:10.976289034 CEST	49834	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:10.976306915 CEST	443	49834	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:11.054770947 CEST	443	49833	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:11.054948092 CEST	443	49833	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:11.055021048 CEST	49833	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:11.055288076 CEST	49833	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:11.055331945 CEST	443	49833	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:11.055367947 CEST	49833	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:11.055383921 CEST	443	49833	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:11.059468031 CEST	49838	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:11.059489012 CEST	443	49838	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:11.059562922 CEST	49838	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:11.059689045 CEST	49838	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:11.059695005 CEST	443	49838	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:11.075609922 CEST	443	49834	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:11.075752974 CEST	443	49834	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:11.075943947 CEST	49834	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:11.078790903 CEST	49834	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:11.078790903 CEST	49834	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:11.078835964 CEST	443	49834	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:11.078869104 CEST	443	49834	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:11.081857920 CEST	49839	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:11.081932068 CEST	443	49839	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:11.082026005 CEST	49839	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:11.082139015 CEST	49839	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:11.082159042 CEST	443	49839	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:11.238681078 CEST	443	49835	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:11.239249945 CEST	49835	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:11.239315987 CEST	443	49835	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:11.239739895 CEST	49835	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:11.239754915 CEST	443	49835	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:11.338402987 CEST	443	49835	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:11.338677883 CEST	443	49835	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:11.338737965 CEST	49835	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:11.338865995 CEST	49835	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:11.338865995 CEST	49835	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:11.338901997 CEST	443	49835	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:11.338924885 CEST	443	49835	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:11.342804909 CEST	49840	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:11.342885017 CEST	443	49840	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:11.342969894 CEST	49840	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:11.343163967 CEST	49840	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:11.343199015 CEST	443	49840	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:11.417779922 CEST	443	49836	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:11.420403957 CEST	49836	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:11.420447111 CEST	443	49836	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:11.420871019 CEST	49836	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:11.420878887 CEST	443	49836	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:11.516493082 CEST	443	49836	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:11.516812086 CEST	443	49836	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:11.516884089 CEST	49836	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:11.516920090 CEST	49836	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:11.516937971 CEST	443	49836	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:11.516949892 CEST	49836	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:11.516957045 CEST	443	49836	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:11.519793034 CEST	49841	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:11.519810915 CEST	443	49841	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:11.519881964 CEST	49841	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:11.520014048 CEST	49841	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:11.520025015 CEST	443	49841	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:11.564764977 CEST	443	49837	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:11.565320969 CEST	49837	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:11.565346003 CEST	443	49837	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:11.565810919 CEST	49837	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:11.565815926 CEST	443	49837	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:11.687308073 CEST	443	49839	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:11.687891006 CEST	49839	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:11.687902927 CEST	443	49839	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:11.688268900 CEST	49839	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:11.688275099 CEST	443	49839	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:11.692025900 CEST	443	49837	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:11.692097902 CEST	443	49837	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:11.692152977 CEST	49837	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:11.692161083 CEST	443	49837	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:11.692195892 CEST	443	49837	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:11.692245007 CEST	49837	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:11.692336082 CEST	49837	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:11.692344904 CEST	443	49837	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:11.692353010 CEST	49837	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:11.692356110 CEST	443	49837	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:11.694566011 CEST	49842	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:11.694586039 CEST	443	49842	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:11.694679022 CEST	49842	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:11.694797039 CEST	49842	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:11.694801092 CEST	443	49842	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:11.744025946 CEST	443	49838	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:11.747423887 CEST	49838	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:11.747435093 CEST	443	49838	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:11.747895002 CEST	49838	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:11.747899055 CEST	443	49838	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:11.786247015 CEST	443	49839	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:11.786315918 CEST	443	49839	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:11.786417007 CEST	443	49839	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:11.786423922 CEST	49839	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:11.786468983 CEST	49839	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:11.786719084 CEST	49839	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:11.786732912 CEST	443	49839	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:11.786746025 CEST	49839	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:11.786751032 CEST	443	49839	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:11.789766073 CEST	49843	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:11.789869070 CEST	443	49843	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:11.789963961 CEST	49843	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:11.790106058 CEST	49843	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:11.790138006 CEST	443	49843	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:11.843154907 CEST	443	49838	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:11.843327045 CEST	443	49838	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:11.843405962 CEST	49838	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:11.843442917 CEST	49838	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:11.843447924 CEST	443	49838	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:11.843456984 CEST	49838	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:11.843461990 CEST	443	49838	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:11.847243071 CEST	49844	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:11.847284079 CEST	443	49844	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:11.847362041 CEST	49844	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:11.847479105 CEST	49844	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:11.847489119 CEST	443	49844	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:12.014784098 CEST	443	49840	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:12.015289068 CEST	49840	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:12.015372992 CEST	443	49840	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:12.015733957 CEST	49840	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:12.015748978 CEST	443	49840	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:12.114065886 CEST	443	49840	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:12.114250898 CEST	443	49840	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:12.114423990 CEST	49840	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:12.114423990 CEST	49840	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:12.114423990 CEST	49840	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:12.117307901 CEST	49845	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:12.117392063 CEST	443	49845	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:12.117487907 CEST	49845	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:12.117630005 CEST	49845	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:12.117652893 CEST	443	49845	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:12.226459980 CEST	443	49841	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:12.227046013 CEST	49841	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:12.227058887 CEST	443	49841	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:12.227547884 CEST	49841	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:12.227550983 CEST	443	49841	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:12.349073887 CEST	443	49841	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:12.349220037 CEST	443	49841	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:12.349280119 CEST	49841	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:12.349484921 CEST	49841	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:12.349484921 CEST	49841	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:12.349497080 CEST	443	49841	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:12.349505901 CEST	443	49841	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:12.352345943 CEST	49846	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:12.352417946 CEST	443	49842	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:12.352428913 CEST	443	49846	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:12.352519035 CEST	49846	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:12.352660894 CEST	49846	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:12.352682114 CEST	443	49846	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:12.352956057 CEST	49842	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:12.352962971 CEST	443	49842	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:12.353404045 CEST	49842	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:12.353408098 CEST	443	49842	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:12.427375078 CEST	49840	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:12.427442074 CEST	443	49840	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:12.452166080 CEST	443	49842	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:12.452385902 CEST	443	49842	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:12.452454090 CEST	49842	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:12.452516079 CEST	49842	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:12.452522993 CEST	443	49842	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:12.452532053 CEST	49842	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:12.452536106 CEST	443	49842	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:12.455337048 CEST	49847	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:12.455377102 CEST	443	49847	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:12.455472946 CEST	49847	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:12.455620050 CEST	49847	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:12.455636978 CEST	443	49847	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:12.476526022 CEST	443	49843	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:12.476947069 CEST	49843	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:12.476974010 CEST	443	49843	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:12.477380037 CEST	49843	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:12.477392912 CEST	443	49843	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:12.537944078 CEST	443	49844	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:12.538512945 CEST	49844	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:12.538528919 CEST	443	49844	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:12.538957119 CEST	49844	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:12.538964033 CEST	443	49844	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:12.581269979 CEST	443	49843	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:12.581336021 CEST	443	49843	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:12.581433058 CEST	443	49843	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:12.581486940 CEST	49843	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:12.581486940 CEST	49843	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:12.581655025 CEST	49843	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:12.581681967 CEST	443	49843	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:12.581705093 CEST	49843	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:12.581721067 CEST	443	49843	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:12.584741116 CEST	49848	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:12.584762096 CEST	443	49848	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:12.584837914 CEST	49848	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:12.584990978 CEST	49848	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:12.585000992 CEST	443	49848	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:12.637691975 CEST	443	49844	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:12.637865067 CEST	443	49844	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:12.637928009 CEST	49844	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:12.637959003 CEST	49844	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:12.637979031 CEST	443	49844	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:12.637991905 CEST	49844	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:12.637998104 CEST	443	49844	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:12.639913082 CEST	49849	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:12.639975071 CEST	443	49849	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:12.640058994 CEST	49849	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:12.640167952 CEST	49849	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:12.640189886 CEST	443	49849	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:12.764767885 CEST	443	49845	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:12.765270948 CEST	49845	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:12.765352964 CEST	443	49845	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:12.765669107 CEST	49845	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:12.765685081 CEST	443	49845	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:12.864836931 CEST	443	49845	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:12.864989996 CEST	443	49845	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:12.865164042 CEST	49845	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:12.865267038 CEST	49845	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:12.865267038 CEST	49845	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:12.865309954 CEST	443	49845	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:12.865338087 CEST	443	49845	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:12.868781090 CEST	49850	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:12.868890047 CEST	443	49850	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:12.869004011 CEST	49850	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:12.869240046 CEST	49850	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:12.869277954 CEST	443	49850	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:13.007098913 CEST	443	49846	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:13.007919073 CEST	49846	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:13.007978916 CEST	443	49846	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:13.008157969 CEST	49846	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:13.008173943 CEST	443	49846	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:13.100898027 CEST	443	49847	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:13.101471901 CEST	49847	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:13.101488113 CEST	443	49847	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:13.101850033 CEST	49847	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:13.101859093 CEST	443	49847	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:13.107881069 CEST	443	49846	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:13.108028889 CEST	443	49846	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:13.108109951 CEST	49846	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:13.108725071 CEST	49846	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:13.108768940 CEST	443	49846	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:13.108799934 CEST	49846	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:13.108814955 CEST	443	49846	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:13.118575096 CEST	49851	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:13.118597031 CEST	443	49851	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:13.118670940 CEST	49851	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:13.118911982 CEST	49851	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:13.118923903 CEST	443	49851	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:13.220352888 CEST	443	49847	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:13.221678972 CEST	443	49847	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:13.221738100 CEST	49847	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:13.221756935 CEST	443	49847	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:13.221785069 CEST	443	49847	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:13.221841097 CEST	49847	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:13.221868038 CEST	443	49847	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:13.221893072 CEST	49847	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:13.221900940 CEST	443	49847	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:13.225461960 CEST	49852	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:13.225548029 CEST	443	49852	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:13.225650072 CEST	49852	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:13.225847960 CEST	49852	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:13.225867987 CEST	443	49852	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:13.304508924 CEST	443	49848	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:13.305078983 CEST	49848	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:13.305090904 CEST	443	49848	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:13.305803061 CEST	49848	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:13.305807114 CEST	443	49848	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:13.309189081 CEST	443	49849	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:13.309711933 CEST	49849	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:13.309781075 CEST	443	49849	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:13.310283899 CEST	49849	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:13.310297966 CEST	443	49849	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:13.403753996 CEST	443	49848	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:13.404200077 CEST	443	49848	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:13.404257059 CEST	49848	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:13.410813093 CEST	49848	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:13.410820961 CEST	443	49848	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:13.410835981 CEST	49848	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:13.410839081 CEST	443	49848	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:13.416146040 CEST	49853	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:13.416250944 CEST	443	49853	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:13.416342974 CEST	49853	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:13.416704893 CEST	49853	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:13.416740894 CEST	443	49853	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:13.545855999 CEST	443	49850	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:13.546737909 CEST	49850	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:13.546782017 CEST	443	49850	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:13.547298908 CEST	49850	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:13.547307014 CEST	443	49850	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:13.627823114 CEST	443	49849	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:13.627893925 CEST	443	49849	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:13.628026962 CEST	443	49849	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:13.628077030 CEST	49849	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:13.628110886 CEST	49849	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:13.628263950 CEST	49849	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:13.628284931 CEST	443	49849	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:13.628297091 CEST	49849	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:13.628303051 CEST	443	49849	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:13.631649017 CEST	49854	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:13.631752014 CEST	443	49854	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:13.631838083 CEST	49854	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:13.632034063 CEST	49854	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:13.632052898 CEST	443	49854	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:13.668075085 CEST	443	49850	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:13.668107033 CEST	443	49850	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:13.668183088 CEST	49850	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:13.668361902 CEST	49850	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:13.668370962 CEST	443	49850	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:13.668381929 CEST	49850	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:13.668386936 CEST	443	49850	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:13.671117067 CEST	49855	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:13.671202898 CEST	443	49855	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:13.671305895 CEST	49855	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:13.671411991 CEST	49855	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:13.671432018 CEST	443	49855	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:13.837956905 CEST	443	49851	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:13.838712931 CEST	49851	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:13.838722944 CEST	443	49851	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:13.839085102 CEST	49851	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:13.839088917 CEST	443	49851	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:13.906989098 CEST	443	49852	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:13.907783985 CEST	49852	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:13.907867908 CEST	443	49852	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:13.908164978 CEST	49852	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:13.908188105 CEST	443	49852	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:13.940006018 CEST	443	49851	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:13.940176010 CEST	443	49851	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:13.940346003 CEST	49851	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:13.940421104 CEST	49851	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:13.940433025 CEST	443	49851	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:13.940455914 CEST	49851	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:13.940459967 CEST	443	49851	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:13.943984032 CEST	49856	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:13.943998098 CEST	443	49856	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:13.944103956 CEST	49856	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:13.944212914 CEST	49856	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:13.944217920 CEST	443	49856	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:14.007674932 CEST	443	49852	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:14.007822037 CEST	443	49852	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:14.008034945 CEST	49852	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:14.008035898 CEST	49852	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:14.008115053 CEST	49852	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:14.008152008 CEST	443	49852	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:14.011086941 CEST	49857	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:14.011142015 CEST	443	49857	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:14.011235952 CEST	49857	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:14.011437893 CEST	49857	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:14.011459112 CEST	443	49857	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:14.072299004 CEST	443	49853	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:14.072868109 CEST	49853	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:14.072956085 CEST	443	49853	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:14.073261023 CEST	49853	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:14.073276997 CEST	443	49853	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:14.170856953 CEST	443	49853	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:14.171029091 CEST	443	49853	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:14.171134949 CEST	443	49853	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:14.171173096 CEST	49853	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:14.171252966 CEST	49853	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:14.176532984 CEST	49853	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:14.176532984 CEST	49853	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:14.176582098 CEST	443	49853	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:14.176609039 CEST	443	49853	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:14.180013895 CEST	49858	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:14.180074930 CEST	443	49858	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:14.180188894 CEST	49858	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:14.180280924 CEST	49858	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:14.180291891 CEST	443	49858	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:14.207954884 CEST	443	49854	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:14.208770990 CEST	49854	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:14.208868980 CEST	443	49854	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:14.209222078 CEST	49854	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:14.209238052 CEST	443	49854	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:14.304805040 CEST	443	49855	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:14.305470943 CEST	49855	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:14.305531025 CEST	443	49855	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:14.306011915 CEST	49855	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:14.306066036 CEST	443	49855	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:14.309027910 CEST	443	49854	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:14.309170008 CEST	443	49854	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:14.309257984 CEST	49854	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:14.309385061 CEST	49854	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:14.309385061 CEST	49854	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:14.309432030 CEST	443	49854	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:14.309462070 CEST	443	49854	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:14.313842058 CEST	49859	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:14.313862085 CEST	443	49859	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:14.313937902 CEST	49859	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:14.314136982 CEST	49859	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:14.314155102 CEST	443	49859	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:14.404612064 CEST	443	49855	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:14.404748917 CEST	443	49855	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:14.405225039 CEST	49855	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:14.405225992 CEST	49855	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:14.405225992 CEST	49855	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:14.407919884 CEST	49860	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:14.407982111 CEST	443	49860	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:14.408082008 CEST	49860	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:14.408185959 CEST	49860	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:14.408205986 CEST	443	49860	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:14.636596918 CEST	443	49856	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:14.640151024 CEST	49856	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:14.640177965 CEST	443	49856	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:14.640450001 CEST	49856	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:14.640469074 CEST	443	49856	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:14.658852100 CEST	443	49857	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:14.662359953 CEST	49857	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:14.662395954 CEST	443	49857	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:14.662566900 CEST	49857	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:14.662576914 CEST	443	49857	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:14.708724022 CEST	49855	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:14.708786011 CEST	443	49855	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:14.742124081 CEST	443	49856	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:14.742281914 CEST	443	49856	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:14.742561102 CEST	49856	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:14.742561102 CEST	49856	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:14.742561102 CEST	49856	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:14.745903969 CEST	49861	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:14.746000051 CEST	443	49861	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:14.746273994 CEST	49861	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:14.746393919 CEST	49861	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:14.746424913 CEST	443	49861	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:14.758214951 CEST	443	49857	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:14.758311033 CEST	443	49857	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:14.758414030 CEST	443	49857	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:14.758568048 CEST	49857	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:14.758651972 CEST	49857	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:14.758651972 CEST	49857	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:14.758651972 CEST	49857	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:14.760899067 CEST	49862	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:14.760948896 CEST	443	49862	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:14.761039019 CEST	49862	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:14.761179924 CEST	49862	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:14.761209965 CEST	443	49862	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:14.895979881 CEST	443	49858	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:14.896946907 CEST	49858	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:14.897047043 CEST	443	49858	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:14.897453070 CEST	49858	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:14.897468090 CEST	443	49858	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.000097036 CEST	443	49858	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.000245094 CEST	443	49858	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.000612974 CEST	49858	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.000613928 CEST	49858	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.001415014 CEST	49858	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.001460075 CEST	443	49858	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.003861904 CEST	49863	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.003947973 CEST	443	49863	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.004054070 CEST	49863	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.004278898 CEST	49863	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.004312038 CEST	443	49863	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.007631063 CEST	443	49859	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.008021116 CEST	49859	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.008032084 CEST	443	49859	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.008392096 CEST	49859	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.008395910 CEST	443	49859	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.052499056 CEST	49856	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.052508116 CEST	443	49856	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.068101883 CEST	49857	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.068166018 CEST	443	49857	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.076328993 CEST	443	49860	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.076853991 CEST	49860	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.076914072 CEST	443	49860	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.077064991 CEST	49860	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.077080965 CEST	443	49860	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.133375883 CEST	443	49859	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.133444071 CEST	443	49859	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.133507967 CEST	49859	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.133721113 CEST	49859	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.133734941 CEST	443	49859	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.133745909 CEST	49859	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.133749962 CEST	443	49859	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.136368990 CEST	49864	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.136425018 CEST	443	49864	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.136514902 CEST	49864	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.136684895 CEST	49864	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.136698008 CEST	443	49864	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.177144051 CEST	443	49860	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.177383900 CEST	443	49860	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.177603960 CEST	49860	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.177686930 CEST	49860	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.177686930 CEST	49860	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.177728891 CEST	443	49860	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.177762032 CEST	443	49860	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.180283070 CEST	49865	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.180300951 CEST	443	49865	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.180443048 CEST	49865	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.180485010 CEST	49865	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.180489063 CEST	443	49865	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.406503916 CEST	443	49861	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.407018900 CEST	49861	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.407107115 CEST	443	49861	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.407444954 CEST	49861	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.407459974 CEST	443	49861	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.448153019 CEST	443	49862	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.448766947 CEST	49862	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.448827982 CEST	443	49862	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.449035883 CEST	49862	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.449052095 CEST	443	49862	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.504904985 CEST	443	49861	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.504976034 CEST	443	49861	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.505080938 CEST	443	49861	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.505153894 CEST	49861	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.505153894 CEST	49861	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.505346060 CEST	49861	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.505346060 CEST	49861	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.505393982 CEST	443	49861	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.505428076 CEST	443	49861	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.508727074 CEST	49866	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.508759975 CEST	443	49866	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.508865118 CEST	49866	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.508968115 CEST	49866	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.508977890 CEST	443	49866	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.558070898 CEST	443	49862	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.558228016 CEST	443	49862	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.558331013 CEST	49862	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.558496952 CEST	49862	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.558496952 CEST	49862	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.558549881 CEST	443	49862	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.558579922 CEST	443	49862	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.562069893 CEST	49867	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.562140942 CEST	443	49867	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.562239885 CEST	49867	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.562459946 CEST	49867	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.562479973 CEST	443	49867	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.696444988 CEST	443	49863	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.697294950 CEST	49863	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.697354078 CEST	443	49863	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.697793007 CEST	49863	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.697846889 CEST	443	49863	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.770622969 CEST	443	49865	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.771344900 CEST	49865	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.771361113 CEST	443	49865	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.771801949 CEST	49865	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.771809101 CEST	443	49865	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.795839071 CEST	443	49863	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.795985937 CEST	443	49863	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.796284914 CEST	49863	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.796436071 CEST	49863	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.796436071 CEST	49863	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.796478987 CEST	443	49863	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.796509027 CEST	443	49863	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.796765089 CEST	443	49864	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.797089100 CEST	49864	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.797133923 CEST	443	49864	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.797585964 CEST	49864	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.797594070 CEST	443	49864	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.800050020 CEST	49868	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.800090075 CEST	443	49868	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.800168037 CEST	49868	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.800323963 CEST	49868	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.800333023 CEST	443	49868	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.871547937 CEST	443	49865	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.871629000 CEST	443	49865	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.871675014 CEST	443	49865	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.871690035 CEST	49865	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.871733904 CEST	49865	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.871923923 CEST	49865	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.871937037 CEST	443	49865	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.871949911 CEST	49865	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.871957064 CEST	443	49865	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.874706984 CEST	49869	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.874798059 CEST	443	49869	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.874892950 CEST	49869	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.875040054 CEST	49869	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.875058889 CEST	443	49869	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.897655010 CEST	443	49864	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.898055077 CEST	443	49864	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.898127079 CEST	49864	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.898161888 CEST	49864	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.898185968 CEST	443	49864	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.898200035 CEST	49864	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.898205996 CEST	443	49864	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.901072979 CEST	49870	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.901097059 CEST	443	49870	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:15.901192904 CEST	49870	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.901340008 CEST	49870	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:15.901370049 CEST	443	49870	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:16.179219007 CEST	443	49866	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:16.179982901 CEST	49866	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:16.180012941 CEST	443	49866	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:16.180763960 CEST	49866	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:16.180771112 CEST	443	49866	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:16.244066000 CEST	443	49867	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:16.244693041 CEST	49867	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:16.244738102 CEST	443	49867	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:16.245157957 CEST	49867	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:16.245165110 CEST	443	49867	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:16.281295061 CEST	443	49866	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:16.281454086 CEST	443	49866	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:16.281534910 CEST	49866	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:16.281888008 CEST	49866	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:16.281888008 CEST	49866	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:16.281919956 CEST	443	49866	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:16.281938076 CEST	443	49866	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:16.285201073 CEST	49871	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:16.285263062 CEST	443	49871	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:16.285348892 CEST	49871	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:16.285487890 CEST	49871	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:16.285502911 CEST	443	49871	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:16.347600937 CEST	443	49867	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:16.347672939 CEST	443	49867	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:16.347738028 CEST	49867	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:16.347752094 CEST	443	49867	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:16.347771883 CEST	443	49867	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:16.347832918 CEST	49867	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:16.347875118 CEST	49867	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:16.347897053 CEST	443	49867	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:16.347909927 CEST	49867	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:16.347917080 CEST	443	49867	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:16.350651026 CEST	49872	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:16.350745916 CEST	443	49872	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:16.350828886 CEST	49872	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:16.350939035 CEST	49872	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:16.350960970 CEST	443	49872	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:16.449208021 CEST	443	49868	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:16.449681044 CEST	49868	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:16.449697018 CEST	443	49868	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:16.450082064 CEST	49868	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:16.450087070 CEST	443	49868	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:16.513752937 CEST	443	49869	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:16.514121056 CEST	49869	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:16.514182091 CEST	443	49869	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:16.514661074 CEST	49869	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:16.514674902 CEST	443	49869	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:16.548583984 CEST	443	49868	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:16.548723936 CEST	443	49868	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:16.548806906 CEST	49868	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:16.548885107 CEST	49868	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:16.548902988 CEST	443	49868	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:16.548913002 CEST	49868	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:16.548918009 CEST	443	49868	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:16.551167965 CEST	49873	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:16.551254034 CEST	443	49873	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:16.551366091 CEST	49873	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:16.551467896 CEST	49873	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:16.551487923 CEST	443	49873	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:16.590946913 CEST	443	49870	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:16.591541052 CEST	49870	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:16.591598988 CEST	443	49870	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:16.592073917 CEST	49870	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:16.592128038 CEST	443	49870	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:16.613085985 CEST	443	49869	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:16.613111019 CEST	443	49869	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:16.613137007 CEST	443	49869	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:16.613183975 CEST	49869	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:16.613244057 CEST	49869	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:16.613533974 CEST	49869	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:16.613533974 CEST	49869	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:16.613574982 CEST	443	49869	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:16.613603115 CEST	443	49869	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:16.617041111 CEST	49874	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:16.617125988 CEST	443	49874	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:16.617238998 CEST	49874	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:16.617347956 CEST	49874	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:16.617369890 CEST	443	49874	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:16.693193913 CEST	443	49870	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:16.693340063 CEST	443	49870	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:16.693413973 CEST	49870	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:16.693517923 CEST	49870	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:16.693545103 CEST	443	49870	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:16.693552017 CEST	49870	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:16.693566084 CEST	443	49870	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:16.696276903 CEST	49875	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:16.696371078 CEST	443	49875	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:16.696518898 CEST	49875	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:16.696645021 CEST	49875	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:16.696675062 CEST	443	49875	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:16.929112911 CEST	443	49871	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:16.929822922 CEST	49871	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:16.929857969 CEST	443	49871	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:16.930526972 CEST	49871	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:16.930532932 CEST	443	49871	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:16.995939970 CEST	443	49872	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:16.997085094 CEST	49872	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:16.997173071 CEST	443	49872	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:16.997539043 CEST	49872	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:16.997594118 CEST	443	49872	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.029880047 CEST	443	49871	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.029948950 CEST	443	49871	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.030009985 CEST	49871	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:17.030021906 CEST	443	49871	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.030059099 CEST	443	49871	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.030118942 CEST	49871	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:17.030389071 CEST	49871	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:17.030411959 CEST	443	49871	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.030421972 CEST	49871	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:17.030427933 CEST	443	49871	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.034044981 CEST	49876	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:17.034104109 CEST	443	49876	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.034209967 CEST	49876	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:17.034420013 CEST	49876	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:17.034432888 CEST	443	49876	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.095784903 CEST	443	49872	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.095928907 CEST	443	49872	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.096086025 CEST	49872	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:17.096169949 CEST	49872	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:17.096169949 CEST	49872	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:17.096214056 CEST	443	49872	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.096256971 CEST	443	49872	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.098695040 CEST	49877	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:17.098723888 CEST	443	49877	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.098897934 CEST	49877	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:17.099102020 CEST	49877	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:17.099123001 CEST	443	49877	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.234687090 CEST	443	49873	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.235081911 CEST	49873	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:17.235141039 CEST	443	49873	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.235475063 CEST	49873	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:17.235488892 CEST	443	49873	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.267111063 CEST	443	49874	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.272332907 CEST	49874	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:17.272393942 CEST	443	49874	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.273241997 CEST	49874	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:17.273257017 CEST	443	49874	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.350178003 CEST	443	49873	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.350248098 CEST	443	49873	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.350307941 CEST	49873	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:17.350338936 CEST	443	49873	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.350363016 CEST	443	49873	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.350413084 CEST	49873	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:17.350503922 CEST	49873	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:17.350524902 CEST	443	49873	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.350538015 CEST	49873	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:17.350543976 CEST	443	49873	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.353765965 CEST	49878	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:17.353786945 CEST	443	49878	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.353857994 CEST	49878	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:17.353979111 CEST	49878	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:17.353984118 CEST	443	49878	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.355746984 CEST	443	49875	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.356070042 CEST	49875	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:17.356134892 CEST	443	49875	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.356456041 CEST	49875	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:17.356471062 CEST	443	49875	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.369766951 CEST	443	49874	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.369932890 CEST	443	49874	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.369993925 CEST	49874	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:17.370048046 CEST	49874	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:17.370049000 CEST	49874	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:17.370064020 CEST	443	49874	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.370085001 CEST	443	49874	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.372411013 CEST	49879	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:17.372464895 CEST	443	49879	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.372570992 CEST	49879	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:17.372683048 CEST	49879	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:17.372699022 CEST	443	49879	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.462436914 CEST	443	49875	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.462594032 CEST	443	49875	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.462682962 CEST	49875	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:17.462847948 CEST	49875	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:17.462898016 CEST	443	49875	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.462929010 CEST	49875	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:17.462944031 CEST	443	49875	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.465497017 CEST	49880	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:17.465583086 CEST	443	49880	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.465684891 CEST	49880	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:17.465795040 CEST	49880	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:17.465815067 CEST	443	49880	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.673126936 CEST	443	49876	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.673953056 CEST	49876	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:17.674015045 CEST	443	49876	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.674321890 CEST	49876	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:17.674350023 CEST	443	49876	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.767111063 CEST	443	49877	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.767678022 CEST	49877	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:17.767718077 CEST	443	49877	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.768132925 CEST	49877	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:17.768151045 CEST	443	49877	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.772577047 CEST	443	49876	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.772731066 CEST	443	49876	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.772799015 CEST	49876	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:17.772875071 CEST	49876	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:17.772906065 CEST	443	49876	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.772916079 CEST	49876	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:17.772921085 CEST	443	49876	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.775944948 CEST	49881	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:17.775991917 CEST	443	49881	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.776077986 CEST	49881	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:17.776335001 CEST	49881	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:17.776356936 CEST	443	49881	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.888183117 CEST	443	49877	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.888252020 CEST	443	49877	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.888307095 CEST	49877	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:17.888319016 CEST	443	49877	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.888360023 CEST	443	49877	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.888406038 CEST	49877	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:17.888603926 CEST	49877	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:17.888612032 CEST	443	49877	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.888624907 CEST	49877	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:17.888628960 CEST	443	49877	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.891952991 CEST	49882	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:17.891974926 CEST	443	49882	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:17.892060995 CEST	49882	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:17.892182112 CEST	49882	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:17.892185926 CEST	443	49882	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.004034042 CEST	443	49878	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.005085945 CEST	49878	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.005105972 CEST	443	49878	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.005475998 CEST	49878	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.005494118 CEST	443	49878	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.052402020 CEST	443	49879	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.053818941 CEST	49879	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.053849936 CEST	443	49879	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.054188013 CEST	49879	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.054194927 CEST	443	49879	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.112875938 CEST	443	49878	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.113014936 CEST	443	49878	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.113075018 CEST	49878	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.113203049 CEST	49878	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.113214970 CEST	443	49878	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.113225937 CEST	49878	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.113229990 CEST	443	49878	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.113454103 CEST	443	49880	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.114481926 CEST	49880	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.114541054 CEST	443	49880	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.115782022 CEST	49880	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.115796089 CEST	443	49880	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.117338896 CEST	49883	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.117389917 CEST	443	49883	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.117465019 CEST	49883	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.117566109 CEST	49883	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.117583036 CEST	443	49883	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.161361933 CEST	443	49879	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.161385059 CEST	443	49879	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.161411047 CEST	443	49879	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.161581993 CEST	49879	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.161659002 CEST	49879	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.161801100 CEST	49879	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.161801100 CEST	49879	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.161849022 CEST	443	49879	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.161879063 CEST	443	49879	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.164853096 CEST	49884	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.164870977 CEST	443	49884	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.165049076 CEST	49884	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.165049076 CEST	49884	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.165095091 CEST	443	49884	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.213011980 CEST	443	49880	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.213373899 CEST	443	49880	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.213551044 CEST	49880	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.213551044 CEST	49880	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.213551044 CEST	49880	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.215368032 CEST	49885	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.215477943 CEST	443	49885	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.215548038 CEST	49885	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.215653896 CEST	49885	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.215673923 CEST	443	49885	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.472074032 CEST	443	49881	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.521069050 CEST	49881	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.521085024 CEST	49880	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.521146059 CEST	443	49880	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.564125061 CEST	443	49882	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.577861071 CEST	49881	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.577868938 CEST	443	49881	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.578509092 CEST	49881	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.578514099 CEST	443	49881	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.579013109 CEST	49882	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.579019070 CEST	443	49882	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.579406023 CEST	49882	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.579410076 CEST	443	49882	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.678868055 CEST	443	49882	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.679477930 CEST	443	49882	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.679534912 CEST	49882	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.681124926 CEST	443	49881	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.681262970 CEST	443	49881	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.681312084 CEST	49881	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.683096886 CEST	49881	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.683119059 CEST	443	49881	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.683129072 CEST	49881	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.683132887 CEST	443	49881	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.685111046 CEST	49882	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.685115099 CEST	443	49882	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.685122013 CEST	49882	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.685126066 CEST	443	49882	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.688529968 CEST	49887	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.688550949 CEST	443	49887	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.688565016 CEST	49886	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.688610077 CEST	49887	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.688635111 CEST	443	49886	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.688690901 CEST	49886	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.688740015 CEST	49887	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.688747883 CEST	443	49887	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.688927889 CEST	49886	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.688965082 CEST	443	49886	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.765254021 CEST	443	49883	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.765784979 CEST	49883	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.765868902 CEST	443	49883	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.766176939 CEST	49883	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.766191959 CEST	443	49883	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.813306093 CEST	443	49884	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.813743114 CEST	49884	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.813754082 CEST	443	49884	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.814152956 CEST	49884	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.814157963 CEST	443	49884	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.876123905 CEST	443	49883	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.876194954 CEST	443	49883	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.876295090 CEST	443	49883	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.876463890 CEST	49883	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.876533985 CEST	49883	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.876533985 CEST	49883	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.876534939 CEST	49883	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.878958941 CEST	49888	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.878988981 CEST	443	49888	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.879204035 CEST	49888	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.879204035 CEST	49888	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.879249096 CEST	443	49888	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.893266916 CEST	443	49885	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.893810987 CEST	49885	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.893827915 CEST	443	49885	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.894464016 CEST	49885	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.894469976 CEST	443	49885	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.924717903 CEST	443	49884	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.924756050 CEST	443	49884	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.924812078 CEST	49884	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.925060987 CEST	49884	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.925060987 CEST	49884	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.925071001 CEST	443	49884	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.925077915 CEST	443	49884	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.926769018 CEST	49889	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.926805973 CEST	443	49889	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.926882029 CEST	49889	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.927002907 CEST	49889	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.927031040 CEST	443	49889	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.997237921 CEST	443	49885	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.997313023 CEST	443	49885	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.997414112 CEST	443	49885	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.997493029 CEST	49885	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.997493982 CEST	49885	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.997736931 CEST	49885	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.997771025 CEST	443	49885	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:18.997798920 CEST	49885	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:18.997811079 CEST	443	49885	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:19.001019001 CEST	49890	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:19.001049995 CEST	443	49890	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:19.001143932 CEST	49890	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:19.001316071 CEST	49890	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:19.001333952 CEST	443	49890	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:19.177355051 CEST	49883	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:19.177382946 CEST	443	49883	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:19.346071005 CEST	443	49886	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:19.346698046 CEST	49886	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:19.346750021 CEST	443	49886	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:19.347121000 CEST	49886	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:19.347129107 CEST	443	49886	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:19.367022038 CEST	443	49887	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:19.367374897 CEST	49887	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:19.367398977 CEST	443	49887	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:19.367813110 CEST	49887	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:19.367816925 CEST	443	49887	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:19.447805882 CEST	443	49886	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:19.447983980 CEST	443	49886	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:19.448070049 CEST	49886	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:19.448149920 CEST	49886	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:19.448167086 CEST	443	49886	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:19.448188066 CEST	49886	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:19.448193073 CEST	443	49886	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:19.451061964 CEST	49891	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:19.451090097 CEST	443	49891	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:19.451173067 CEST	49891	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:19.451314926 CEST	49891	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:19.451339006 CEST	443	49891	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:19.472544909 CEST	443	49887	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:19.472687006 CEST	443	49887	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:19.472820997 CEST	49887	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:19.473093033 CEST	49887	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:19.473114014 CEST	443	49887	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:19.473309040 CEST	49887	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:19.473330021 CEST	443	49887	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:19.475187063 CEST	49892	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:19.475271940 CEST	443	49892	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:19.475364923 CEST	49892	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:19.475461960 CEST	49892	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:19.475481033 CEST	443	49892	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:19.526949883 CEST	443	49888	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:19.527523994 CEST	49888	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:19.527543068 CEST	443	49888	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:19.528100014 CEST	49888	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:19.528104067 CEST	443	49888	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:19.583538055 CEST	443	49889	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:19.583966970 CEST	49889	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:19.583987951 CEST	443	49889	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:19.584367990 CEST	49889	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:19.584372997 CEST	443	49889	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:19.630192995 CEST	443	49888	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:19.630331039 CEST	443	49888	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:19.630393028 CEST	49888	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:19.630537987 CEST	49888	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:19.630551100 CEST	443	49888	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:19.630561113 CEST	49888	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:19.630565882 CEST	443	49888	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:19.633405924 CEST	49893	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:19.633440018 CEST	443	49893	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:19.633522987 CEST	49893	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:19.633656025 CEST	49893	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:19.633665085 CEST	443	49893	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:19.710124016 CEST	443	49890	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:19.710792065 CEST	49890	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:19.710830927 CEST	443	49890	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:19.711236954 CEST	49890	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:19.711241007 CEST	443	49890	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:19.726070881 CEST	443	49889	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:19.726118088 CEST	443	49889	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:19.726175070 CEST	49889	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:19.726474047 CEST	49889	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:19.726488113 CEST	443	49889	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:19.726505041 CEST	49889	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:19.726510048 CEST	443	49889	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:19.729556084 CEST	49894	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:19.729614973 CEST	443	49894	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:19.729708910 CEST	49894	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:19.729857922 CEST	49894	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:19.729870081 CEST	443	49894	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:19.835335016 CEST	443	49890	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:19.835540056 CEST	443	49890	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:19.835613966 CEST	49890	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:19.835690975 CEST	49890	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:19.835716963 CEST	443	49890	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:19.835735083 CEST	49890	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:19.835740089 CEST	443	49890	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:19.838563919 CEST	49895	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:19.838608027 CEST	443	49895	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:19.838685036 CEST	49895	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:19.838820934 CEST	49895	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:19.838829994 CEST	443	49895	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:20.238195896 CEST	443	49891	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:20.238831043 CEST	49891	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:20.238858938 CEST	443	49891	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:20.239275932 CEST	49891	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:20.239281893 CEST	443	49891	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:20.339066029 CEST	443	49892	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:20.339205980 CEST	443	49891	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:20.339468956 CEST	443	49891	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:20.339525938 CEST	49892	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:20.339533091 CEST	49891	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:20.339560986 CEST	49891	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:20.339574099 CEST	443	49891	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:20.339585066 CEST	443	49892	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:20.339591980 CEST	49891	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:20.339596033 CEST	443	49891	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:20.340029001 CEST	49892	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:20.340044975 CEST	443	49892	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:20.342245102 CEST	49896	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:20.342344046 CEST	443	49896	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:20.342443943 CEST	49896	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:20.342562914 CEST	49896	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:20.342588902 CEST	443	49896	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:20.423541069 CEST	443	49893	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:20.424058914 CEST	49893	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:20.424074888 CEST	443	49893	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:20.424555063 CEST	49893	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:20.424560070 CEST	443	49893	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:20.434089899 CEST	443	49894	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:20.434550047 CEST	49894	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:20.434557915 CEST	443	49894	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:20.434954882 CEST	49894	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:20.434959888 CEST	443	49894	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:20.444323063 CEST	443	49892	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:20.444634914 CEST	443	49892	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:20.444704056 CEST	49892	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:20.444757938 CEST	49892	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:20.444757938 CEST	49892	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:20.444791079 CEST	443	49892	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:20.444813013 CEST	443	49892	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:20.448257923 CEST	49897	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:20.448278904 CEST	443	49897	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:20.448331118 CEST	49897	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:20.448421955 CEST	49897	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:20.448427916 CEST	443	49897	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:20.520845890 CEST	443	49895	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:20.521303892 CEST	49895	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:20.521320105 CEST	443	49895	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:20.521708965 CEST	49895	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:20.521718979 CEST	443	49895	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:20.550729990 CEST	443	49894	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:20.550875902 CEST	443	49894	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:20.550930977 CEST	49894	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:20.550965071 CEST	49894	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:20.550981045 CEST	443	49894	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:20.550988913 CEST	49894	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:20.550995111 CEST	443	49894	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:20.551732063 CEST	443	49893	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:20.551800966 CEST	443	49893	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:20.551845074 CEST	49893	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:20.551851988 CEST	443	49893	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:20.551899910 CEST	443	49893	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:20.551922083 CEST	49893	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:20.551930904 CEST	443	49893	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:20.551939964 CEST	49893	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:20.551943064 CEST	443	49893	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:20.551954985 CEST	49893	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:20.551958084 CEST	443	49893	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:20.553823948 CEST	49898	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:20.553843975 CEST	443	49898	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:20.553893089 CEST	49898	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:20.554166079 CEST	49898	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:20.554177046 CEST	443	49898	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:20.554717064 CEST	49899	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:20.554814100 CEST	443	49899	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:20.554888964 CEST	49899	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:20.554985046 CEST	49899	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:20.555007935 CEST	443	49899	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:20.623593092 CEST	443	49895	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:20.623728991 CEST	443	49895	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:20.623781919 CEST	49895	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:20.623816967 CEST	49895	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:20.623816967 CEST	49895	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:20.623835087 CEST	443	49895	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:20.623855114 CEST	443	49895	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:20.625576019 CEST	49900	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:20.625660896 CEST	443	49900	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:20.625734091 CEST	49900	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:20.625850916 CEST	49900	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:20.625874043 CEST	443	49900	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.062484026 CEST	443	49896	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.083133936 CEST	49896	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:21.083209038 CEST	443	49896	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.086536884 CEST	49896	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:21.086551905 CEST	443	49896	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.107218027 CEST	443	49897	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.110140085 CEST	49897	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:21.110150099 CEST	443	49897	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.110527992 CEST	49897	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:21.110532045 CEST	443	49897	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.192445993 CEST	443	49896	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.192595005 CEST	443	49896	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.192841053 CEST	49896	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:21.193254948 CEST	49896	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:21.193315029 CEST	443	49896	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.193350077 CEST	49896	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:21.193366051 CEST	443	49896	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.202203989 CEST	49901	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:21.202254057 CEST	443	49901	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.202562094 CEST	49901	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:21.202697992 CEST	49901	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:21.202724934 CEST	443	49901	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.206922054 CEST	443	49897	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.206979990 CEST	443	49897	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.207036972 CEST	49897	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:21.207046986 CEST	443	49897	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.207146883 CEST	443	49897	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.207196951 CEST	49897	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:21.207211971 CEST	49897	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:21.207218885 CEST	443	49897	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.207227945 CEST	49897	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:21.207231045 CEST	443	49897	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.212133884 CEST	49902	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:21.212162018 CEST	443	49902	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.212380886 CEST	49902	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:21.212480068 CEST	49902	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:21.212491989 CEST	443	49902	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.263941050 CEST	443	49898	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.264760971 CEST	443	49899	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.281086922 CEST	49898	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:21.281116009 CEST	443	49898	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.281423092 CEST	49898	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:21.281429052 CEST	443	49898	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.281752110 CEST	49899	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:21.281819105 CEST	443	49899	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.283601046 CEST	49899	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:21.283618927 CEST	443	49899	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.285265923 CEST	443	49900	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.285648108 CEST	49900	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:21.285708904 CEST	443	49900	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.286014080 CEST	49900	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:21.286029100 CEST	443	49900	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.377957106 CEST	443	49898	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.378485918 CEST	443	49898	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.378536940 CEST	49898	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:21.378545046 CEST	443	49898	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.378587008 CEST	443	49898	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.378623962 CEST	49898	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:21.378638983 CEST	443	49898	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.378648043 CEST	49898	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:21.378648043 CEST	49898	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:21.378654003 CEST	443	49898	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.378659964 CEST	443	49898	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.381386042 CEST	49903	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:21.381464958 CEST	443	49903	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.381555080 CEST	49903	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:21.381647110 CEST	49903	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:21.381659985 CEST	443	49903	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.383371115 CEST	443	49899	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.383459091 CEST	443	49899	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.383557081 CEST	443	49899	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.383651972 CEST	49899	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:21.383651972 CEST	49899	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:21.383651972 CEST	49899	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:21.383753061 CEST	49899	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:21.383791924 CEST	443	49899	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.385508060 CEST	49904	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:21.385540009 CEST	443	49904	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.385617018 CEST	49904	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:21.385724068 CEST	49904	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:21.385739088 CEST	443	49904	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.387685061 CEST	443	49900	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.387830019 CEST	443	49900	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.388333082 CEST	49900	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:21.388381004 CEST	49900	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:21.388381004 CEST	49900	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:21.388407946 CEST	443	49900	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.388432026 CEST	443	49900	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.390954971 CEST	49905	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:21.391038895 CEST	443	49905	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.391231060 CEST	49905	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:21.391443014 CEST	49905	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:21.391475916 CEST	443	49905	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.820799112 CEST	443	49902	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.823468924 CEST	49902	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:21.823497057 CEST	443	49902	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.824024916 CEST	49902	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:21.824037075 CEST	443	49902	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.909879923 CEST	443	49901	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.910454035 CEST	49901	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:21.910482883 CEST	443	49901	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.910918951 CEST	49901	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:21.910929918 CEST	443	49901	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.920012951 CEST	443	49902	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.920481920 CEST	443	49902	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.920555115 CEST	49902	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:21.920602083 CEST	49902	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:21.920602083 CEST	49902	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:21.920631886 CEST	443	49902	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.920654058 CEST	443	49902	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.923219919 CEST	49906	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:21.923302889 CEST	443	49906	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:21.923418045 CEST	49906	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:21.923522949 CEST	49906	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:21.923546076 CEST	443	49906	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:22.011153936 CEST	443	49901	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:22.011218071 CEST	443	49901	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:22.011342049 CEST	443	49901	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:22.011461973 CEST	49901	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:22.011461973 CEST	49901	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:22.011549950 CEST	49901	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:22.011594057 CEST	443	49901	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:22.011653900 CEST	49901	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:22.011670113 CEST	443	49901	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:22.013664007 CEST	49907	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:22.013700962 CEST	443	49907	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:22.013768911 CEST	49907	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:22.013883114 CEST	49907	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:22.013887882 CEST	443	49907	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:22.247216940 CEST	443	49903	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:22.247672081 CEST	443	49905	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:22.247761965 CEST	443	49904	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:22.247879028 CEST	49903	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:22.247968912 CEST	443	49903	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:22.248177052 CEST	49905	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:22.248260021 CEST	443	49905	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:22.248358011 CEST	49903	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:22.248373985 CEST	443	49903	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:22.248440981 CEST	49905	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:22.248456001 CEST	443	49905	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:22.248642921 CEST	49904	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:22.248660088 CEST	443	49904	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:22.248939991 CEST	49904	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:22.248944998 CEST	443	49904	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:22.349006891 CEST	443	49903	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:22.349061012 CEST	443	49903	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:22.349204063 CEST	49903	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:22.349272966 CEST	443	49903	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:22.349701881 CEST	443	49903	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:22.349812031 CEST	49903	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:22.349880934 CEST	49903	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:22.349880934 CEST	49903	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:22.349916935 CEST	443	49903	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:22.349939108 CEST	443	49903	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:22.351774931 CEST	443	49904	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:22.352597952 CEST	443	49904	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:22.352675915 CEST	49904	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:22.352699041 CEST	443	49904	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:22.352698088 CEST	443	49905	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:22.352766037 CEST	443	49905	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:22.352807045 CEST	49904	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:22.352807045 CEST	49904	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:22.352807045 CEST	49904	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:22.352861881 CEST	443	49905	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:22.352989912 CEST	49908	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:22.353055954 CEST	49905	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:22.353056908 CEST	49905	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:22.353084087 CEST	443	49908	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:22.353146076 CEST	49905	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:22.353174925 CEST	49908	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:22.353190899 CEST	443	49905	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:22.353225946 CEST	49905	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:22.353241920 CEST	443	49905	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:22.353960991 CEST	49908	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:22.353998899 CEST	443	49908	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:22.355165958 CEST	49909	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:22.355190039 CEST	443	49909	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:22.355268002 CEST	49909	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:22.355370045 CEST	49909	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:22.355381012 CEST	443	49909	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:22.355396986 CEST	49910	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:22.355407000 CEST	443	49910	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:22.355460882 CEST	49910	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:22.355515003 CEST	49910	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:22.355523109 CEST	443	49910	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:22.583206892 CEST	443	49906	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:22.583786011 CEST	49906	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:22.583844900 CEST	443	49906	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:22.584259033 CEST	49906	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:22.584271908 CEST	443	49906	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:22.661693096 CEST	49904	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:22.661716938 CEST	443	49904	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:22.683677912 CEST	443	49906	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:22.683943987 CEST	443	49906	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:22.684024096 CEST	49906	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:22.684024096 CEST	49906	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:22.684094906 CEST	49906	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:22.684123039 CEST	443	49906	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:22.686645985 CEST	49911	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:22.686711073 CEST	443	49911	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:22.686913967 CEST	49911	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:22.687030077 CEST	49911	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:22.687047958 CEST	443	49911	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:22.874531031 CEST	443	49907	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:22.875200987 CEST	49907	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:22.875226021 CEST	443	49907	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:22.875653982 CEST	49907	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:22.875658989 CEST	443	49907	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:22.977304935 CEST	443	49907	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:22.977377892 CEST	443	49907	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:22.977631092 CEST	49907	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:22.977686882 CEST	49907	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:22.977705956 CEST	443	49907	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:22.977741003 CEST	49907	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:22.977745056 CEST	443	49907	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:22.980418921 CEST	49912	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:22.980453014 CEST	443	49912	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:22.980650902 CEST	49912	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:22.980650902 CEST	49912	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:22.980715036 CEST	443	49912	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.033520937 CEST	443	49909	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.034020901 CEST	49909	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.034040928 CEST	443	49909	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.034379005 CEST	49909	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.034398079 CEST	443	49909	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.048765898 CEST	443	49908	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.049374104 CEST	49908	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.049438000 CEST	443	49908	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.049581051 CEST	49908	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.049597979 CEST	443	49908	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.057957888 CEST	443	49910	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.058229923 CEST	49910	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.058249950 CEST	443	49910	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.058507919 CEST	49910	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.058514118 CEST	443	49910	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.136349916 CEST	443	49909	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.136425972 CEST	443	49909	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.136524916 CEST	443	49909	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.136677027 CEST	49909	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.136677027 CEST	49909	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.136677027 CEST	49909	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.139308929 CEST	49913	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.139409065 CEST	443	49913	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.139514923 CEST	49913	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.139672995 CEST	49913	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.139692068 CEST	443	49913	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.153686047 CEST	443	49908	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.153832912 CEST	443	49908	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.153908968 CEST	49908	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.153971910 CEST	49908	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.153971910 CEST	49908	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.154007912 CEST	443	49908	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.154030085 CEST	443	49908	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.156682968 CEST	49914	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.156774044 CEST	443	49914	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.156908035 CEST	49914	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.157006025 CEST	49914	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.157026052 CEST	443	49914	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.162601948 CEST	443	49910	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.162754059 CEST	443	49910	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.162910938 CEST	49910	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.163125038 CEST	49910	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.163146019 CEST	443	49910	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.163310051 CEST	49910	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.163331032 CEST	443	49910	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.164860010 CEST	49915	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.164947033 CEST	443	49915	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.165030003 CEST	49915	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.165122032 CEST	49915	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.165141106 CEST	443	49915	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.367326021 CEST	443	49911	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.367952108 CEST	49911	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.368041039 CEST	443	49911	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.368504047 CEST	49911	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.368518114 CEST	443	49911	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.442948103 CEST	49909	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.442964077 CEST	443	49909	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.466850996 CEST	443	49911	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.466912985 CEST	443	49911	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.467006922 CEST	443	49911	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.467048883 CEST	49911	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.467091084 CEST	49911	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.467490911 CEST	49911	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.467530966 CEST	443	49911	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.467557907 CEST	49911	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.467572927 CEST	443	49911	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.471738100 CEST	49916	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.471770048 CEST	443	49916	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.471834898 CEST	49916	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.472348928 CEST	49916	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.472364902 CEST	443	49916	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.631587029 CEST	443	49912	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.677455902 CEST	49912	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.740726948 CEST	49912	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.740782022 CEST	443	49912	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.746824026 CEST	49912	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.746877909 CEST	443	49912	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.797506094 CEST	443	49914	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.804775953 CEST	443	49913	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.805754900 CEST	443	49915	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.820700884 CEST	49914	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.820786953 CEST	443	49914	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.821140051 CEST	49914	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.821156025 CEST	443	49914	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.821480989 CEST	49913	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.821518898 CEST	443	49913	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.821923018 CEST	49913	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.821933985 CEST	443	49913	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.822137117 CEST	49915	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.822189093 CEST	443	49915	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.822427988 CEST	49915	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.822443008 CEST	443	49915	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.843422890 CEST	443	49912	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.843585014 CEST	443	49912	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.843847990 CEST	49912	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.844120026 CEST	49912	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.844151974 CEST	443	49912	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.844181061 CEST	49912	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.844194889 CEST	443	49912	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.853612900 CEST	49917	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.853723049 CEST	443	49917	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.853810072 CEST	49917	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.853929043 CEST	49917	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.853950024 CEST	443	49917	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.916990042 CEST	443	49914	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.917164087 CEST	443	49914	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.917251110 CEST	49914	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.917682886 CEST	443	49915	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.917865038 CEST	443	49915	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.918601990 CEST	49915	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.919842958 CEST	49914	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.919872046 CEST	443	49914	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.919884920 CEST	49914	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.919893026 CEST	443	49914	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.920967102 CEST	443	49913	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.921077967 CEST	443	49913	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.921134949 CEST	49913	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.921147108 CEST	443	49913	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.921202898 CEST	443	49913	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.921442032 CEST	49913	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.922528982 CEST	49913	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.922538042 CEST	443	49913	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.922548056 CEST	49913	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.922553062 CEST	443	49913	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.925944090 CEST	49915	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.925980091 CEST	443	49915	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.926007986 CEST	49915	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.926023960 CEST	443	49915	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.939676046 CEST	49918	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.939780951 CEST	443	49918	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.939868927 CEST	49918	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.943861961 CEST	49918	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.943902016 CEST	443	49918	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.944904089 CEST	49919	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.944935083 CEST	443	49919	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.945004940 CEST	49919	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.945096016 CEST	49919	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.945103884 CEST	443	49919	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.945616007 CEST	49920	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.945642948 CEST	443	49920	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:23.945718050 CEST	49920	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.945830107 CEST	49920	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:23.945847034 CEST	443	49920	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:24.140068054 CEST	443	49916	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:24.140664101 CEST	49916	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:24.140692949 CEST	443	49916	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:24.141124010 CEST	49916	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:24.141134024 CEST	443	49916	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:24.242626905 CEST	443	49916	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:24.242779016 CEST	443	49916	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:24.242954969 CEST	49916	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:24.243029118 CEST	49916	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:24.243050098 CEST	443	49916	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:24.243066072 CEST	49916	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:24.243072987 CEST	443	49916	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:24.246273041 CEST	49921	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:24.246315002 CEST	443	49921	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:24.246546030 CEST	49921	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:24.246613979 CEST	49921	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:24.246629000 CEST	443	49921	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:24.536034107 CEST	443	49917	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:24.536669970 CEST	49917	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:24.536773920 CEST	443	49917	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:24.537302017 CEST	49917	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:24.537317991 CEST	443	49917	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:24.605308056 CEST	443	49920	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:24.605917931 CEST	49920	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:24.605979919 CEST	443	49920	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:24.606379986 CEST	49920	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:24.606395006 CEST	443	49920	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:24.607212067 CEST	443	49919	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:24.607453108 CEST	49919	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:24.607470989 CEST	443	49919	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:24.607757092 CEST	49919	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:24.607764006 CEST	443	49919	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:24.612519026 CEST	443	49918	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:24.613080025 CEST	49918	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:24.613147020 CEST	443	49918	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:24.613229036 CEST	49918	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:24.613245964 CEST	443	49918	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:24.640839100 CEST	443	49917	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:24.640993118 CEST	443	49917	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:24.641181946 CEST	49917	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:24.641273975 CEST	49917	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:24.641273975 CEST	49917	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:24.641319036 CEST	443	49917	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:24.641350031 CEST	443	49917	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:24.644207954 CEST	49922	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:24.644237995 CEST	443	49922	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:24.644325018 CEST	49922	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:24.644473076 CEST	49922	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:24.644479990 CEST	443	49922	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:24.705730915 CEST	443	49920	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:24.705893040 CEST	443	49920	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:24.705972910 CEST	49920	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:24.706044912 CEST	49920	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:24.706044912 CEST	49920	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:24.706079960 CEST	443	49920	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:24.706103086 CEST	443	49920	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:24.707758904 CEST	49923	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:24.707808018 CEST	443	49923	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:24.707880974 CEST	49923	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:24.707984924 CEST	49923	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:24.707999945 CEST	443	49923	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:24.711410046 CEST	443	49919	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:24.711505890 CEST	443	49919	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:24.711555958 CEST	443	49919	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:24.711561918 CEST	49919	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:24.711626053 CEST	49919	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:24.711668015 CEST	49919	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:24.711688042 CEST	443	49919	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:24.711702108 CEST	49919	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:24.711709023 CEST	443	49919	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:24.713326931 CEST	49924	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:24.713422060 CEST	443	49924	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:24.713561058 CEST	49924	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:24.713661909 CEST	49924	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:24.713682890 CEST	443	49924	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:24.715164900 CEST	443	49918	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:24.715318918 CEST	443	49918	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:24.715384007 CEST	49918	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:24.715452909 CEST	49918	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:24.715452909 CEST	49918	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:24.715476990 CEST	443	49918	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:24.715498924 CEST	443	49918	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:24.717025995 CEST	49925	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:24.717047930 CEST	443	49925	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:24.717120886 CEST	49925	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:24.717219114 CEST	49925	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:24.717226982 CEST	443	49925	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:24.926091909 CEST	443	49921	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:24.926800013 CEST	49921	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:24.926841974 CEST	443	49921	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:24.927325010 CEST	49921	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:24.927339077 CEST	443	49921	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:25.031152964 CEST	443	49921	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:25.031219959 CEST	443	49921	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:25.031321049 CEST	443	49921	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:25.031466007 CEST	49921	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:25.031466007 CEST	49921	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:25.031586885 CEST	49921	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:25.031586885 CEST	49921	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:25.031627893 CEST	443	49921	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:25.031658888 CEST	443	49921	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:25.034687042 CEST	49926	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:25.034729004 CEST	443	49926	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:25.034910917 CEST	49926	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:25.034969091 CEST	49926	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:25.034982920 CEST	443	49926	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:25.344839096 CEST	443	49922	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:25.345587969 CEST	49922	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:25.345630884 CEST	443	49922	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:25.346004963 CEST	49922	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:25.346018076 CEST	443	49922	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:25.444056988 CEST	443	49922	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:25.444284916 CEST	443	49922	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:25.444355965 CEST	49922	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:25.444427967 CEST	49922	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:25.444427967 CEST	49922	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:25.444461107 CEST	443	49922	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:25.444489002 CEST	443	49922	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:25.447351933 CEST	49927	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:25.447451115 CEST	443	49927	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:25.447588921 CEST	49927	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:25.447706938 CEST	49927	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:25.447727919 CEST	443	49927	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:25.526659966 CEST	443	49924	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:25.527209997 CEST	49924	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:25.527296066 CEST	443	49924	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:25.527503967 CEST	49924	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:25.527520895 CEST	443	49924	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:25.538409948 CEST	443	49925	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:25.538753986 CEST	443	49923	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:25.538794994 CEST	49925	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:25.538822889 CEST	443	49925	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:25.539025068 CEST	49923	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:25.539104939 CEST	443	49923	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:25.539181948 CEST	49925	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:25.539189100 CEST	443	49925	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:25.539500952 CEST	49923	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:25.539518118 CEST	443	49923	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:25.627104044 CEST	443	49924	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:25.627249002 CEST	443	49924	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:25.627500057 CEST	49924	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:25.627500057 CEST	49924	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:25.627500057 CEST	49924	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:25.630789042 CEST	49928	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:25.630872965 CEST	443	49928	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:25.631026030 CEST	49928	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:25.631201029 CEST	49928	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:25.631221056 CEST	443	49928	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:25.641618013 CEST	443	49925	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:25.641685963 CEST	443	49925	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:25.641756058 CEST	49925	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:25.641773939 CEST	443	49925	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:25.641796112 CEST	443	49925	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:25.641844034 CEST	49925	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:25.641932964 CEST	49925	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:25.641932964 CEST	49925	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:25.641947031 CEST	443	49925	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:25.641957045 CEST	443	49925	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:25.644154072 CEST	49929	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:25.644186020 CEST	443	49929	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:25.644262075 CEST	49929	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:25.644398928 CEST	49929	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:25.644416094 CEST	443	49929	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:25.644644976 CEST	443	49923	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:25.644680977 CEST	443	49923	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:25.644745111 CEST	49923	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:25.644795895 CEST	443	49923	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:25.644823074 CEST	443	49923	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:25.644829035 CEST	49923	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:25.644829035 CEST	49923	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:25.644882917 CEST	443	49923	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:25.644913912 CEST	49923	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:25.644929886 CEST	443	49923	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:25.646682024 CEST	49930	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:25.646689892 CEST	443	49930	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:25.646754026 CEST	49930	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:25.646859884 CEST	49930	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:25.646872997 CEST	443	49930	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:25.715121984 CEST	443	49926	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:25.715537071 CEST	49926	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:25.715548992 CEST	443	49926	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:25.715943098 CEST	49926	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:25.715949059 CEST	443	49926	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:25.820583105 CEST	443	49926	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:25.820724964 CEST	443	49926	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:25.820795059 CEST	49926	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:25.820945978 CEST	49926	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:25.820964098 CEST	443	49926	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:25.820979118 CEST	49926	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:25.820985079 CEST	443	49926	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:25.822938919 CEST	49931	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:25.823024035 CEST	443	49931	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:25.823108912 CEST	49931	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:25.823225975 CEST	49931	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:25.823245049 CEST	443	49931	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:25.943111897 CEST	49924	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:25.943181992 CEST	443	49924	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:26.094018936 CEST	443	49927	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:26.094798088 CEST	49927	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:26.094863892 CEST	443	49927	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:26.095146894 CEST	49927	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:26.095164061 CEST	443	49927	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:26.194994926 CEST	443	49927	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:26.195009947 CEST	443	49927	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:26.195219040 CEST	443	49927	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:26.195240021 CEST	49927	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:26.195339918 CEST	49927	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:26.222760916 CEST	49927	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:26.222762108 CEST	49927	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:26.222816944 CEST	443	49927	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:26.222835064 CEST	443	49927	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:26.225883007 CEST	49932	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:26.225903988 CEST	443	49932	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:26.225971937 CEST	49932	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:26.226102114 CEST	49932	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:26.226106882 CEST	443	49932	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:26.267106056 CEST	443	49928	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:26.271985054 CEST	49928	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:26.272063971 CEST	443	49928	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:26.272499084 CEST	49928	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:26.272511959 CEST	443	49928	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:26.289433956 CEST	443	49929	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:26.292558908 CEST	49929	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:26.292574883 CEST	443	49929	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:26.295840025 CEST	49929	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:26.295844078 CEST	443	49929	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:26.302719116 CEST	443	49930	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:26.304794073 CEST	49930	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:26.304806948 CEST	443	49930	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:26.308046103 CEST	49930	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:26.308049917 CEST	443	49930	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:26.367836952 CEST	443	49928	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:26.367894888 CEST	443	49928	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:26.367964983 CEST	49928	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:26.368026018 CEST	443	49928	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:26.368067980 CEST	443	49928	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:26.368124008 CEST	49928	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:26.393034935 CEST	443	49929	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:26.393158913 CEST	443	49929	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:26.393238068 CEST	49929	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:26.393260956 CEST	443	49929	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:26.393280983 CEST	443	49929	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:26.393327951 CEST	49929	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:26.396492958 CEST	49928	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:26.396492958 CEST	49928	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:26.396560907 CEST	443	49928	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:26.396596909 CEST	443	49928	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:26.405278921 CEST	443	49930	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:26.405455112 CEST	443	49930	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:26.405518055 CEST	49930	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:26.413700104 CEST	49929	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:26.413717985 CEST	443	49929	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:26.413742065 CEST	49929	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:26.413747072 CEST	443	49929	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:26.418637037 CEST	49930	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:26.418642044 CEST	443	49930	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:26.418649912 CEST	49930	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:26.418653965 CEST	443	49930	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:26.422924042 CEST	49933	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:26.423029900 CEST	443	49933	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:26.423101902 CEST	49933	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:26.424639940 CEST	49934	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:26.424662113 CEST	443	49934	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:26.424721956 CEST	49934	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:26.425194979 CEST	49933	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:26.425230026 CEST	443	49933	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:26.425266027 CEST	49934	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:26.425292969 CEST	443	49934	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:26.426502943 CEST	49935	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:26.426532984 CEST	443	49935	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:26.426580906 CEST	49935	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:26.427894115 CEST	49935	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:26.427906036 CEST	443	49935	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:26.463238001 CEST	443	49931	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:26.465976954 CEST	49931	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:26.466053009 CEST	443	49931	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:26.466526985 CEST	49931	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:26.466541052 CEST	443	49931	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:26.562077999 CEST	443	49931	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:26.562143087 CEST	443	49931	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:26.562211037 CEST	49931	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:26.562232018 CEST	443	49931	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:26.562308073 CEST	49931	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:26.562381029 CEST	49931	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:26.562424898 CEST	443	49931	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:26.562458992 CEST	49931	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:26.562474966 CEST	443	49931	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:26.564595938 CEST	49936	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:26.564625025 CEST	443	49936	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:26.564706087 CEST	49936	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:26.564831018 CEST	49936	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:26.564836025 CEST	443	49936	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:26.873276949 CEST	443	49932	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:26.873836994 CEST	49932	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:26.873847008 CEST	443	49932	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:26.874320030 CEST	49932	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:26.874324083 CEST	443	49932	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:26.975331068 CEST	443	49932	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:26.975766897 CEST	443	49932	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:26.975883961 CEST	49932	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:26.975902081 CEST	49932	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:26.975902081 CEST	49932	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:26.975910902 CEST	443	49932	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:26.975917101 CEST	443	49932	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:26.978784084 CEST	49937	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:26.978888988 CEST	443	49937	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:26.978991032 CEST	49937	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:26.979120970 CEST	49937	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:26.979141951 CEST	443	49937	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:27.065217018 CEST	443	49933	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:27.066416025 CEST	443	49935	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:27.067662001 CEST	49933	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:27.067713976 CEST	443	49933	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:27.068329096 CEST	49933	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:27.068337917 CEST	443	49933	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:27.068551064 CEST	49935	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:27.068561077 CEST	443	49935	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:27.069047928 CEST	49935	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:27.069051981 CEST	443	49935	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:27.073838949 CEST	443	49934	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:27.074579954 CEST	49934	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:27.074592113 CEST	443	49934	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:27.074903965 CEST	49934	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:27.074911118 CEST	443	49934	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:27.182228088 CEST	443	49936	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:27.182790995 CEST	49936	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:27.182820082 CEST	443	49936	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:27.182935953 CEST	49936	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:27.182945013 CEST	443	49936	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:27.186626911 CEST	443	49935	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:27.186702967 CEST	443	49935	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:27.186757088 CEST	49935	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:27.186775923 CEST	443	49935	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:27.186810017 CEST	443	49933	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:27.186820030 CEST	443	49935	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:27.186856985 CEST	443	49933	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:27.186871052 CEST	49935	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:27.186887980 CEST	49935	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:27.186894894 CEST	443	49935	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:27.186916113 CEST	49933	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:27.186929941 CEST	49935	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:27.186929941 CEST	443	49933	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:27.186933994 CEST	443	49935	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:27.187017918 CEST	443	49933	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:27.187057972 CEST	49933	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:27.187057972 CEST	49933	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:27.187367916 CEST	49933	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:27.187381029 CEST	443	49933	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:27.188275099 CEST	443	49934	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:27.188514948 CEST	443	49934	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:27.188566923 CEST	49934	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:27.189466953 CEST	49934	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:27.189471960 CEST	443	49934	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:27.189486980 CEST	49934	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:27.189492941 CEST	443	49934	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:27.189726114 CEST	49938	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:27.189739943 CEST	49939	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:27.189769030 CEST	443	49939	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:27.189821005 CEST	443	49938	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:27.189824104 CEST	49939	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:27.189882994 CEST	49938	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:27.189924955 CEST	49939	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:27.189933062 CEST	443	49939	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:27.190002918 CEST	49938	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:27.190022945 CEST	443	49938	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:27.191411972 CEST	49940	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:27.191443920 CEST	443	49940	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:27.191499949 CEST	49940	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:27.191597939 CEST	49940	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:27.191606998 CEST	443	49940	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:27.281465054 CEST	443	49936	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:27.281636000 CEST	443	49936	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:27.281821012 CEST	49936	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:27.281964064 CEST	49936	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:27.281985998 CEST	443	49936	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:27.282001972 CEST	49936	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:27.282008886 CEST	443	49936	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:27.284805059 CEST	49941	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:27.284864902 CEST	443	49941	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:27.284970999 CEST	49941	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:27.285118103 CEST	49941	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:27.285125971 CEST	443	49941	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:27.975946903 CEST	443	49937	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:27.976694107 CEST	49937	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:27.976766109 CEST	443	49937	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:27.977159023 CEST	49937	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:27.977174997 CEST	443	49937	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:27.979077101 CEST	443	49939	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:27.979382038 CEST	49939	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:27.979429007 CEST	443	49939	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:27.979633093 CEST	49939	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:27.979644060 CEST	443	49939	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:27.982698917 CEST	443	49941	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:27.982829094 CEST	443	49938	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:27.982935905 CEST	49941	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:27.983007908 CEST	443	49941	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:27.983064890 CEST	49938	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:27.983081102 CEST	443	49938	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:27.983212948 CEST	49941	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:27.983227015 CEST	443	49941	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:27.983525991 CEST	49938	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:27.983536959 CEST	443	49938	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:27.989448071 CEST	443	49940	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:27.989727974 CEST	49940	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:27.989758015 CEST	443	49940	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:27.990051031 CEST	49940	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:27.990058899 CEST	443	49940	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.080070019 CEST	443	49937	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.080089092 CEST	443	49937	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.080112934 CEST	443	49937	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.080147028 CEST	49937	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.080189943 CEST	49937	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.080374956 CEST	49937	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.080414057 CEST	443	49937	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.080445051 CEST	49937	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.080459118 CEST	443	49937	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.080641031 CEST	443	49941	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.081139088 CEST	443	49941	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.081149101 CEST	443	49939	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.081204891 CEST	49941	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.081291914 CEST	49941	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.081331968 CEST	443	49941	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.081337929 CEST	443	49939	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.081366062 CEST	49941	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.081382036 CEST	443	49941	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.081382990 CEST	49939	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.081552029 CEST	49939	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.081566095 CEST	443	49939	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.081581116 CEST	49939	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.081587076 CEST	443	49939	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.083830118 CEST	49942	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.083872080 CEST	49943	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.083878994 CEST	443	49942	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.083909035 CEST	443	49943	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.083946943 CEST	49942	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.083970070 CEST	49943	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.084062099 CEST	49942	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.084079981 CEST	443	49942	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.084131002 CEST	49943	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.084140062 CEST	443	49943	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.084453106 CEST	49944	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.084536076 CEST	443	49944	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.084608078 CEST	49944	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.084721088 CEST	49944	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.084744930 CEST	443	49944	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.085876942 CEST	443	49938	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.086628914 CEST	443	49938	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.086693048 CEST	49938	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.086734056 CEST	49938	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.086734056 CEST	49938	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.086752892 CEST	443	49938	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.086772919 CEST	443	49938	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.088402033 CEST	49945	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.088418961 CEST	443	49945	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.088484049 CEST	49945	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.088594913 CEST	49945	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.088604927 CEST	443	49945	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.093287945 CEST	443	49940	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.093358994 CEST	443	49940	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.093416929 CEST	49940	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.093431950 CEST	443	49940	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.093467951 CEST	443	49940	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.093508959 CEST	49940	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.093508959 CEST	49940	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.093525887 CEST	443	49940	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.093542099 CEST	49940	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.093547106 CEST	443	49940	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.095299959 CEST	49946	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.095308065 CEST	443	49946	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.095375061 CEST	49946	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.095484018 CEST	49946	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.095490932 CEST	443	49946	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.720334053 CEST	443	49942	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.720921040 CEST	49942	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.720998049 CEST	443	49942	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.721482992 CEST	49942	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.721497059 CEST	443	49942	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.724462032 CEST	443	49943	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.724948883 CEST	49943	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.725033045 CEST	443	49943	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.725282907 CEST	49943	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.725337029 CEST	443	49943	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.737082958 CEST	443	49945	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.737442017 CEST	49945	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.737461090 CEST	443	49945	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.737766981 CEST	49945	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.737771988 CEST	443	49945	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.743563890 CEST	443	49946	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.743872881 CEST	49946	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.743894100 CEST	443	49946	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.744072914 CEST	49946	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.744080067 CEST	443	49946	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.756736994 CEST	443	49944	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.757087946 CEST	49944	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.757173061 CEST	443	49944	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.757318020 CEST	49944	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.757333040 CEST	443	49944	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.819710016 CEST	443	49942	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.819999933 CEST	443	49942	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.820048094 CEST	443	49942	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.820055008 CEST	49942	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.820102930 CEST	49942	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.822328091 CEST	49942	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.822371006 CEST	443	49942	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.822416067 CEST	49942	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.822431087 CEST	443	49942	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.823223114 CEST	443	49943	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.823354959 CEST	443	49943	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.823537111 CEST	49943	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.823864937 CEST	49943	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.823864937 CEST	49943	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.823931932 CEST	443	49943	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.823967934 CEST	443	49943	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.826981068 CEST	49947	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.827059031 CEST	443	49947	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.827181101 CEST	49947	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.827706099 CEST	49947	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.827738047 CEST	443	49947	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.830935001 CEST	49948	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.830976963 CEST	443	49948	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.831032991 CEST	49948	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.831132889 CEST	49948	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.831145048 CEST	443	49948	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.838221073 CEST	443	49945	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.838289976 CEST	443	49945	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.838336945 CEST	49945	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.838350058 CEST	443	49945	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.838390112 CEST	443	49945	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.838433027 CEST	49945	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.838578939 CEST	49945	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.838587999 CEST	443	49945	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.838598013 CEST	49945	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.838602066 CEST	443	49945	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.840502024 CEST	49949	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.840586901 CEST	443	49949	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.840663910 CEST	49949	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.840754986 CEST	49949	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.840779066 CEST	443	49949	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.844830990 CEST	443	49946	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.845005989 CEST	443	49946	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.845851898 CEST	49946	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.845962048 CEST	49946	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.845964909 CEST	443	49946	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.845973969 CEST	49946	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.845977068 CEST	443	49946	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.847620964 CEST	49950	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.847645044 CEST	443	49950	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.847721100 CEST	49950	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.847806931 CEST	49950	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.847820044 CEST	443	49950	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.862034082 CEST	443	49944	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.862214088 CEST	443	49944	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.862278938 CEST	49944	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.862278938 CEST	49944	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.862322092 CEST	49944	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.862340927 CEST	443	49944	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.864026070 CEST	49951	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.864041090 CEST	443	49951	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:28.864099026 CEST	49951	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.864308119 CEST	49951	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:28.864322901 CEST	443	49951	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:29.460727930 CEST	443	49947	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:29.461234093 CEST	49947	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:29.461297035 CEST	443	49947	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:29.461970091 CEST	49947	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:29.461983919 CEST	443	49947	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:29.487638950 CEST	443	49948	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:29.488137007 CEST	49948	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:29.488172054 CEST	443	49948	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:29.488620996 CEST	49948	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:29.488630056 CEST	443	49948	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:29.490163088 CEST	443	49950	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:29.490513086 CEST	49950	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:29.490571976 CEST	443	49950	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:29.490897894 CEST	49950	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:29.490911961 CEST	443	49950	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:29.492883921 CEST	443	49949	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:29.493194103 CEST	49949	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:29.493223906 CEST	443	49949	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:29.493550062 CEST	49949	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:29.493561029 CEST	443	49949	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:29.524321079 CEST	443	49951	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:29.524585009 CEST	49951	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:29.524595976 CEST	443	49951	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:29.524996996 CEST	49951	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:29.525002003 CEST	443	49951	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:29.559516907 CEST	443	49947	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:29.559766054 CEST	443	49947	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:29.559843063 CEST	49947	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:29.559899092 CEST	49947	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:29.559899092 CEST	49947	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:29.559935093 CEST	443	49947	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:29.559957981 CEST	443	49947	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:29.562469959 CEST	49952	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:29.562506914 CEST	443	49952	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:29.562561989 CEST	49952	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:29.562669039 CEST	49952	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:29.562694073 CEST	443	49952	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:29.587466955 CEST	443	49948	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:29.587539911 CEST	443	49948	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:29.587598085 CEST	49948	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:29.587615013 CEST	443	49948	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:29.587650061 CEST	443	49948	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:29.587707996 CEST	49948	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:29.587763071 CEST	49948	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:29.587779999 CEST	443	49948	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:29.587793112 CEST	49948	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:29.587800980 CEST	443	49948	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:29.588148117 CEST	443	49950	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:29.588321924 CEST	443	49950	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:29.588397980 CEST	49950	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:29.588736057 CEST	49950	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:29.588736057 CEST	49950	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:29.588779926 CEST	443	49950	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:29.588809013 CEST	443	49950	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:29.590356112 CEST	49953	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:29.590399027 CEST	443	49953	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:29.590477943 CEST	49953	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:29.590531111 CEST	49954	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:29.590548992 CEST	443	49954	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:29.590611935 CEST	49954	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:29.590657949 CEST	49953	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:29.590683937 CEST	443	49953	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:29.590737104 CEST	49954	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:29.590760946 CEST	443	49954	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:29.598429918 CEST	443	49949	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:29.598615885 CEST	443	49949	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:29.598687887 CEST	49949	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:29.598721027 CEST	49949	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:29.598721027 CEST	49949	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:29.598736048 CEST	443	49949	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:29.598756075 CEST	443	49949	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:29.600498915 CEST	49955	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:29.600522041 CEST	443	49955	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:29.600594044 CEST	49955	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:29.600673914 CEST	49955	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:29.600689888 CEST	443	49955	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:29.627437115 CEST	443	49951	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:29.627561092 CEST	443	49951	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:29.627599001 CEST	443	49951	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:29.627613068 CEST	49951	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:29.627635002 CEST	49951	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:29.627696991 CEST	49951	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:29.627713919 CEST	443	49951	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:29.627738953 CEST	49951	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:29.627744913 CEST	443	49951	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:29.629384995 CEST	49956	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:29.629441023 CEST	443	49956	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:29.629512072 CEST	49956	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:29.629612923 CEST	49956	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:29.629645109 CEST	443	49956	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:30.209841967 CEST	443	49952	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:30.210634947 CEST	49952	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:30.210652113 CEST	443	49952	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:30.211059093 CEST	49952	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:30.211065054 CEST	443	49952	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:30.254523993 CEST	443	49953	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:30.255045891 CEST	49953	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:30.255105972 CEST	443	49953	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:30.255322933 CEST	49953	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:30.255337954 CEST	443	49953	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:30.261573076 CEST	443	49954	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:30.261957884 CEST	49954	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:30.262018919 CEST	443	49954	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:30.262156010 CEST	49954	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:30.262171984 CEST	443	49954	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:30.275851965 CEST	443	49955	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:30.276156902 CEST	49955	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:30.276175022 CEST	443	49955	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:30.276458979 CEST	49955	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:30.276465893 CEST	443	49955	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:30.309415102 CEST	443	49952	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:30.309674025 CEST	443	49952	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:30.309747934 CEST	49952	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:30.309786081 CEST	49952	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:30.309786081 CEST	49952	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:30.309808016 CEST	443	49952	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:30.309820890 CEST	443	49952	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:30.312186956 CEST	49957	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:30.312216997 CEST	443	49957	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:30.312395096 CEST	49957	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:30.312447071 CEST	49957	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:30.312457085 CEST	443	49957	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:30.318892002 CEST	443	49956	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:30.319200039 CEST	49956	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:30.319245100 CEST	443	49956	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:30.319535017 CEST	49956	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:30.319549084 CEST	443	49956	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:30.353605986 CEST	443	49953	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:30.353909969 CEST	443	49953	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:30.354010105 CEST	443	49953	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:30.354007959 CEST	49953	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:30.354089022 CEST	49953	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:30.354134083 CEST	49953	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:30.354176044 CEST	443	49953	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:30.354206085 CEST	49953	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:30.354221106 CEST	443	49953	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:30.356812954 CEST	49958	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:30.356852055 CEST	443	49958	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:30.356931925 CEST	49958	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:30.357058048 CEST	49958	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:30.357068062 CEST	443	49958	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:30.365051031 CEST	443	49954	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:30.365190983 CEST	443	49954	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:30.365257978 CEST	49954	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:30.365291119 CEST	49954	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:30.365291119 CEST	49954	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:30.365307093 CEST	443	49954	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:30.365325928 CEST	443	49954	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:30.366944075 CEST	49959	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:30.367016077 CEST	443	49959	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:30.367090940 CEST	49959	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:30.367193937 CEST	49959	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:30.367208958 CEST	443	49959	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:30.378134012 CEST	443	49955	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:30.378282070 CEST	443	49955	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:30.378371000 CEST	49955	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:30.378405094 CEST	49955	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:30.378423929 CEST	443	49955	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:30.378437042 CEST	49955	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:30.378446102 CEST	443	49955	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:30.379930019 CEST	49960	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:30.379959106 CEST	443	49960	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:30.380024910 CEST	49960	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:30.380124092 CEST	49960	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:30.380135059 CEST	443	49960	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:30.424088001 CEST	443	49956	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:30.424170017 CEST	443	49956	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:30.424225092 CEST	49956	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:30.424318075 CEST	49956	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:30.424318075 CEST	49956	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:30.424331903 CEST	443	49956	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:30.424341917 CEST	443	49956	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:30.426038027 CEST	49961	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:30.426083088 CEST	443	49961	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:30.426160097 CEST	49961	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:30.426259995 CEST	49961	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:30.426279068 CEST	443	49961	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:30.975276947 CEST	443	49957	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:30.975963116 CEST	49957	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:30.975991011 CEST	443	49957	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:30.976421118 CEST	49957	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:30.976428032 CEST	443	49957	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.008586884 CEST	443	49959	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.009030104 CEST	49959	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.009093046 CEST	443	49959	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.009372950 CEST	49959	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.009392977 CEST	443	49959	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.011363029 CEST	443	49958	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.011610985 CEST	49958	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.011621952 CEST	443	49958	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.011888981 CEST	49958	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.011894941 CEST	443	49958	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.021595001 CEST	443	49960	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.021893978 CEST	49960	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.021929979 CEST	443	49960	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.022151947 CEST	49960	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.022166967 CEST	443	49960	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.078524113 CEST	443	49957	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.078650951 CEST	443	49957	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.078696966 CEST	443	49957	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.078705072 CEST	49957	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.078752041 CEST	49957	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.078908920 CEST	49957	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.078923941 CEST	443	49957	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.078937054 CEST	49957	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.078943014 CEST	443	49957	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.081928968 CEST	49962	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.082034111 CEST	443	49962	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.082133055 CEST	49962	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.082263947 CEST	49962	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.082285881 CEST	443	49962	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.091557980 CEST	443	49961	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.091917038 CEST	49961	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.091938019 CEST	443	49961	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.092349052 CEST	49961	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.092365980 CEST	443	49961	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.134006977 CEST	443	49959	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.134044886 CEST	443	49959	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.134090900 CEST	443	49959	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.134105921 CEST	49959	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.134157896 CEST	49959	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.134356022 CEST	49959	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.134397030 CEST	443	49959	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.134424925 CEST	49959	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.134440899 CEST	443	49959	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.136873007 CEST	49963	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.136957884 CEST	443	49963	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.137046099 CEST	49963	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.137161970 CEST	49963	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.137181044 CEST	443	49963	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.138688087 CEST	443	49958	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.139288902 CEST	443	49958	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.139343977 CEST	49958	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.139411926 CEST	49958	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.139411926 CEST	49958	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.139425993 CEST	443	49958	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.139437914 CEST	443	49958	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.141443968 CEST	49964	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.141470909 CEST	443	49964	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.141537905 CEST	49964	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.141805887 CEST	49964	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.141820908 CEST	443	49964	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.150505066 CEST	443	49960	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.151186943 CEST	443	49960	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.151261091 CEST	49960	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.151304007 CEST	49960	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.151304007 CEST	49960	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.151328087 CEST	443	49960	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.151357889 CEST	443	49960	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.153048038 CEST	49965	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.153099060 CEST	443	49965	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.153168917 CEST	49965	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.153290987 CEST	49965	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.153327942 CEST	443	49965	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.194777012 CEST	443	49961	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.194804907 CEST	443	49961	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.194860935 CEST	443	49961	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.194881916 CEST	49961	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.194993973 CEST	49961	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.195061922 CEST	49961	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.195113897 CEST	443	49961	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.195148945 CEST	49961	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.195164919 CEST	443	49961	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.201894999 CEST	49966	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.201920986 CEST	443	49966	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.202004910 CEST	49966	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.202120066 CEST	49966	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.202127934 CEST	443	49966	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.769630909 CEST	443	49962	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.770189047 CEST	49962	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.770224094 CEST	443	49962	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.770683050 CEST	49962	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.770690918 CEST	443	49962	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.788678885 CEST	443	49964	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.789024115 CEST	49964	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.789041042 CEST	443	49964	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.789411068 CEST	49964	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.789417982 CEST	443	49964	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.791136026 CEST	443	49963	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.791559935 CEST	49963	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.791620016 CEST	443	49963	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.791817904 CEST	49963	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.791834116 CEST	443	49963	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.812952042 CEST	443	49965	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.813519955 CEST	49965	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.813563108 CEST	443	49965	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.814003944 CEST	49965	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.814030886 CEST	443	49965	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.866332054 CEST	443	49966	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.866770983 CEST	49966	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.866805077 CEST	443	49966	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.867139101 CEST	49966	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.867147923 CEST	443	49966	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.873231888 CEST	443	49962	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.873351097 CEST	443	49962	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.873428106 CEST	49962	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.873532057 CEST	49962	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.873532057 CEST	49962	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.873572111 CEST	443	49962	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.873594046 CEST	443	49962	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.876353025 CEST	49967	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.876372099 CEST	443	49967	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.876456022 CEST	49967	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.876586914 CEST	49967	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.876591921 CEST	443	49967	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.887362957 CEST	443	49964	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.887557983 CEST	443	49964	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.887619019 CEST	49964	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.887638092 CEST	49964	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.887646914 CEST	443	49964	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.887656927 CEST	49964	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.887661934 CEST	443	49964	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.889127016 CEST	443	49963	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.889262915 CEST	443	49963	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.889333010 CEST	49963	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.889411926 CEST	49963	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.889413118 CEST	49963	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.889453888 CEST	443	49963	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.889482021 CEST	443	49963	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.904735088 CEST	49968	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.904773951 CEST	443	49968	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.904840946 CEST	49968	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.904961109 CEST	49968	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.904968977 CEST	443	49968	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.905729055 CEST	49969	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.905776978 CEST	443	49969	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.905834913 CEST	49969	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.905932903 CEST	49969	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.905944109 CEST	443	49969	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.911266088 CEST	443	49965	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.911611080 CEST	443	49965	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.911705017 CEST	49965	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.911711931 CEST	443	49965	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.911887884 CEST	49965	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.911889076 CEST	49965	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.911889076 CEST	49965	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.913597107 CEST	49970	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.913604021 CEST	443	49970	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.913672924 CEST	49970	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.913805008 CEST	49970	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.913822889 CEST	443	49970	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.966655016 CEST	443	49966	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.966732979 CEST	443	49966	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.966850042 CEST	49966	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.966927052 CEST	49966	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.966927052 CEST	49966	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.966965914 CEST	443	49966	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.966995001 CEST	443	49966	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.968903065 CEST	49971	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.968943119 CEST	443	49971	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:31.969121933 CEST	49971	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.969176054 CEST	49971	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:31.969189882 CEST	443	49971	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:32.224298000 CEST	49965	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:32.224378109 CEST	443	49965	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:32.518807888 CEST	443	49967	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:32.519368887 CEST	49967	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:32.519375086 CEST	443	49967	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:32.519941092 CEST	49967	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:32.519944906 CEST	443	49967	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:32.563787937 CEST	443	49968	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:32.564305067 CEST	49968	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:32.564323902 CEST	443	49968	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:32.564883947 CEST	49968	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:32.564889908 CEST	443	49968	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:32.566414118 CEST	443	49970	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:32.566845894 CEST	49970	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:32.566895962 CEST	443	49970	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:32.567312002 CEST	49970	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:32.567325115 CEST	443	49970	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:32.572278023 CEST	443	49969	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:32.572973967 CEST	49969	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:32.573010921 CEST	443	49969	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:32.578365088 CEST	49969	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:32.578377962 CEST	443	49969	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:32.617532015 CEST	443	49967	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:32.617685080 CEST	443	49967	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:32.617738008 CEST	49967	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:32.617834091 CEST	49967	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:32.617842913 CEST	443	49967	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:32.617851973 CEST	49967	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:32.617856026 CEST	443	49967	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:32.620379925 CEST	49972	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:32.620425940 CEST	443	49972	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:32.620506048 CEST	49972	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:32.620620966 CEST	49972	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:32.620649099 CEST	443	49972	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:32.637053013 CEST	443	49971	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:32.637440920 CEST	49971	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:32.637463093 CEST	443	49971	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:32.637692928 CEST	49971	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:32.637700081 CEST	443	49971	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:32.670075893 CEST	443	49970	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:32.670336008 CEST	443	49970	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:32.670412064 CEST	49970	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:32.670412064 CEST	49970	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:32.670468092 CEST	49970	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:32.670500040 CEST	443	49970	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:32.672580957 CEST	49973	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:32.672607899 CEST	443	49968	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:32.672633886 CEST	443	49973	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:32.672708988 CEST	49973	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:32.672760963 CEST	443	49968	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:32.672816992 CEST	49968	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:32.672880888 CEST	49973	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:32.672889948 CEST	443	49973	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:32.672924042 CEST	49968	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:32.672924042 CEST	49968	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:32.672936916 CEST	443	49968	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:32.672945976 CEST	443	49968	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:32.674479008 CEST	49974	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:32.674489975 CEST	443	49974	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:32.674550056 CEST	49974	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:32.674634933 CEST	49974	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:32.674644947 CEST	443	49974	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:32.687733889 CEST	443	49969	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:32.687870979 CEST	443	49969	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:32.687936068 CEST	49969	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:32.687987089 CEST	49969	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:32.688010931 CEST	443	49969	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:32.688034058 CEST	49969	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:32.688047886 CEST	443	49969	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:32.689779043 CEST	49975	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:32.689866066 CEST	443	49975	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:32.689948082 CEST	49975	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:32.690047026 CEST	49975	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:32.690066099 CEST	443	49975	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:32.740896940 CEST	443	49971	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:32.740969896 CEST	443	49971	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:32.741013050 CEST	49971	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:32.741153955 CEST	49971	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:32.741163015 CEST	443	49971	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:32.741173029 CEST	49971	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:32.741177082 CEST	443	49971	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:32.742996931 CEST	49976	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:32.743086100 CEST	443	49976	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:32.743179083 CEST	49976	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:32.743292093 CEST	49976	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:32.743313074 CEST	443	49976	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:33.275803089 CEST	443	49972	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:33.276449919 CEST	49972	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:33.276460886 CEST	443	49974	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:33.276510000 CEST	443	49972	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:33.276757956 CEST	49974	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:33.276777983 CEST	443	49974	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:33.276982069 CEST	49972	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:33.276997089 CEST	443	49972	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:33.277282953 CEST	49974	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:33.277291059 CEST	443	49974	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:33.366096020 CEST	443	49975	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:33.366569996 CEST	49975	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:33.366631031 CEST	443	49975	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:33.366906881 CEST	49975	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:33.366919994 CEST	443	49975	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:33.374938965 CEST	443	49972	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:33.375096083 CEST	443	49972	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:33.375164032 CEST	49972	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:33.375236034 CEST	49972	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:33.375236034 CEST	49972	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:33.375267029 CEST	443	49972	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:33.375288963 CEST	443	49972	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:33.375685930 CEST	443	49974	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:33.375830889 CEST	443	49974	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:33.375888109 CEST	49974	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:33.375916958 CEST	49974	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:33.375936985 CEST	443	49974	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:33.375948906 CEST	49974	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:33.375956059 CEST	443	49974	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:33.378051043 CEST	49977	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:33.378076077 CEST	443	49977	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:33.378086090 CEST	49978	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:33.378093004 CEST	443	49978	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:33.378138065 CEST	49977	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:33.378165960 CEST	49978	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:33.378268957 CEST	49978	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:33.378273964 CEST	443	49978	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:33.378290892 CEST	49977	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:33.378295898 CEST	443	49977	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:33.385943890 CEST	443	49973	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:33.386209965 CEST	49973	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:33.386219978 CEST	443	49973	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:33.386533976 CEST	49973	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:33.386539936 CEST	443	49973	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:33.421776056 CEST	443	49976	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:33.422235966 CEST	49976	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:33.422327042 CEST	443	49976	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:33.422451973 CEST	49976	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:33.422468901 CEST	443	49976	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:33.485256910 CEST	443	49975	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:33.485332966 CEST	443	49975	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:33.485414982 CEST	49975	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:33.485451937 CEST	443	49975	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:33.485487938 CEST	443	49975	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:33.485542059 CEST	49975	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:33.485584974 CEST	49975	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:33.485584974 CEST	49975	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:33.485615015 CEST	443	49975	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:33.485639095 CEST	443	49975	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:33.487818956 CEST	49979	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:33.487907887 CEST	443	49979	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:33.488006115 CEST	49979	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:33.488131046 CEST	49979	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:33.488151073 CEST	443	49979	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:33.494718075 CEST	443	49973	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:33.494997978 CEST	443	49973	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:33.495047092 CEST	49973	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:33.495059967 CEST	443	49973	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:33.495099068 CEST	443	49973	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:33.495135069 CEST	49973	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:33.495152950 CEST	443	49973	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:33.495165110 CEST	49973	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:33.495165110 CEST	49973	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:33.495172024 CEST	443	49973	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:33.495179892 CEST	443	49973	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:33.497051954 CEST	49980	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:33.497139931 CEST	443	49980	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:33.497220039 CEST	49980	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:33.497319937 CEST	49980	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:33.497344017 CEST	443	49980	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:33.525609970 CEST	443	49976	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:33.525727987 CEST	443	49976	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:33.525907993 CEST	49976	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:33.526006937 CEST	49976	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:33.526006937 CEST	49976	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:33.526056051 CEST	443	49976	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:33.526087046 CEST	443	49976	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:33.529450893 CEST	49981	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:33.529509068 CEST	443	49981	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:33.529587030 CEST	49981	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:33.529757977 CEST	49981	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:33.529783010 CEST	443	49981	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.035871983 CEST	443	49977	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.036638975 CEST	49977	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.036659002 CEST	443	49977	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.037050009 CEST	49977	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.037056923 CEST	443	49977	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.039091110 CEST	443	49978	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.039350033 CEST	49978	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.039355993 CEST	443	49978	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.039649010 CEST	49978	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.039652109 CEST	443	49978	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.150218010 CEST	443	49977	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.150259972 CEST	443	49977	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.150311947 CEST	49977	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.150625944 CEST	49977	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.150635958 CEST	443	49977	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.150645018 CEST	49977	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.150649071 CEST	443	49977	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.152465105 CEST	443	49978	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.153033972 CEST	443	49978	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.153093100 CEST	49978	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.153099060 CEST	443	49978	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.153140068 CEST	443	49978	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.153193951 CEST	49978	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.153426886 CEST	49982	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.153455019 CEST	49978	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.153459072 CEST	443	49978	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.153475046 CEST	49978	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.153477907 CEST	443	49978	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.153512001 CEST	443	49982	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.153594971 CEST	49982	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.154567003 CEST	49982	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.154603004 CEST	443	49982	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.155567884 CEST	49983	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.155666113 CEST	443	49983	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.155760050 CEST	49983	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.155991077 CEST	49983	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.156029940 CEST	443	49983	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.157908916 CEST	443	49979	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.158441067 CEST	49979	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.158504963 CEST	443	49979	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.158763885 CEST	49979	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.158782005 CEST	443	49979	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.160270929 CEST	443	49980	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.160656929 CEST	49980	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.160677910 CEST	443	49980	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.161216974 CEST	49980	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.161230087 CEST	443	49980	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.253246069 CEST	443	49981	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.254013062 CEST	49981	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.254097939 CEST	443	49981	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.255201101 CEST	49981	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.255219936 CEST	443	49981	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.259232998 CEST	443	49980	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.259365082 CEST	443	49980	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.259561062 CEST	49980	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.259561062 CEST	49980	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.259561062 CEST	49980	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.260986090 CEST	443	49979	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.261123896 CEST	443	49979	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.261317015 CEST	49979	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.261615038 CEST	49979	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.261667013 CEST	443	49979	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.261702061 CEST	49979	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.261718035 CEST	443	49979	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.263463020 CEST	49984	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.263513088 CEST	443	49984	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.263597012 CEST	49984	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.263796091 CEST	49984	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.263830900 CEST	443	49984	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.265309095 CEST	49985	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.265331030 CEST	443	49985	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.265397072 CEST	49985	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.265538931 CEST	49985	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.265549898 CEST	443	49985	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.356884003 CEST	443	49981	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.357007980 CEST	443	49981	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.357081890 CEST	49981	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.357100010 CEST	443	49981	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.357165098 CEST	49981	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.357382059 CEST	49981	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.357418060 CEST	443	49981	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.357446909 CEST	49981	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.357461929 CEST	443	49981	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.360713005 CEST	49986	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.360726118 CEST	443	49986	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.360800982 CEST	49986	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.360999107 CEST	49986	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.361010075 CEST	443	49986	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.568006039 CEST	49980	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.568094969 CEST	443	49980	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.787817955 CEST	443	49982	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.788563967 CEST	49982	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.788624048 CEST	443	49982	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.788908005 CEST	49982	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.788923979 CEST	443	49982	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.813071966 CEST	443	49983	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.813724041 CEST	49983	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.813800097 CEST	443	49983	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.814189911 CEST	49983	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.814207077 CEST	443	49983	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.888314009 CEST	443	49982	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.892199039 CEST	443	49982	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.892479897 CEST	49982	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.892479897 CEST	49982	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.892479897 CEST	49982	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.895984888 CEST	49987	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.896104097 CEST	443	49987	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.896210909 CEST	49987	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.896449089 CEST	49987	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.896487951 CEST	443	49987	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.904097080 CEST	443	49984	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.904602051 CEST	49984	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.904622078 CEST	443	49984	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.905033112 CEST	49984	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.905044079 CEST	443	49984	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.906470060 CEST	443	49985	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.906852961 CEST	49985	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.906872034 CEST	443	49985	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.907066107 CEST	49985	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.907071114 CEST	443	49985	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.913815022 CEST	443	49983	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.913961887 CEST	443	49983	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.914048910 CEST	49983	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.914139986 CEST	49983	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.914139986 CEST	49983	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.914191961 CEST	443	49983	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.914218903 CEST	443	49983	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.916753054 CEST	49988	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.916802883 CEST	443	49988	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:34.916899920 CEST	49988	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.917074919 CEST	49988	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:34.917095900 CEST	443	49988	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.003063917 CEST	443	49986	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.003161907 CEST	443	49984	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.003218889 CEST	443	49984	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.003345013 CEST	443	49984	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.003351927 CEST	49984	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.003457069 CEST	49984	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.003688097 CEST	49984	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.003688097 CEST	49984	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.003726959 CEST	49986	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.003736973 CEST	443	49984	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.003746986 CEST	443	49986	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.003765106 CEST	443	49984	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.004415035 CEST	49986	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.004421949 CEST	443	49986	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.006067038 CEST	443	49985	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.006203890 CEST	443	49985	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.006269932 CEST	49985	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.006302118 CEST	49985	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.006310940 CEST	443	49985	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.006320000 CEST	49985	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.006323099 CEST	443	49985	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.007144928 CEST	49989	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.007205963 CEST	443	49989	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.007301092 CEST	49989	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.007436991 CEST	49989	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.007453918 CEST	443	49989	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.008433104 CEST	49990	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.008460045 CEST	443	49990	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.008538961 CEST	49990	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.008722067 CEST	49990	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.008748055 CEST	443	49990	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.110383034 CEST	443	49986	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.110455990 CEST	443	49986	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.110573053 CEST	443	49986	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.110608101 CEST	49986	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.110631943 CEST	49986	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.110764027 CEST	49986	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.110775948 CEST	443	49986	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.110786915 CEST	49986	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.110790968 CEST	443	49986	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.113181114 CEST	49991	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.113274097 CEST	443	49991	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.113385916 CEST	49991	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.113584995 CEST	49991	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.113605976 CEST	443	49991	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.193206072 CEST	49982	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.193269968 CEST	443	49982	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.561508894 CEST	443	49987	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.562112093 CEST	49987	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.562176943 CEST	443	49987	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.562627077 CEST	49987	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.562642097 CEST	443	49987	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.606292009 CEST	443	49988	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.606934071 CEST	49988	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.607003927 CEST	443	49988	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.607552052 CEST	49988	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.607568979 CEST	443	49988	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.659852982 CEST	443	49989	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.660393000 CEST	49989	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.660443068 CEST	443	49989	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.660690069 CEST	49989	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.660705090 CEST	443	49989	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.667404890 CEST	443	49987	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.667423010 CEST	443	49987	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.667584896 CEST	49987	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.667658091 CEST	443	49987	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.667749882 CEST	443	49987	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.667814016 CEST	49987	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.676595926 CEST	49987	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.676597118 CEST	49987	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.676635981 CEST	443	49987	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.676673889 CEST	443	49987	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.677263975 CEST	443	49990	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.678076029 CEST	49990	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.678097010 CEST	443	49990	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.678705931 CEST	49990	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.678716898 CEST	443	49990	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.680887938 CEST	49992	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.680916071 CEST	443	49992	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.680990934 CEST	49992	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.681186914 CEST	49992	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.681199074 CEST	443	49992	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.711071014 CEST	443	49988	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.711117983 CEST	443	49988	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.711220980 CEST	443	49988	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.711353064 CEST	49988	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.711464882 CEST	49988	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.711464882 CEST	49988	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.711464882 CEST	49988	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.714123011 CEST	49993	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.714216948 CEST	443	49993	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.714301109 CEST	49993	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.714457035 CEST	49993	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.714488029 CEST	443	49993	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.762659073 CEST	443	49989	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.762769938 CEST	443	49989	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.762845993 CEST	49989	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.762878895 CEST	443	49989	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.763041019 CEST	49989	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.763062000 CEST	443	49989	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.763088942 CEST	49989	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.763122082 CEST	443	49989	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.765072107 CEST	49994	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.765100956 CEST	443	49994	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.765197992 CEST	49994	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.765310049 CEST	49994	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.765320063 CEST	443	49994	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.781265020 CEST	443	49990	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.781414032 CEST	443	49990	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.781636953 CEST	49990	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.781636953 CEST	49990	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.781637907 CEST	49990	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.783705950 CEST	49995	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.783734083 CEST	443	49995	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.783902884 CEST	49995	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.783902884 CEST	49995	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.783945084 CEST	443	49995	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.785535097 CEST	443	49991	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.785854101 CEST	49991	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.785911083 CEST	443	49991	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.786402941 CEST	49991	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.786416054 CEST	443	49991	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.908138037 CEST	443	49991	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.908282995 CEST	443	49991	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.908346891 CEST	49991	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.908446074 CEST	49991	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.908480883 CEST	443	49991	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.908505917 CEST	49991	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.908519983 CEST	443	49991	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.910955906 CEST	49996	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.911040068 CEST	443	49996	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:35.911122084 CEST	49996	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.911236048 CEST	49996	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:35.911253929 CEST	443	49996	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:36.021104097 CEST	49988	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:36.021146059 CEST	443	49988	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:36.083715916 CEST	49990	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:36.083780050 CEST	443	49990	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:36.328598022 CEST	443	49992	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:36.329353094 CEST	49992	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:36.329370975 CEST	443	49992	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:36.329739094 CEST	49992	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:36.329742908 CEST	443	49992	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:36.374557018 CEST	443	49993	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:36.375773907 CEST	49993	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:36.375817060 CEST	443	49993	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:36.376276016 CEST	49993	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:36.376286983 CEST	443	49993	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:36.427587986 CEST	443	49994	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:36.428117037 CEST	49994	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:36.428133965 CEST	443	49994	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:36.428585052 CEST	49994	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:36.428596020 CEST	443	49994	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:36.429413080 CEST	443	49992	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:36.429625034 CEST	443	49992	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:36.429759979 CEST	49992	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:36.429760933 CEST	49992	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:36.429760933 CEST	49992	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:36.432250977 CEST	49997	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:36.432296991 CEST	443	49997	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:36.432374001 CEST	49997	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:36.432497978 CEST	49997	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:36.432513952 CEST	443	49997	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:36.476835966 CEST	443	49993	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:36.476984024 CEST	443	49993	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:36.477040052 CEST	49993	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:36.477116108 CEST	49993	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:36.477117062 CEST	49993	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:36.477147102 CEST	443	49993	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:36.477168083 CEST	443	49993	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:36.479387045 CEST	49998	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:36.479424000 CEST	443	49998	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:36.479480028 CEST	49998	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:36.479583025 CEST	49998	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:36.479592085 CEST	443	49998	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:36.486223936 CEST	443	49995	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:36.486512899 CEST	49995	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:36.486525059 CEST	443	49995	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:36.486898899 CEST	49995	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:36.486901999 CEST	443	49995	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:36.529333115 CEST	443	49994	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:36.529392004 CEST	443	49994	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:36.529448986 CEST	49994	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:36.529468060 CEST	443	49994	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:36.529503107 CEST	443	49994	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:36.529521942 CEST	49994	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:36.529546022 CEST	49994	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:36.529572010 CEST	443	49994	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:36.529594898 CEST	49994	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:36.529594898 CEST	49994	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:36.529611111 CEST	443	49994	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:36.529629946 CEST	443	49994	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:36.531440973 CEST	49999	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:36.531495094 CEST	443	49999	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:36.531572104 CEST	49999	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:36.531671047 CEST	49999	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:36.531687021 CEST	443	49999	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:36.568324089 CEST	443	49996	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:36.568722963 CEST	49996	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:36.568754911 CEST	443	49996	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:36.569158077 CEST	49996	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:36.569169044 CEST	443	49996	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:36.593653917 CEST	443	49995	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:36.593713045 CEST	443	49995	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:36.593770981 CEST	49995	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:36.593780041 CEST	443	49995	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:36.593905926 CEST	49995	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:36.593909979 CEST	443	49995	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:36.593939066 CEST	49995	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:36.593951941 CEST	443	49995	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:36.595805883 CEST	50000	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:36.595870972 CEST	443	50000	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:36.595946074 CEST	50000	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:36.596070051 CEST	50000	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:36.596087933 CEST	443	50000	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:36.676284075 CEST	443	49996	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:36.676347017 CEST	443	49996	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:36.676390886 CEST	443	49996	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:36.676425934 CEST	49996	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:36.676445007 CEST	443	49996	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:36.676482916 CEST	49996	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:36.676506042 CEST	49996	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:36.739968061 CEST	49992	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:36.739989996 CEST	443	49992	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:36.760515928 CEST	443	49996	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:36.760652065 CEST	49996	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:36.760674953 CEST	443	49996	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:36.760709047 CEST	443	49996	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:36.760766983 CEST	49996	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:36.760797977 CEST	49996	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:36.760823965 CEST	443	49996	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:36.760848045 CEST	49996	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:36.760860920 CEST	443	49996	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:36.763938904 CEST	50001	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:36.764033079 CEST	443	50001	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:36.764116049 CEST	50001	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:36.764257908 CEST	50001	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:36.764276981 CEST	443	50001	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.077974081 CEST	443	49997	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.078427076 CEST	49997	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.078449965 CEST	443	49997	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.078850031 CEST	49997	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.078856945 CEST	443	49997	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.128029108 CEST	443	49998	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.128330946 CEST	49998	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.128340960 CEST	443	49998	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.128663063 CEST	49998	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.128669024 CEST	443	49998	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.175928116 CEST	443	49997	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.175946951 CEST	443	49997	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.175978899 CEST	443	49997	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.176126003 CEST	49997	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.176126003 CEST	49997	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.176275015 CEST	49997	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.176290989 CEST	443	49997	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.176300049 CEST	49997	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.176305056 CEST	443	49997	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.178044081 CEST	443	49999	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.178359032 CEST	49999	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.178416014 CEST	443	49999	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.178692102 CEST	49999	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.178705931 CEST	443	49999	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.179287910 CEST	50002	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.179406881 CEST	443	50002	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.179487944 CEST	50002	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.179616928 CEST	50002	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.179635048 CEST	443	50002	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.231137037 CEST	443	49998	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.231200933 CEST	443	49998	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.231244087 CEST	443	49998	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.231369972 CEST	49998	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.231369972 CEST	49998	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.231379986 CEST	443	49998	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.231430054 CEST	49998	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.280138016 CEST	443	49999	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.280204058 CEST	443	49999	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.280328035 CEST	443	49999	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.280445099 CEST	49999	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.280445099 CEST	49999	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.280445099 CEST	49999	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.280445099 CEST	49999	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.280445099 CEST	49999	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.282459021 CEST	50003	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.282519102 CEST	443	50003	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.282596111 CEST	50003	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.282695055 CEST	50003	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.282711029 CEST	443	50003	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.287007093 CEST	443	50000	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.287354946 CEST	50000	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.287380934 CEST	443	50000	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.287692070 CEST	50000	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.287703991 CEST	443	50000	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.316421986 CEST	443	49998	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.316548109 CEST	49998	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.316570044 CEST	443	49998	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.316601992 CEST	443	49998	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.316729069 CEST	49998	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.316729069 CEST	49998	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.316807032 CEST	49998	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.316823006 CEST	443	49998	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.316834927 CEST	49998	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.316838980 CEST	443	49998	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.319444895 CEST	50004	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.319472075 CEST	443	50004	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.319700956 CEST	50004	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.319700956 CEST	50004	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.319741964 CEST	443	50004	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.390129089 CEST	443	50000	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.390183926 CEST	443	50000	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.390305042 CEST	443	50000	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.390429020 CEST	50000	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.390429974 CEST	50000	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.390597105 CEST	50000	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.390597105 CEST	50000	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.390647888 CEST	443	50000	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.390685081 CEST	443	50000	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.393353939 CEST	50005	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.393469095 CEST	443	50005	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.393570900 CEST	50005	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.393711090 CEST	50005	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.393731117 CEST	443	50005	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.407078028 CEST	443	50001	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.407511950 CEST	50001	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.407576084 CEST	443	50001	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.407808065 CEST	50001	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.407821894 CEST	443	50001	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.507203102 CEST	443	50001	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.507343054 CEST	443	50001	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.507424116 CEST	50001	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.507499933 CEST	50001	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.507499933 CEST	50001	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.507543087 CEST	443	50001	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.507569075 CEST	443	50001	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.509397984 CEST	50006	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.509443045 CEST	443	50006	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.509519100 CEST	50006	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.509635925 CEST	50006	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.509644032 CEST	443	50006	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.583579063 CEST	49999	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.583641052 CEST	443	49999	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.833607912 CEST	443	50002	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.834220886 CEST	50002	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.834286928 CEST	443	50002	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.834669113 CEST	50002	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.834682941 CEST	443	50002	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.938041925 CEST	443	50002	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.938081026 CEST	443	50002	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.938277006 CEST	50002	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.938436031 CEST	50002	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.938483953 CEST	443	50002	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.938514948 CEST	50002	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.938530922 CEST	443	50002	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.941653013 CEST	50007	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.941674948 CEST	443	50007	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.941760063 CEST	50007	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.941943884 CEST	50007	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.941948891 CEST	443	50007	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.961905003 CEST	443	50003	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.962301016 CEST	50003	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.962337017 CEST	443	50003	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.962673903 CEST	50003	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.962688923 CEST	443	50003	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.973957062 CEST	443	50004	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.974239111 CEST	50004	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.974253893 CEST	443	50004	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:37.974576950 CEST	50004	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:37.974581003 CEST	443	50004	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:38.052804947 CEST	443	50005	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:38.053323984 CEST	50005	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:38.053359032 CEST	443	50005	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:38.053580999 CEST	50005	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:38.053591967 CEST	443	50005	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:38.063893080 CEST	443	50003	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:38.064034939 CEST	443	50003	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:38.064111948 CEST	50003	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:38.064187050 CEST	50003	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:38.064215899 CEST	443	50003	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:38.064243078 CEST	50003	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:38.064258099 CEST	443	50003	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:38.067172050 CEST	50008	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:38.067215919 CEST	443	50008	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:38.067300081 CEST	50008	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:38.067409992 CEST	50008	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:38.067415953 CEST	443	50008	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:38.074508905 CEST	443	50004	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:38.074703932 CEST	443	50004	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:38.074764013 CEST	50004	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:38.075098991 CEST	50004	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:38.075104952 CEST	443	50004	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:38.077970028 CEST	50009	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:38.078052998 CEST	443	50009	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:38.078124046 CEST	50009	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:38.078228951 CEST	50009	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:38.078253031 CEST	443	50009	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:38.152749062 CEST	443	50005	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:38.152821064 CEST	443	50005	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:38.152980089 CEST	443	50005	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:38.152998924 CEST	50005	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:38.153074980 CEST	50005	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:38.153074980 CEST	50005	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:38.153074980 CEST	50005	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:38.153130054 CEST	443	50005	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:38.153214931 CEST	443	50006	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:38.153557062 CEST	50006	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:38.153601885 CEST	443	50006	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:38.153979063 CEST	50006	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:38.153990984 CEST	443	50006	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:38.252052069 CEST	443	50006	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:38.252203941 CEST	443	50006	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:38.252314091 CEST	50006	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:38.252314091 CEST	50006	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:38.252314091 CEST	50006	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:38.458772898 CEST	50005	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:38.458853960 CEST	443	50005	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:38.552443981 CEST	50006	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:38.552512884 CEST	443	50006	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:38.601582050 CEST	443	50007	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:38.602102041 CEST	50007	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:38.602113008 CEST	443	50007	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:38.602551937 CEST	50007	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:38.602555990 CEST	443	50007	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:38.706012011 CEST	443	50007	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:38.706046104 CEST	443	50007	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:38.706341982 CEST	50007	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:38.706475973 CEST	50007	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:38.706481934 CEST	443	50007	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:38.706521988 CEST	50007	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:38.706526041 CEST	443	50007	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:38.712116957 CEST	443	50008	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:38.712563038 CEST	50008	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:38.712584972 CEST	443	50008	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:38.713011026 CEST	50008	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:38.713016033 CEST	443	50008	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:38.726458073 CEST	443	50009	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:38.726713896 CEST	50009	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:38.726809025 CEST	443	50009	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:38.727135897 CEST	50009	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:38.727149963 CEST	443	50009	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:38.813663960 CEST	443	50008	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:38.814042091 CEST	443	50008	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:38.814106941 CEST	50008	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:38.814140081 CEST	50008	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:38.814158916 CEST	443	50008	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:38.814167976 CEST	50008	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:38.814172029 CEST	443	50008	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:38.830632925 CEST	443	50009	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:38.830821037 CEST	443	50009	13.107.246.60	192.168.2.4
Oct 8, 2024 05:49:38.830905914 CEST	50009	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:38.830905914 CEST	50009	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:38.830905914 CEST	50009	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:39.130517960 CEST	50009	443	192.168.2.4	13.107.246.60
Oct 8, 2024 05:49:39.130580902 CEST	443	50009	13.107.246.60	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 05:48:01.140438080 CEST	50697	53	192.168.2.4	1.1.1.1
Oct 8, 2024 05:48:01.149040937 CEST	53	50697	1.1.1.1	192.168.2.4
Oct 8, 2024 05:48:01.151734114 CEST	54145	53	192.168.2.4	1.1.1.1
Oct 8, 2024 05:48:01.160175085 CEST	53	54145	1.1.1.1	192.168.2.4
Oct 8, 2024 05:48:01.161561012 CEST	49684	53	192.168.2.4	1.1.1.1
Oct 8, 2024 05:48:01.169878960 CEST	53	49684	1.1.1.1	192.168.2.4
Oct 8, 2024 05:48:01.173319101 CEST	59807	53	192.168.2.4	1.1.1.1
Oct 8, 2024 05:48:01.181972027 CEST	53	59807	1.1.1.1	192.168.2.4
Oct 8, 2024 05:48:01.183305979 CEST	62362	53	192.168.2.4	1.1.1.1
Oct 8, 2024 05:48:01.191922903 CEST	53	62362	1.1.1.1	192.168.2.4
Oct 8, 2024 05:48:01.193249941 CEST	63416	53	192.168.2.4	1.1.1.1
Oct 8, 2024 05:48:01.201183081 CEST	53	63416	1.1.1.1	192.168.2.4
Oct 8, 2024 05:48:01.203289032 CEST	51455	53	192.168.2.4	1.1.1.1
Oct 8, 2024 05:48:01.212129116 CEST	53	51455	1.1.1.1	192.168.2.4
Oct 8, 2024 05:48:01.214624882 CEST	64808	53	192.168.2.4	1.1.1.1
Oct 8, 2024 05:48:01.222790956 CEST	53	64808	1.1.1.1	192.168.2.4
Oct 8, 2024 05:48:01.223836899 CEST	56218	53	192.168.2.4	1.1.1.1
Oct 8, 2024 05:48:01.232115984 CEST	53	56218	1.1.1.1	192.168.2.4
Oct 8, 2024 05:48:01.233607054 CEST	59046	53	192.168.2.4	1.1.1.1
Oct 8, 2024 05:48:01.241069078 CEST	53	59046	1.1.1.1	192.168.2.4
Oct 8, 2024 05:48:02.544538021 CEST	56434	53	192.168.2.4	1.1.1.1
Oct 8, 2024 05:48:02.707770109 CEST	53	56434	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 8, 2024 05:48:01.140438080 CEST	192.168.2.4	1.1.1.1	0x4111	Standard query (0)	trustterwowqm.shop	A (IP address)	IN (0x0001)	false
Oct 8, 2024 05:48:01.151734114 CEST	192.168.2.4	1.1.1.1	0x2f73	Standard query (0)	mobbipenju.store	A (IP address)	IN (0x0001)	false
Oct 8, 2024 05:48:01.161561012 CEST	192.168.2.4	1.1.1.1	0x3004	Standard query (0)	eaglepawnoy.store	A (IP address)	IN (0x0001)	false
Oct 8, 2024 05:48:01.173319101 CEST	192.168.2.4	1.1.1.1	0x556e	Standard query (0)	dissapoiznw.store	A (IP address)	IN (0x0001)	false
Oct 8, 2024 05:48:01.183305979 CEST	192.168.2.4	1.1.1.1	0xc349	Standard query (0)	studennotediw.store	A (IP address)	IN (0x0001)	false
Oct 8, 2024 05:48:01.193249941 CEST	192.168.2.4	1.1.1.1	0x25f6	Standard query (0)	bathdoomgaz.store	A (IP address)	IN (0x0001)	false
Oct 8, 2024 05:48:01.203289032 CEST	192.168.2.4	1.1.1.1	0xaf2f	Standard query (0)	spirittunek.store	A (IP address)	IN (0x0001)	false
Oct 8, 2024 05:48:01.214624882 CEST	192.168.2.4	1.1.1.1	0xad8f	Standard query (0)	licendfilteo.site	A (IP address)	IN (0x0001)	false
Oct 8, 2024 05:48:01.223836899 CEST	192.168.2.4	1.1.1.1	0xd4d1	Standard query (0)	clearancek.site	A (IP address)	IN (0x0001)	false
Oct 8, 2024 05:48:01.233607054 CEST	192.168.2.4	1.1.1.1	0xcb6a	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 8, 2024 05:48:02.544538021 CEST	192.168.2.4	1.1.1.1	0x2529	Standard query (0)	sergei-esenin.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 8, 2024 05:48:01.149040937 CEST	1.1.1.1	192.168.2.4	0x4111	Name error (3)	trustterwowqm.shop	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 05:48:01.160175085 CEST	1.1.1.1	192.168.2.4	0x2f73	Name error (3)	mobbipenju.store	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 05:48:01.169878960 CEST	1.1.1.1	192.168.2.4	0x3004	Name error (3)	eaglepawnoy.store	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 05:48:01.181972027 CEST	1.1.1.1	192.168.2.4	0x556e	Name error (3)	dissapoiznw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 05:48:01.191922903 CEST	1.1.1.1	192.168.2.4	0xc349	Name error (3)	studennotediw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 05:48:01.201183081 CEST	1.1.1.1	192.168.2.4	0x25f6	Name error (3)	bathdoomgaz.store	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 05:48:01.212129116 CEST	1.1.1.1	192.168.2.4	0xaf2f	Name error (3)	spirittunek.store	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 05:48:01.222790956 CEST	1.1.1.1	192.168.2.4	0xad8f	Name error (3)	licendfilteo.site	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 05:48:01.232115984 CEST	1.1.1.1	192.168.2.4	0xd4d1	Name error (3)	clearancek.site	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 05:48:01.241069078 CEST	1.1.1.1	192.168.2.4	0xcb6a	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Oct 8, 2024 05:48:02.576253891 CEST	1.1.1.1	192.168.2.4	0x4876	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Oct 8, 2024 05:48:02.576253891 CEST	1.1.1.1	192.168.2.4	0x4876	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Oct 8, 2024 05:48:02.707770109 CEST	1.1.1.1	192.168.2.4	0x2529	No error (0)	sergei-esenin.com		172.67.206.204	A (IP address)	IN (0x0001)	false
Oct 8, 2024 05:48:02.707770109 CEST	1.1.1.1	192.168.2.4	0x2529	No error (0)	sergei-esenin.com		104.21.53.8	A (IP address)	IN (0x0001)	false
Oct 8, 2024 05:48:03.960413933 CEST	1.1.1.1	192.168.2.4	0x367b	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 05:48:03.960413933 CEST	1.1.1.1	192.168.2.4	0x367b	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Oct 8, 2024 05:48:55.627016068 CEST	1.1.1.1	192.168.2.4	0x579	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 05:48:55.627016068 CEST	1.1.1.1	192.168.2.4	0x579	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

sergei-esenin.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	104.102.49.254	443	7460	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 03:48:01 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-08 03:48:02 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Tue, 08 Oct 2024 03:48:02 GMT Content-Length: 34837 Connection: close Set-Cookie: sessionid=78e7e1b59f7d6669de616005; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=None
2024-10-08 03:48:02 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-08 03:48:02 UTC	16384	IN	Data Raw: 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0d 0a 09 09 6a 51 75 65 72 79 28 66 75 6e 63 74 69 6f 6e 28 24 29 20 7b 0d 0a 09 09 09 24 28 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 27 29 2e 76 5f 74 6f 6f 6c 74 69 70 28 7b 27 6c 6f 63 61 74 69 6f 6e 27 3a 27 62 6f 74 74 6f 6d 27 2c 20 27 64 65 73 74 72 6f 79 57 68 65 6e 44 6f 6e 65 27 3a 20 66 61 6c 73 65 2c 20 27 74 6f 6f 6c 74 69 70 43 6c 61 73 73 27 3a 20 27 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 65 6e 74 27 2c 20 27 6f 66 66 73 65 74 59 27 3a 2d 36 2c 20 27 6f 66 66 73 65 74 58 27 3a 20 31 2c 20 27 68 6f 72 69 7a 6f 6e 74 61 6c 53 6e 61 70 27 3a 20 34 2c 20 27 74 6f 6f 6c 74 69 70 50 61 72 65 6e 74 27 3a 20 27 23 67 6c 6f Data Ascii: <script type="text/javascript">jQuery(function($) {$('#global_header .supernav').v_tooltip({'location':'bottom', 'destroyWhenDone': false, 'tooltipClass': 'supernav_content', 'offsetY':-6, 'offsetX': 1, 'horizontalSnap': 4, 'tooltipParent': '#glo
2024-10-08 03:48:02 UTC	3768	IN	Data Raw: 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 73 75 6d 6d 61 72 79 5f 66 6f 6f 74 65 72 22 3e 0d 0a 09 09 09 09 09 09 09 3c 73 70 61 6e 20 64 61 74 61 2d 70 61 6e 65 6c 3d 22 7b 26 71 75 6f 74 3b 66 6f 63 75 73 61 62 6c 65 26 71 75 6f 74 3b 3a 74 72 75 65 2c 26 71 75 6f 74 3b 63 6c 69 63 6b 4f 6e 41 63 74 69 76 61 74 65 26 71 75 6f 74 3b 3a 74 72 75 65 7d 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 20 63 6c 61 73 73 3d 22 77 68 69 74 65 4c 69 6e 6b 22 3e 56 69 65 77 20 6d 6f 72 65 20 69 6e 66 6f 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 20 24 4a 28 20 66 75 6e 63 74 69 6f 6e 28 29 Data Ascii: <div class="profile_summary_footer"><span data-panel="{"focusable":true,"clickOnActivate":true}" class="whiteLink" class="whiteLink">View more info</span></div><script type="text/javascript"> $J( function()
2024-10-08 03:48:02 UTC	171	IN	Data Raw: 09 3c 73 70 61 6e 3e 56 69 65 77 20 6d 6f 62 69 6c 65 20 77 65 62 73 69 74 65 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 0d 0a 09 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 63 6f 6e 74 65 6e 74 20 2d 2d 3e 0d 0a 0d 0a 3c 2f 64 69 76 3e 09 3c 21 2d 2d 20 72 65 73 70 6f 6e 73 69 76 65 5f 70 61 67 65 5f 66 72 61 6d 65 20 2d 2d 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <span>View mobile website</span></div></div></div></div>... responsive_page_content --></div>... responsive_page_frame --></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49733	172.67.206.204	443	7460	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 03:48:03 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: sergei-esenin.com
2024-10-08 03:48:03 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-08 03:48:03 UTC	799	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 03:48:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ku0li1dvfb1jht10eju9qs2bc5; expires=Fri, 31 Jan 2025 21:34:42 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bfzCKcAMXv3cUoU3MYIFtlooqBUjI6FKggYgTX6sdtj%2Fq2mNHqquD%2FQOSREX1n01vdb8qbX9e1mqv%2Bv1htnkRJNp3TYO5U6z5v6EgeNoB82HCwTBbaO2uZra4uZ4XQvY%2BggNVg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cf327305c0841fb-EWR
2024-10-08 03:48:03 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-08 03:48:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	23:47:59
Start date:	07/10/2024
Path:	C:\Users\user\Desktop\lHHfXU6Y37.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\lHHfXU6Y37.exe"
Imagebase:	0x3b0000
File size:	550'912 bytes
MD5 hash:	7544BC22211629C705BF9D778CC00479
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	23:47:59
Start date:	07/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0x2e0000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	23:47:59
Start date:	07/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0x4f0000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	23:48:00
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7436 -s 280
Imagebase:	0x630000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	6.1%
Total number of Nodes:	229
Total number of Limit Nodes:	3

Executed Functions

Function 003B2021 Relevance: 9.4, APIs: 1, Strings: 4, Instructions: 631
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(004358D8,?,00000040,?), ref: 003B2738

Strings

', xrefs: 003B2718
S, xrefs: 003B206A
a, xrefs: 003B2296
MZx, xrefs: 003B274B, 003B2757, 003B275C

Memory Dump Source

Source File: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID: ProtectVirtual
String ID: '$MZx$S$a
API String ID: 544645111-3057195942
Opcode ID: 27e34e1622400c41e1e62ec94c83fa89f4d7780391044e5832518aebab51b86f
Instruction ID: 71a3a0afb969ac1b49b5cdc77f82c59d103355c9b355933e7cc3960afb75f221
Opcode Fuzzy Hash: 27e34e1622400c41e1e62ec94c83fa89f4d7780391044e5832518aebab51b86f
Instruction Fuzzy Hash: 70F1F027934E1B06E70960394D522E7A58AD7EA334F925333BF22DBFF4E36909419285

Function 003C6368 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE(?,003C8F1C,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 003C639C
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,003C8F1C,?,?,00000000,?,00000000), ref: 003C63BA

Strings

R[;, xrefs: 003C6396

Memory Dump Source

Source File: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID: String
String ID: R[;
API String ID: 2568140703-2017283703
Opcode ID: b4be1211b8f1fdee719fb5769dcb99dd9a7041e2c1bfe3abea0d9c60e840f2cb
Instruction ID: 2393eced8bab3984577c5efd374da7e5ca85b40f509f632e1ff555d14d145e04
Opcode Fuzzy Hash: b4be1211b8f1fdee719fb5769dcb99dd9a7041e2c1bfe3abea0d9c60e840f2cb
Instruction Fuzzy Hash: 58F07A3610019ABBCF136F90EC06EDE3F2AEF48360F058115FA19A9030C736D971AB91

Function 003C8E2E Relevance: 4.7, APIs: 3, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__freea.LIBCMT ref: 003C8FDD

Part of subcall function 003C3A83: HeapAlloc.KERNEL32(00000000,003CA1AA,?,?,003CA1AA,00000220,?,?,?), ref: 003C3AB5

__freea.LIBCMT ref: 003C8FF2
__freea.LIBCMT ref: 003C9002

Memory Dump Source

Source File: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID: __freea$AllocHeap
String ID:
API String ID: 85559729-0
Opcode ID: 1b99bf7c6a42d623ec915c920fcb52a5f2a773758c0a10968aded61a32de56f6
Instruction ID: d19962a85c2252777f1219aabbd430aa360bf4070d26aa6056071d3d788050b0
Opcode Fuzzy Hash: 1b99bf7c6a42d623ec915c920fcb52a5f2a773758c0a10968aded61a32de56f6
Instruction Fuzzy Hash: A7518E72600216AFEB279F649C86FBB3AAAEF44754B16052DFD08DA151EF31CE508760

Function 003CA3A6 Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 003C9ED6: GetOEMCP.KERNEL32(00000000,?,?,?,?), ref: 003C9F01

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,003CA1ED,?,00000000,?,?,?), ref: 003CA407
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,003CA1ED,?,00000000,?,?,?), ref: 003CA449

Memory Dump Source

Source File: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 6520f65778fa4c5cf44f4861612fa818fd1b87413d47f180aa0969145661f29e
Instruction ID: 3798a514047ade7a04e7d4bbc925852f71cfee7d271f40d3574e2c3513ad4614
Opcode Fuzzy Hash: 6520f65778fa4c5cf44f4861612fa818fd1b87413d47f180aa0969145661f29e
Instruction Fuzzy Hash: 15510871A00A498FDB27CF76C445FAABBF4EF81308F15806ED086CB651E6B49D45CB52

Function 003C9FAA Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(E8458D00,?,003CA1F9,003CA1ED,00000000), ref: 003C9FDC

Memory Dump Source

Source File: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: c9fb0af0e42bd68b0ea3c1adc69dc09a7cce9d2a7b4e7d420f5a6ec427bcfaa7
Instruction ID: 02869d80a81f8625db70b5371b40ee5950a187ba3957ab32a1925aaa32f5770d
Opcode Fuzzy Hash: c9fb0af0e42bd68b0ea3c1adc69dc09a7cce9d2a7b4e7d420f5a6ec427bcfaa7
Instruction Fuzzy Hash: 1C51477190826C9ADB238A28CD84FE67BBCEB45348F2405ADE19AC7142D275AD46DF21

Non-executed Functions

Function 003FCB98 Relevance: 20.7, Strings: 15, Instructions: 1988COMMON

Download Yara Rule

Strings

lkji, xrefs: 003FD903
yz{|, xrefs: 003FD6B7
efgh, xrefs: 003FD6D8
8;:=, xrefs: 003FD6CD
p, xrefs: 003FE019
,/.!, xrefs: 003FD6AC
4, xrefs: 003FD80C
lcba, xrefs: 003FD8CC
pwvu, xrefs: 003FD8AB
0325, xrefs: 003FD6E3
@GFE, xrefs: 003FD92F
(+*-, xrefs: 003FD6A1
$'&9, xrefs: 003FD6C2
,, xrefs: 003FDC6F
`onm, xrefs: 003FD8F8

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID: $'&9$(+*-$,$,/.!$0325$4$8;:=$@GFE$`onm$efgh$lcba$lkji$p$pwvu$yz{|
API String ID: 0-4284672935
Opcode ID: 17a9da9fb198ce4cff53889ca9a74bbfb73063c59ecad7ce56909eb832305105
Instruction ID: 822c3b1e08edc734440263c8d35aa62ee5620fd49a93599e1eda67e9443ce009
Opcode Fuzzy Hash: 17a9da9fb198ce4cff53889ca9a74bbfb73063c59ecad7ce56909eb832305105
Instruction Fuzzy Hash: E5F286B1108385ABD732CF54D888BAFBBE2BF86305F54492DE5C99B292D7359804CB53

Function 0040C568 Relevance: 11.5, Strings: 9, Instructions: 256COMMON

Download Yara Rule

Strings

0W4i, xrefs: 0040C613
W7JI, xrefs: 0040C5DB
4[&], xrefs: 0040C5FE
7S.U, xrefs: 0040C60C
=G!Y, xrefs: 0040C5F7
8O?A, xrefs: 0040C5E9
2C!E, xrefs: 0040C5F0
A3W5, xrefs: 0040C5D4
;_(Q, xrefs: 0040C605

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID: 0W4i$2C!E$4[&]$7S.U$8O?A$;_(Q$=G!Y$A3W5$W7JI
API String ID: 0-83756894
Opcode ID: c1abe5d969104e4faaeeb94a57dcd0a77674fd740321b7385ce3fa244a949eb5
Instruction ID: 8a13822b09b4bc292925f1d19888df92867171a2d993af3176c8b70094e1a36d
Opcode Fuzzy Hash: c1abe5d969104e4faaeeb94a57dcd0a77674fd740321b7385ce3fa244a949eb5
Instruction Fuzzy Hash: D581C2B4900206DBCB20CF55C991BBEB7B1FF46301F64425AE844BB391D339AE51CBA9

Function 003CC9E9 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 003C4EB1: GetLastError.KERNEL32(?,00000008,003C9482), ref: 003C4EB5
Part of subcall function 003C4EB1: SetLastError.KERNEL32(00000000,003DC480,00000024,003C0419), ref: 003C4F57

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 003CCAF5
IsValidCodePage.KERNEL32(00000000), ref: 003CCB3E
IsValidLocale.KERNEL32(?,00000001), ref: 003CCB4D
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 003CCB95
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 003CCBB4

Strings

||=, xrefs: 003CCA4E

Memory Dump Source

Source File: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID: ||=
API String ID: 415426439-2034774733
Opcode ID: 2c18333067dbe8a3b0fbfc3dcc662392f7d8fb0cc0d67142d1ab51136fc311a8
Instruction ID: 31c812d271721f5801776c87779b424935d097f5facadd18ba667eaa730111ed
Opcode Fuzzy Hash: 2c18333067dbe8a3b0fbfc3dcc662392f7d8fb0cc0d67142d1ab51136fc311a8
Instruction Fuzzy Hash: A9518E76A10209ABDB12DFA5DC46FAE77B8FF08700F15506DE919EB190E7709E04CB61

Function 003CD39B Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 003CD57F

Strings

1#QNAN, xrefs: 003CD4AE
1#IND, xrefs: 003CD4A0
1#INF, xrefs: 003CD4D1
1#SNAN, xrefs: 003CD4A7

Memory Dump Source

Source File: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: b4b7b2138f1416f4a85ef6f1314486283da47d5b1dfab1fb703df4793c745eec
Instruction ID: 6f6c69f496a01aa8007b8b18797ba828611b7fc8a0d8b17dd547a6c7ff4dec4b
Opcode Fuzzy Hash: b4b7b2138f1416f4a85ef6f1314486283da47d5b1dfab1fb703df4793c745eec
Instruction Fuzzy Hash: 5FD20A71E086298FDB66CE28DD40BEAB7B9EB45305F1541EEE40DE7240E774AE818F41

Function 003CC085 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 003C4EB1: GetLastError.KERNEL32(?,00000008,003C9482), ref: 003C4EB5
Part of subcall function 003C4EB1: SetLastError.KERNEL32(00000000,003DC480,00000024,003C0419), ref: 003C4F57

GetACP.KERNEL32(?,?,?,?,?,?,003C1848,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 003CC146
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,003C1848,?,?,?,00000055,?,-00000050,?,?), ref: 003CC171
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 003CC2D4

Strings

||=, xrefs: 003CC0C7
utf8, xrefs: 003CC243

Memory Dump Source

Source File: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8$||=
API String ID: 607553120-2131785747
Opcode ID: ccd9c2733a56d079fcd65cda844125d974dc17c157b61aa368efc7f65363be06
Instruction ID: acc3f1bbe7d3378dd3e833838aeef45d9b9b14e0455fd3d19f40bedad0ac87f7
Opcode Fuzzy Hash: ccd9c2733a56d079fcd65cda844125d974dc17c157b61aa368efc7f65363be06
Instruction Fuzzy Hash: A971F675A10306AADB27BB75DC46FAA73ACEF44700F15542EF50ADB182EB74ED4087A0

Function 003CC814 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,003CCB32,00000002,00000000,?,?,?,003CCB32,?,00000000), ref: 003CC8AD
GetLocaleInfoW.KERNEL32(?,20001004,003CCB32,00000002,00000000,?,?,?,003CCB32,?,00000000), ref: 003CC8D6
GetACP.KERNEL32(?,?,003CCB32,?,00000000), ref: 003CC8EB

Strings

ACP, xrefs: 003CC832
OCP, xrefs: 003CC868

Memory Dump Source

Source File: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 3b0a1672d61cbfdc68253acbd9fb6e96278ef37f69b27830dc32c66f37480411
Instruction ID: 151ac4db218926044893d56baa26fab317e2343403bcb5d65c6688d3645d3161
Opcode Fuzzy Hash: 3b0a1672d61cbfdc68253acbd9fb6e96278ef37f69b27830dc32c66f37480411
Instruction Fuzzy Hash: E721A132A20301EADB279F55D901F97B3AABF54B50B57942DE90ED7101EB32DE40D350

Function 003BFEF0 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 449COMMONLIBRARYCODE

Download Yara Rule

Strings

G<, xrefs: 003BFF0B, 003C008E, 003C02B7, 003C0250, 003C00DD
G<, xrefs: 003C0233, 003C0211

Memory Dump Source

Source File: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID: G<$G<
API String ID: 0-2936303400
Opcode ID: b78e9bc5a25061f1abca4818c36b3245c47596756df3441acd3b4668cd2eb70a
Instruction ID: 6561b6f43ba10905550e046d2400d02327fedd6ea9a126a2d1ff03175caeae7b
Opcode Fuzzy Hash: b78e9bc5a25061f1abca4818c36b3245c47596756df3441acd3b4668cd2eb70a
Instruction Fuzzy Hash: 25F11A75E00259DFDB19CFA8D884AADB7B5FF88314F16826DE915EB381D730AD018B90

Function 003DE175 Relevance: 7.2, Strings: 5, Instructions: 909COMMON

Download Yara Rule

Strings

0, xrefs: 003DECA9
0, xrefs: 003DF3A0
0, xrefs: 003DED58
@, xrefs: 003DF90C
i, xrefs: 003DF7FE

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID: 0$0$0$@$i
API String ID: 0-3124195287
Opcode ID: 71f3d092406bf2b1da397f9251c19992cfeb9473183140990b6d77d2ed173c24
Instruction ID: 1639d1a4a949bcb1131dcf9bbfd430e03c9650d7a1134cf75bc0784e89015b18
Opcode Fuzzy Hash: 71f3d092406bf2b1da397f9251c19992cfeb9473183140990b6d77d2ed173c24
Instruction Fuzzy Hash: 9672E472A0C3518FD31ADF28D49076ABBE1AFC5704F158A2EE8D69B391D634DC45CB82

Function 003DE2D5 Relevance: 6.7, Strings: 5, Instructions: 453COMMON

Download Yara Rule

Strings

gfff, xrefs: 003DF033
0, xrefs: 003DE5FB
-, xrefs: 003DEFFD
gfff, xrefs: 003DF0EC
gfff, xrefs: 003DF0A1

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID: -$0$gfff$gfff$gfff
API String ID: 0-1217629319
Opcode ID: e70ea6af7df4099828697e47c503092b59018ffd614456e3a52484d2297035ff
Instruction ID: fa57449803ac75fe6aa1ef92680966bb5c938157d47ea92d6ca683c32c297ab3
Opcode Fuzzy Hash: e70ea6af7df4099828697e47c503092b59018ffd614456e3a52484d2297035ff
Instruction Fuzzy Hash: 01F1B172A083518FD319CE28D49075EFBE2ABD9314F498A2EF4D9CB381D274D945CB42

Function 003EC938 Relevance: 6.7, Strings: 5, Instructions: 409COMMON

Download Yara Rule

Strings

vLyB, xrefs: 003ECCDB, 003ECCE3
\W, xrefs: 003ECAEC
q-s, xrefs: 003ECA32
d`df, xrefs: 003EC94A
JpzN, xrefs: 003ECCA5

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID: JpzN$\W$d`df$vLyB$q-s
API String ID: 0-2943124228
Opcode ID: c0123f9ddd81bde4ead67e13c59693835463b28b846828819b093025ea9eb232
Instruction ID: 32048d21bae0b952675f8ea9e12d96040f405e8a57a84d34baee6014ab661917
Opcode Fuzzy Hash: c0123f9ddd81bde4ead67e13c59693835463b28b846828819b093025ea9eb232
Instruction Fuzzy Hash: 3CD1BFB051C3E08BD712DF1AC45062EBBE5AF92744F281E5CE4D49B392C336C94ACB96

Function 003FEF70 Relevance: 6.5, Strings: 5, Instructions: 258COMMON

Download Yara Rule

Strings

H~, xrefs: 003FEFD5
k$i, xrefs: 003FF259, 003FF25D
zC, xrefs: 003FEFC5
-{4y, xrefs: 003FF17B, 003FF183
KC, xrefs: 003FEFCD

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID: k$i$-{4y$H~$KC$zC
API String ID: 0-1198185020
Opcode ID: cb060303c5a1a0c4baba74594868201dd970643a30ef342180b2144766bb590c
Instruction ID: 0b113ce5d462bac5d2d79196588d405e92923871265991124fc23a2ba7f251ba
Opcode Fuzzy Hash: cb060303c5a1a0c4baba74594868201dd970643a30ef342180b2144766bb590c
Instruction Fuzzy Hash: 1B81AAB04083419BD711AF18C881B3AB7F0EF96764F048A2CE9D59B391E739C905CB9A

Function 003C3C92 Relevance: 6.3, APIs: 4, Instructions: 337COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 003C3D1F

Memory Dump Source

Source File: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 40f0e063838af908aa0c23a01ee66fead67f3bdac29e3056e6e3dd52480c6ad0
Instruction ID: faf9529fa03748be61d53ebc7d8d07569062152194b5065bbb9de2f94cb74049
Opcode Fuzzy Hash: 40f0e063838af908aa0c23a01ee66fead67f3bdac29e3056e6e3dd52480c6ad0
Instruction Fuzzy Hash: 40B12072E042469FDB168F68C891FEEBBB5EF59304F15C16EE805EB241D6349E05CBA0

Function 003B7922 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 003B792E
IsDebuggerPresent.KERNEL32 ref: 003B79FA
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 003B7A13
UnhandledExceptionFilter.KERNEL32(?), ref: 003B7A1D

Memory Dump Source

Source File: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: be6ed7adc7823ca8872c9dc08bb3503a870426c4e7e2a32e72524600cf2d54cc
Instruction ID: 3381d3c45ec9186487b53193e83d9d7674282f5c8e34b311b0b7366beaaa27a4
Opcode Fuzzy Hash: be6ed7adc7823ca8872c9dc08bb3503a870426c4e7e2a32e72524600cf2d54cc
Instruction Fuzzy Hash: F43127B5D062189BDB21DFA4D9497CDBBB8BF08304F1041EAE50DAB250EB709B84CF45

Function 00425288 Relevance: 5.3, Strings: 4, Instructions: 348COMMON

Download Yara Rule

Strings

P, xrefs: 0042542E
oD, xrefs: 0042551C
kD, xrefs: 00425509
, xrefs: 004255BE, 00425717, 004256EB, 0042559B, 004255A3, 004256F3

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID: P$kD$oD$
API String ID: 0-1115615460
Opcode ID: ed1cfad7e5831a2e1b48057f332d66576bd6f5d84c9fae2d0d95bb32115eec55
Instruction ID: 54a0f98cfb6f632ce8063df6b1116d1c11c3fc68a97deb998c26ab3c1894305c
Opcode Fuzzy Hash: ed1cfad7e5831a2e1b48057f332d66576bd6f5d84c9fae2d0d95bb32115eec55
Instruction Fuzzy Hash: 88C111326087608FC715CE28E84071FB7E1ABC5714F598A2DE8A5AB380D779DD45CBC6

Function 003FFAE2 Relevance: 5.2, Strings: 4, Instructions: 209COMMON

Download Yara Rule

Strings

I}, xrefs: 003FFB3E
I}, xrefs: 003FFD29
v}, xrefs: 003FFB37
~, xrefs: 003FFB45

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID: I}$I}$v}$~
API String ID: 0-1535326304
Opcode ID: 18d941ddf0c7df2a2020a84959c7baed37afdcccf923d2de2c574be5e132557b
Instruction ID: 61e284253c1c31e116c4063bf16b101347b84c10e9b4e54082b3db3e3c8fb133
Opcode Fuzzy Hash: 18d941ddf0c7df2a2020a84959c7baed37afdcccf923d2de2c574be5e132557b
Instruction Fuzzy Hash: A061A0B090026A8FDB11CF94CC91BBEBBB1FF46340F184958E890AF391D3399841CB65

Function 00423642 Relevance: 5.1, Strings: 4, Instructions: 142COMMON

Download Yara Rule

Strings

@, xrefs: 004237F5
Q_, xrefs: 00423652
, xrefs: 0042385E, 0042383B, 00423843
US, xrefs: 0042364A

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID: @$Q_$US$
API String ID: 0-1387636662
Opcode ID: b84bd2cad6fc919d03a3147de07ecc8b5f863db2d204b0a85fdfcd1955775bcd
Instruction ID: 9e68f25d3d3e02499acb644becfea1985d63058a21c018cbb9e62023f5dba267
Opcode Fuzzy Hash: b84bd2cad6fc919d03a3147de07ecc8b5f863db2d204b0a85fdfcd1955775bcd
Instruction Fuzzy Hash: 1941A7B0608351ABD714EF04D45062BBBF0EF86349F94891EF4C5AB361E339DA45CB5A

Function 003CC498 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 003C4EB1: GetLastError.KERNEL32(?,00000008,003C9482), ref: 003C4EB5
Part of subcall function 003C4EB1: SetLastError.KERNEL32(00000000,003DC480,00000024,003C0419), ref: 003C4F57

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 003CC4EC
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 003CC536
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 003CC5FC

Memory Dump Source

Source File: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 92ca6541eb9658f34d0344e1178b9e4518e95979989f41ec53217e94654c403e
Instruction ID: 44404454e648101936a0972958a7c670ba5bfe772cc574bc2874784c2e14f089
Opcode Fuzzy Hash: 92ca6541eb9658f34d0344e1178b9e4518e95979989f41ec53217e94654c403e
Instruction Fuzzy Hash: 5D61B1725201079FDB2ADF25CD82FAA73A8EF04310F15617EE90AC6585EB34ED54CB50

Function 003BDA73 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 003BDB6B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 003BDB75
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 003BDB82

Memory Dump Source

Source File: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 9afd11a2f3b836ed039d8a3718429b5e3f27abc628c1dec7edecfc3ef39995c2
Instruction ID: d1068d6aa941fcdea39a2a63a50d27103d7adaf2261ac73148840ff4bcf37cca
Opcode Fuzzy Hash: 9afd11a2f3b836ed039d8a3718429b5e3f27abc628c1dec7edecfc3ef39995c2
Instruction Fuzzy Hash: 3531C6749012189BCB22DF64DC89BCCBBB8BF48314F5045EAE51DAB250E7749F858F45

Function 004236EE Relevance: 3.9, Strings: 3, Instructions: 122COMMON

Download Yara Rule

Strings

@, xrefs: 004237F5
]oXm, xrefs: 00423716
, xrefs: 0042385E, 0042383B, 00423843

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID: @$]oXm$
API String ID: 0-4013158905
Opcode ID: 08b563d773aac84b36ad4809571cbbdf506584426bf330bc6785f7f8a4602933
Instruction ID: 6b5287e73e5298ad5eac749b64faa83f7ff68c871229e2241eeecb67e2d62aef
Opcode Fuzzy Hash: 08b563d773aac84b36ad4809571cbbdf506584426bf330bc6785f7f8a4602933
Instruction Fuzzy Hash: 174173B05083519BC7109F15D09062BBBF0EF86349F84880EF4C9AB261D339CA45CB5A

Function 0040C224 Relevance: 3.8, Strings: 3, Instructions: 38COMMON

Download Yara Rule

Strings

KFCI, xrefs: 0040C252
Q^\X, xrefs: 0040C23A
UNOc, xrefs: 0040C232

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID: KFCI$Q^\X$UNOc
API String ID: 0-1593643587
Opcode ID: c1021c8647da17318554d3aa5cff67c87dd53425995099f84c7b189f47ca34d0
Instruction ID: 273adc21441de423725eb3c75b6573da2afa36f9fa0ee71e7f9eb65ddba27570
Opcode Fuzzy Hash: c1021c8647da17318554d3aa5cff67c87dd53425995099f84c7b189f47ca34d0
Instruction Fuzzy Hash: 96110DB0508380ABD3218F95C480A1EFFF0AB86780F50895DF9D857661C379C8858F17

Function 003C622B Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,003C23AE,?,20001004,00000000,00000002,?,?,003C19B0), ref: 003C625F

Strings

R[;, xrefs: 003C624A

Memory Dump Source

Source File: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID: InfoLocale
String ID: R[;
API String ID: 2299586839-2017283703
Opcode ID: 0f7ad66735ad687bddd83578c7329997babe0446933aefd44a51f3b1b3671180
Instruction ID: f8da6cde143b109afeda34020a47c2e8925421de1ac55b099d28b8ef6ec7a4d7
Opcode Fuzzy Hash: 0f7ad66735ad687bddd83578c7329997babe0446933aefd44a51f3b1b3671180
Instruction Fuzzy Hash: FCE04F36501228BBCF132F60EC0AFAE7F2AEF44760F008419FD05A5121CB71CE20ABA1

Function 004249F8 Relevance: 2.8, Strings: 2, Instructions: 288COMMON

Download Yara Rule

Strings

, xrefs: 00424A69, 00424B39, 00424C4D, 00424B70, 00424B0C, 00424A3C, 00424A48, 00424B18, 00424B7B, 00424C56
, xrefs: 00424C0C, 00424BDC, 00424BE5

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-1425349742
Opcode ID: a72b061ef2fa19078f6f09b4256c813a26286e548eea71359ce8abeef3a1e115
Instruction ID: 0cbd88f4113df3478bb2e14ebb62b67ec06bb080a1c9f00726dfed9735e3a310
Opcode Fuzzy Hash: a72b061ef2fa19078f6f09b4256c813a26286e548eea71359ce8abeef3a1e115
Instruction Fuzzy Hash: 6EA1CF71708360ABDB20CB55D840BABBBE5EBC5314F95482EF58587351E738E940CB9A

Function 00426FD8 Relevance: 2.7, Strings: 2, Instructions: 228COMMON

Download Yara Rule

Strings

, xrefs: 004270CE
, xrefs: 0042702E, 00427142, 0042711B, 0042700B, 00427013, 00427123

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-1425349742
Opcode ID: e90198aaeed22a300b19465d833889039e3ddf500042478477c72a525097edc6
Instruction ID: ebd05ecd106a09979100abad32ace79bade6e963df0f21ec24318afdfbc72f33
Opcode Fuzzy Hash: e90198aaeed22a300b19465d833889039e3ddf500042478477c72a525097edc6
Instruction Fuzzy Hash: 9E71CE7060C351ABCB10AF58E881A2FB7E5EF55704F94881DF5C58B3A2D339D824CB5A

Function 00405EC3 Relevance: 2.6, Strings: 2, Instructions: 140COMMON

Download Yara Rule

Strings

^TPX, xrefs: 00405FE9
6, xrefs: 00406061

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID: 6$^TPX
API String ID: 0-3674074485
Opcode ID: e2faa7a7b5874149e8eed49c136e69c5cac99755a3b347c5e8b82d654e240883
Instruction ID: 258dbd2bf9e2935862b64c9e31810a41ae3903b77b4008fcb6b4f2585ccc8784
Opcode Fuzzy Hash: e2faa7a7b5874149e8eed49c136e69c5cac99755a3b347c5e8b82d654e240883
Instruction Fuzzy Hash: B45100B050C7818FD3629F2A858062BFBF2AB92785F64596DE0E15B3A1C339C445CF1B

Function 00426EA8 Relevance: 2.6, Strings: 2, Instructions: 98COMMON

Download Yara Rule

Strings

, xrefs: 00426F7E, 00426F5B, 00426F63
@, xrefs: 00426F10

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID: @$
API String ID: 0-736778079
Opcode ID: 0ac285f3c4d7bf6ff568a0e3d31a6644a2a8a6f4a62bd3ece0da7e21683cf0fc
Instruction ID: fed0d7c02c840e6d6d37b293721d6863de3f6fb8d36948002d4d6dc7f56f77f8
Opcode Fuzzy Hash: 0ac285f3c4d7bf6ff568a0e3d31a6644a2a8a6f4a62bd3ece0da7e21683cf0fc
Instruction Fuzzy Hash: E2319A716083009BC714DF14E980A2FFBF5EF86309F55892DE99897291D339D908CB9A

Function 003EBB58 Relevance: 2.6, Strings: 2, Instructions: 82COMMON

Download Yara Rule

Strings

p, xrefs: 003EBBE9
p, xrefs: 003EBBC1, 003EBB9B

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID: p$p
API String ID: 0-2001073228
Opcode ID: 9ccebd6029074dcc193b65c5d4f3edf18eb513497d73d4234c938a2efa72fd27
Instruction ID: 777cb641b9a93033873c861dae536d165410d510672ae149c60c5e46a134493c
Opcode Fuzzy Hash: 9ccebd6029074dcc193b65c5d4f3edf18eb513497d73d4234c938a2efa72fd27
Instruction Fuzzy Hash: 723120B0D1028A9BDB01CF99D4866AEFFB1FB0A310F144619E550FB781D334A994CBE5

Function 003E6C29 Relevance: 2.6, Strings: 2, Instructions: 71COMMON

Download Yara Rule

Strings

8, xrefs: 003E6C7F
0, xrefs: 003E6C87

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID: 0$8
API String ID: 0-46163386
Opcode ID: 101362e4397cd3868e0d82b2d27283c317da1e6fc92abe76afbb474ffa19d7ef
Instruction ID: 254317338bc20824c2f1336f4285b053aea2ccca47eb8f32d9984f0b0f78fedf
Opcode Fuzzy Hash: 101362e4397cd3868e0d82b2d27283c317da1e6fc92abe76afbb474ffa19d7ef
Instruction Fuzzy Hash: EE31F53660D3C58FD315CA68848069FFBE1ABE6354F484D4CE8C4A7382CA74D809CBA3

Function 003DDED8 Relevance: 2.5, Strings: 1, Instructions: 1296COMMON

Download Yara Rule

Strings

@, xrefs: 003DFE4D

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 0f2fb15fb640a0ac74f7ebf11ae0a00e79eb1ebbcee514835237cce2622ebf17
Instruction ID: 791c5aa5f9691d7aa5a67220c3c2d0279ff594f2a998ab44f12c850acd2a6bd8
Opcode Fuzzy Hash: 0f2fb15fb640a0ac74f7ebf11ae0a00e79eb1ebbcee514835237cce2622ebf17
Instruction Fuzzy Hash: 9E92F7726083518FC71ACF29D4C436ABBE2AFC5314F198A2EE8969B391D374DD45CB81

Function 00421798 Relevance: 1.9, Strings: 1, Instructions: 618COMMON

Download Yara Rule

Strings

f, xrefs: 00421976

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID: f
API String ID: 0-1993550816
Opcode ID: b38e6f6da0f4ee892dc7bd84d3849ea3ee91e3c5acb601456a1049e317f3aa66
Instruction ID: 141af3f53a33cf217290d7f7a7fe7798b177d79938b57825002bb6b4d79e62f4
Opcode Fuzzy Hash: b38e6f6da0f4ee892dc7bd84d3849ea3ee91e3c5acb601456a1049e317f3aa66
Instruction Fuzzy Hash: BA22CD716083509FC714CF19D880A2BBBE1BF99314F988A2EF495873A1D739E944CB5A

Function 003C572C Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,003C5727,?,?,00000008,?,?,003D15F5,00000000), ref: 003C5959

Memory Dump Source

Source File: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 77e76b09d3d55533cc8338a75b3417aee381c793724a2d642c94a4df69caaefc
Instruction ID: 215831955188b64d45961da6cfc303ce5894c5eb4cab7ab973660b9a5fcd9823
Opcode Fuzzy Hash: 77e76b09d3d55533cc8338a75b3417aee381c793724a2d642c94a4df69caaefc
Instruction Fuzzy Hash: 08B1F836610A08DFD716CF28C486B657BA0FB45365F26869CE89ACF2A1C735ED91CB40

Function 003B729C Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 003B72B2

Memory Dump Source

Source File: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: ae428fbaa99ad5178b29519e13a8490df5ddf0761c2c5a8ad92ddc05926d3b67
Instruction ID: a26ebc426516de1028480f7b3b88b51532a452ace19f7430066f151ae4182595
Opcode Fuzzy Hash: ae428fbaa99ad5178b29519e13a8490df5ddf0761c2c5a8ad92ddc05926d3b67
Instruction Fuzzy Hash: 90A1A4B59066059FDB1ACF68E88179DBBF4FB84314F29812BD51AE7360D3349941CF90

Function 003E05B8 Relevance: 1.7, Strings: 1, Instructions: 448COMMON

Download Yara Rule

Strings

CD, xrefs: 003E0616

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID: CD
API String ID: 0-3115673787
Opcode ID: 4c0b4b88843fe66386dd9f80ba3723d5ab93d35f761372caa74b535c6bc6894e
Instruction ID: 101a3d667ba4e9f71ec24de7dd97c6dc3657b38584e54d37990ee06a4678e04d
Opcode Fuzzy Hash: 4c0b4b88843fe66386dd9f80ba3723d5ab93d35f761372caa74b535c6bc6894e
Instruction Fuzzy Hash: 71E1D572A083519BC709CF29C88065EB7E6FBC8750F258A2DF898973D1E774DD858B81

Function 00405368 Relevance: 1.7, Strings: 1, Instructions: 415COMMON

Download Yara Rule

Strings

TW, xrefs: 0040538A

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID: TW
API String ID: 0-1778470648
Opcode ID: 37e65682408c37040f626a0ca88badc03505eecafd751e2c16e196c146a53e28
Instruction ID: ea6a47cf0bed9a6f5c3688dfdd98ec56b756c08b679fb9ed11b14fd242d50fcb
Opcode Fuzzy Hash: 37e65682408c37040f626a0ca88badc03505eecafd751e2c16e196c146a53e28
Instruction Fuzzy Hash: FCC1B2B1508710ABD711AB14C841A2BB7F5EF91750F48892EF8C8AB391E339DD50CB6B

Function 003C9ABF Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a3c515991595875276574089a9bec793bab5915a1ea7b6fbfb7bec72e19f507
Instruction ID: b7c97dfee73da991aa0cfd271b3e45639dbb7c0100eaeda4289af3acf06a7671
Opcode Fuzzy Hash: 8a3c515991595875276574089a9bec793bab5915a1ea7b6fbfb7bec72e19f507
Instruction Fuzzy Hash: 4831F776900219AFCB25DFB8DC89FAB777DEB84314F15415EF905D7244EA30AE408B50

Function 003BCAF2 Relevance: 1.6, Strings: 1, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 003BCC80

Memory Dump Source

Source File: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 298be90568e21d2005a3f7593f4d7587c3bd3704699e340014ba41fd8020c1ef
Instruction ID: 099caee4d3797733b1b4bb301129adf5ff8933a734f8b915c850d29109f0fd2e
Opcode Fuzzy Hash: 298be90568e21d2005a3f7593f4d7587c3bd3704699e340014ba41fd8020c1ef
Instruction Fuzzy Hash: A1C111746206098FCB36CF28C491AFEBBB1AF55308F15662DD6569BE91C730EC46CB90

Function 0041074E Relevance: 1.6, Strings: 1, Instructions: 336COMMON

Download Yara Rule

Strings

-'.$, xrefs: 00410989

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID: -'.$
API String ID: 0-2031752551
Opcode ID: 34e3f814482b72035446470293d0cf0e4fa038b8cce2f5f390abddc47372c923
Instruction ID: ff02151cc7ccc4cfb76f3bddd383525e9c3083cc27667b946f799588a660ad6d
Opcode Fuzzy Hash: 34e3f814482b72035446470293d0cf0e4fa038b8cce2f5f390abddc47372c923
Instruction Fuzzy Hash: E9B18EB0504B818FD7268F29C090B62FBF1EF56314F14858ED4EA9B752C379E886CB95

Function 003CC6EB Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 003C4EB1: GetLastError.KERNEL32(?,00000008,003C9482), ref: 003C4EB5
Part of subcall function 003C4EB1: SetLastError.KERNEL32(00000000,003DC480,00000024,003C0419), ref: 003C4F57

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 003CC73F

Memory Dump Source

Source File: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 3cd4127c14970009d48ddacfefe93779570e806ad430ca5d64d012a86c300406
Instruction ID: 1462e233338eafcfe3397f1ee77311823e532d4450306d24f429b7b18a8417df
Opcode Fuzzy Hash: 3cd4127c14970009d48ddacfefe93779570e806ad430ca5d64d012a86c300406
Instruction Fuzzy Hash: B6218332521206AFEB1A9F25DC42FBA77ACEF44314F11507EF909DA141EB35DD418B54

Function 003CC372 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 003C4EB1: GetLastError.KERNEL32(?,00000008,003C9482), ref: 003C4EB5
Part of subcall function 003C4EB1: SetLastError.KERNEL32(00000000,003DC480,00000024,003C0419), ref: 003C4F57

EnumSystemLocalesW.KERNEL32(003CC498,00000001,00000000,?,-00000050,?,003CCAC9,00000000,?,?,?,00000055,?), ref: 003CC3E4

Memory Dump Source

Source File: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: ab2a7c8305cd8b893b48d5c1e50bacb404cb29b8716fafc93a72d32cc61d3b13
Instruction ID: 5dab3dc65591e1abbf970d8e085f62e1a067cc1d8141776fdbfad150ee106512
Opcode Fuzzy Hash: ab2a7c8305cd8b893b48d5c1e50bacb404cb29b8716fafc93a72d32cc61d3b13
Instruction Fuzzy Hash: 9011253B2103015FDB199F39D8A1ABABBA1FF80768B15842DE94B87A40D775AD42C740

Function 003CC91A Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 003C4EB1: GetLastError.KERNEL32(?,00000008,003C9482), ref: 003C4EB5
Part of subcall function 003C4EB1: SetLastError.KERNEL32(00000000,003DC480,00000024,003C0419), ref: 003C4F57

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,003CC6B4,00000000,00000000,?), ref: 003CC946

Memory Dump Source

Source File: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 33fa86443e0196b181fd7548a071f2a1c16008f02f5d68086642a626ed6c2f2b
Instruction ID: 471e7bd4cd1b903cea102429ae7e40560298df3eaca592ac38a902bb34aa45b9
Opcode Fuzzy Hash: 33fa86443e0196b181fd7548a071f2a1c16008f02f5d68086642a626ed6c2f2b
Instruction Fuzzy Hash: CBF0F433A20111BBDB2A9B318805FBAB7A8FB40754F06442CEC0AE3180EB30FE01C790

Function 003CC40D Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 003C4EB1: GetLastError.KERNEL32(?,00000008,003C9482), ref: 003C4EB5
Part of subcall function 003C4EB1: SetLastError.KERNEL32(00000000,003DC480,00000024,003C0419), ref: 003C4F57

EnumSystemLocalesW.KERNEL32(003CC6EB,00000001,?,?,-00000050,?,003CCA8D,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 003CC457

Memory Dump Source

Source File: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 88c0206f2bb548274f480184688e12660b7f82307c9236444207fd6a5fc4d558
Instruction ID: e482f06b084bd162614fe642ee4ad9b58e0e67b915660f1c9ae50d1ab9ade204
Opcode Fuzzy Hash: 88c0206f2bb548274f480184688e12660b7f82307c9236444207fd6a5fc4d558
Instruction Fuzzy Hash: 58F0C2362103045FDB1A5F7ADC91F7A7B95EB80768F16842DF94ACB690C671AC42C750

Function 003C5D7F Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 003BDDC1: EnterCriticalSection.KERNEL32(?,?,003C4B89,?,003DC2E0,00000008,003C4D4D,?,003BC446,?), ref: 003BDDD0

EnumSystemLocalesW.KERNEL32(003C5D72,00000001,003DC3A0,0000000C,003C6127,00000000), ref: 003C5DB7

Memory Dump Source

Source File: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: eefb895e9680aafb3e86f808aaf6f3acdb68477377130420b54693e5af081631
Instruction ID: 8df3fc5c4305ac9baced69418758b56111f049f4e4f9f6e8fa73b787b36ddf55
Opcode Fuzzy Hash: eefb895e9680aafb3e86f808aaf6f3acdb68477377130420b54693e5af081631
Instruction Fuzzy Hash: EAF0A976A40304EFD712EF98E846B8C7BB0FB44320F00412AF412DB2A0CBB55900CF40

Function 003CC327 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 003C4EB1: GetLastError.KERNEL32(?,00000008,003C9482), ref: 003C4EB5
Part of subcall function 003C4EB1: SetLastError.KERNEL32(00000000,003DC480,00000024,003C0419), ref: 003C4F57

EnumSystemLocalesW.KERNEL32(003CC280,00000001,?,?,?,003CCAEB,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 003CC35E

Memory Dump Source

Source File: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: ac011fc702025f026ff9cfc97358481f688ff665c1d762881dd881490de97fa7
Instruction ID: 6ce35947372841e84773d52f625df7e5d903269ac259aeb53b22d8c8fb5d957f
Opcode Fuzzy Hash: ac011fc702025f026ff9cfc97358481f688ff665c1d762881dd881490de97fa7
Instruction Fuzzy Hash: 7CF0E53A30024557CB169F75E855B6ABF94FFC1B60F0B405DEA09CB690C6759D43C790

Function 0040A059 Relevance: 1.5, Strings: 1, Instructions: 267COMMON

Download Yara Rule

Strings

P, xrefs: 0040A397

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: 4bfaa7626ea9b600e4b84af23bd05a8ca6e36999e86aa202f38862eca0be855c
Instruction ID: 71084e49c3e4c16e3c2ee2b71222c5fa9059589b34d9dbed8294f65fb991ab41
Opcode Fuzzy Hash: 4bfaa7626ea9b600e4b84af23bd05a8ca6e36999e86aa202f38862eca0be855c
Instruction Fuzzy Hash: 40A1E2719083458BE7109A15C88036FBBE1EB95390F184A7EE885AB3D2D33DC965DB4B

Function 003DE212 Relevance: 1.5, Strings: 1, Instructions: 264COMMON

Download Yara Rule

Strings

@, xrefs: 003DE7F8

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 306e642b51b2512054d38a46158e9f08723d7b25d1953b1fc47caece9ac7f322
Instruction ID: d4ab0e9930a7657499fd85b347b3acb3f23c84c9c69b86155bdf2e1f37e9ac9a
Opcode Fuzzy Hash: 306e642b51b2512054d38a46158e9f08723d7b25d1953b1fc47caece9ac7f322
Instruction Fuzzy Hash: DAA1BB72A087519FD315CE18E4D435AFBE2AFC4714F198A2EE8DA5B391C7349C49CB82

Function 003B7AAF Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00007ABB,003B6DC9), ref: 003B7AB4

Memory Dump Source

Source File: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 7f19f53d539a3226c94646c6c9643c814c50c64d10f2ac1e10123a46b697fa60
Instruction ID: 0511f73df496164e895048b2b1b3ba1dfa13ecccb0be06c8d3878a1ac974fa9b
Opcode Fuzzy Hash: 7f19f53d539a3226c94646c6c9643c814c50c64d10f2ac1e10123a46b697fa60
Instruction Fuzzy Hash:

Function 004274F8 Relevance: 1.5, Strings: 1, Instructions: 247COMMON

Download Yara Rule

Strings

, xrefs: 00427552, 0042760E, 004275EB, 0042752B, 00427533, 004275F3

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3019521637
Opcode ID: 08d3931baa2a9c42408cb6ec1c64e50b571bbd3c3c2ceb0987ed0c3721af9082
Instruction ID: b694204b62b212f1cdb720237aa22924a6ac8257849f11b203a960e92870f6fe
Opcode Fuzzy Hash: 08d3931baa2a9c42408cb6ec1c64e50b571bbd3c3c2ceb0987ed0c3721af9082
Instruction Fuzzy Hash: 6681F1757083219BCB249F18D880A2BB7E1FF85710F99882DF88597351D739EC50CB8A

Function 0040E388 Relevance: 1.5, Strings: 1, Instructions: 237COMMON

Download Yara Rule

Strings

", xrefs: 0040E64C

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 7e98b4656ee7a597cc4d0ae5467a7c4b97e5a60aa5ade5d03bcc0f57a0d03316
Instruction ID: 360f10a251945c677da9ce3c56ed37f78c89fd6ed58a68ae17be791eef46dc94
Opcode Fuzzy Hash: 7e98b4656ee7a597cc4d0ae5467a7c4b97e5a60aa5ade5d03bcc0f57a0d03316
Instruction Fuzzy Hash: D171F6327083504FD724892E988031BB6D26BD6334F688F3EE4B4AB3E1D679CC55974A

Function 004247F8 Relevance: 1.4, Strings: 1, Instructions: 183COMMON

Download Yara Rule

Strings

, xrefs: 004248BE, 004249A8, 0042497B, 0042489B, 004248A3, 00424983

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3019521637
Opcode ID: caa00a0baa876a8884e4083aa7b8b58c4b77efdead5d9ec54620c567e662e154
Instruction ID: 40a20033ebb15cce9e9c9d490f5e901af66acc34c65099cef49542a32f26373f
Opcode Fuzzy Hash: caa00a0baa876a8884e4083aa7b8b58c4b77efdead5d9ec54620c567e662e154
Instruction Fuzzy Hash: 52510170708320ABC7049E29E881B2FB7E5EBC5714F948A2DE9D997391C239DC00C75A

Function 00410AD4 Relevance: 1.4, Strings: 1, Instructions: 161COMMON

Download Yara Rule

Strings

2FD>, xrefs: 00411F68

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID: 2FD>
API String ID: 0-1510312430
Opcode ID: 242552adc178d8c3491bf93f30874780fcc0fbb89b54cad1dcff1d541b57b90a
Instruction ID: f2ea315658f9b99737d53ea0c778e795377b05014baf7a8337734484916c56fd
Opcode Fuzzy Hash: 242552adc178d8c3491bf93f30874780fcc0fbb89b54cad1dcff1d541b57b90a
Instruction Fuzzy Hash: 735173705047818FDB268F15C050A66FBB1EF17354F54888ED8E69BB93C339E846CB69

Function 003EFA44 Relevance: 1.4, Strings: 1, Instructions: 160COMMON

Download Yara Rule

Strings

2, xrefs: 003EFADA

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID: 2
API String ID: 0-450215437
Opcode ID: e6034f399045d4b6abb2554f6b82214a593dffe65b117c12c080d18cf511f5b9
Instruction ID: 49061686a733c0871449d7eb55f03eae1613b62d61cb6cf76fe669f827e9f50b
Opcode Fuzzy Hash: e6034f399045d4b6abb2554f6b82214a593dffe65b117c12c080d18cf511f5b9
Instruction Fuzzy Hash: DA5163B16493C0DBE632A7118851FEFB6A5BFD6304F08092CE48D5B2C2D7769505C767

Function 003EFCD4 Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

2, xrefs: 003EFD63

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID: 2
API String ID: 0-450215437
Opcode ID: 15cde75e9d06dabda2588e85d20db4463443109759951a92bfa7a8f5d5147061
Instruction ID: cd646f6d75f2ca142819ab25dbda1645fedb3ced7b671629c70b308e88f0bba0
Opcode Fuzzy Hash: 15cde75e9d06dabda2588e85d20db4463443109759951a92bfa7a8f5d5147061
Instruction Fuzzy Hash: BC51B3B164A3C0DBE632A7118C52FEFB6A1BFD5300F080A2CE4895B2C2D776A515C767

Function 003B1D79 Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

Z81xbyuAua, xrefs: 003B1E9B

Memory Dump Source

Source File: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID: Z81xbyuAua
API String ID: 0-3121583705
Opcode ID: 8fceef607cc619a448522f3e820053f5ab165fab2bb91e5e9e0b710d57b9c84c
Instruction ID: d014b8ab077403074151e49a654b62630cde71fd8fc0c0ffc6b77aa29d7f9237
Opcode Fuzzy Hash: 8fceef607cc619a448522f3e820053f5ab165fab2bb91e5e9e0b710d57b9c84c
Instruction Fuzzy Hash: AA413C76E2052B4BCB4CEEB8C8560EFBB68E746354B41423ADE11DB7D1E230CA01C6D0

Function 00411327 Relevance: 1.4, Strings: 1, Instructions: 141COMMON

Download Yara Rule

Strings

2FD>, xrefs: 00411F68

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID: 2FD>
API String ID: 0-1510312430
Opcode ID: 482e1bb03dcd7035389772e6bba219ce3904a568faca1742d2efed7deef8c6d7
Instruction ID: 35d8ab3bfea3fdfaedf390e37ea9ef86203131f9568a5280d2799c66a8d14a63
Opcode Fuzzy Hash: 482e1bb03dcd7035389772e6bba219ce3904a568faca1742d2efed7deef8c6d7
Instruction Fuzzy Hash: D5416F701047818EDB268F258050A76FBB0AF17354F64888ED8D69BB92C339E847CB59

Function 00426B98 Relevance: 1.4, Strings: 1, Instructions: 131COMMON

Download Yara Rule

Strings

, xrefs: 00426BF7, 00426CAE, 00426C8B, 00426BCC, 00426BD5, 00426C93

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3019521637
Opcode ID: 3f681d420308340ce622b70d3801fe125027f74667fc1b293c25dd6169613fb3
Instruction ID: eaef43d81b82f9800272a15be047ea10bdc71bf1075d134db8e978e27d296303
Opcode Fuzzy Hash: 3f681d420308340ce622b70d3801fe125027f74667fc1b293c25dd6169613fb3
Instruction Fuzzy Hash: D841B070708310ABD714AF15E990B2BBBE5EF86714FA5882EF8C997351C339D800CB5A

Function 00426D28 Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

, xrefs: 00426D87, 00426E3E, 00426E1B, 00426D5C, 00426D65, 00426E23

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3019521637
Opcode ID: 35ff341fea01c2b82f004fdc622a9334d9847dfee3824cdca80f10c1f8328be7
Instruction ID: 4327ccac7ce1901b30e802451b12992c4621bd4f3a7bb4e2de581c3e404ed8d5
Opcode Fuzzy Hash: 35ff341fea01c2b82f004fdc622a9334d9847dfee3824cdca80f10c1f8328be7
Instruction Fuzzy Hash: 7D41BF74708350ABD7109F14E980B2FBBE5EF86715FA6882EF48957351C339E810CB5A

Function 003FAF2D Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

qs, xrefs: 003FAF96

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID: qs
API String ID: 0-1399850505
Opcode ID: 8aaebf1e4c3640f5f3ce392bc9914373ba4fadcd76e73042caaaaaebe0853f7e
Instruction ID: 11b80675a524ea6bc6ad2aa30195e4272dd7e1f835546be49d9682d399a23595
Opcode Fuzzy Hash: 8aaebf1e4c3640f5f3ce392bc9914373ba4fadcd76e73042caaaaaebe0853f7e
Instruction Fuzzy Hash: 603132B0100B008BC731CF25D991A23B7F1FF1A750B549A0DE9AA8FAA1E335F840CB25

Function 004238E2 Relevance: 1.3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

, xrefs: 0042394E, 0042392B, 00423933

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3019521637
Opcode ID: 6755f9bab069ea5934903f8183f253ded6f2aca177a558b48b1de12272a79bcd
Instruction ID: 7d3d39dbf70dba45a93cfd217bc997f1cd45a4b3690d32ce9e151e211aa9fbcc
Opcode Fuzzy Hash: 6755f9bab069ea5934903f8183f253ded6f2aca177a558b48b1de12272a79bcd
Instruction Fuzzy Hash: 2321CFB0208301ABD704DF08DC41B2AB7F5AB82706F94891CF1C1973E1C3B9E950CB5A

Function 003CCC4B Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 003CCC4B

Memory Dump Source

Source File: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 91aa32b434aed491a8a3dbae689e4def8cbccbaf5faf80cb7dfd22464c0d3048
Instruction ID: 1848408b379168cde080f69718ffb3d864ea497c5165500388293703a085bdf1
Opcode Fuzzy Hash: 91aa32b434aed491a8a3dbae689e4def8cbccbaf5faf80cb7dfd22464c0d3048
Instruction Fuzzy Hash: 05A02470101101CF4700CF357D0730C37DC55013C0704C0355000C4130D73045405F41

Function 003E8F38 Relevance: .8, Instructions: 789COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55bdd7183e786f206f49eb0e89a9435e12bd88c65a2001897e8b962e1375b007
Instruction ID: 31dca1e62b04f2d34533f406f1612122df361447fa3532f7f8035ed02f1c92a8
Opcode Fuzzy Hash: 55bdd7183e786f206f49eb0e89a9435e12bd88c65a2001897e8b962e1375b007
Instruction Fuzzy Hash: 0942E6316047658BC726DF2AD8807AEB3E1FFC5315F268A2ED996872C1E734D841CB42

Function 00401908 Relevance: .7, Instructions: 700COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16869c809fe6b9c013eb52f11e203e487ef228a061d05dc0c8baca727ee9c214
Instruction ID: 878a36da789578bb4d808c51b8fe43f89eeb6acd64084a4b46f48c5b98f5b83d
Opcode Fuzzy Hash: 16869c809fe6b9c013eb52f11e203e487ef228a061d05dc0c8baca727ee9c214
Instruction Fuzzy Hash: DB72F6B0508B818ED371CF3C8849797BFE5AB1A324F044A5EE0EA8B3D2C3756505CB66

Function 003E8428 Relevance: .7, Instructions: 670COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 169fd697c981202875bdf4f7b877c3bbabddd2f5e73f7c32bbe4a1385d044f0b
Instruction ID: 5c308fd73fa3ca566dfac55aefe015949ab0db9d4cf76158519834038c5d4dc2
Opcode Fuzzy Hash: 169fd697c981202875bdf4f7b877c3bbabddd2f5e73f7c32bbe4a1385d044f0b
Instruction Fuzzy Hash: 7952C470D08BE48FE736CB25C4843ABBBE1EB51310F554A2DD5EE16AC2CB79A885C701

Function 003E4278 Relevance: .7, Instructions: 657COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e65e6d0ec29a0286690b312841c0ba80701f8bb5ada55794a20425fd9e091869
Instruction ID: 4bf9faa559c6c5f28722654c88041c9e09c8fedeeb973d29539dc1e4ae8de3dc
Opcode Fuzzy Hash: e65e6d0ec29a0286690b312841c0ba80701f8bb5ada55794a20425fd9e091869
Instruction Fuzzy Hash: CD52E5319083A58FCB16CF16C0906AEBBE1FF89314F5A8B6DE89957381D735E849CB41

Function 003E4C78 Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b4942d6c5a04db89343f61d2bd896b7a754b8bfa492006bc517a5ac4323522e
Instruction ID: 3a70320b48c92727b1ef56510786a7ac17b0def34b85755ade6d871b7ff84af3
Opcode Fuzzy Hash: 8b4942d6c5a04db89343f61d2bd896b7a754b8bfa492006bc517a5ac4323522e
Instruction Fuzzy Hash: DF323670515BA08FC36ACF2AC58062AB7F1BF85714B614A2ED6A787F90D376F845CB10

Function 003E7338 Relevance: .5, Instructions: 504COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2ed25ed2ecece428dec3d662da4c49c86df14d0f0cac3c7bd7da9d139c37883
Instruction ID: f0a0f3c08611d71cb7f8cba5830a6455a2b3f7602015a95de80e8ccba13880a5
Opcode Fuzzy Hash: c2ed25ed2ecece428dec3d662da4c49c86df14d0f0cac3c7bd7da9d139c37883
Instruction Fuzzy Hash: 4C02D07160C7818FC729CF2AC88166BFBE2AFD8300F08892DE4D687791E675D904CB56

Function 0040A438 Relevance: .4, Instructions: 380COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83d948c1b98276872fbedeb4ae571c7f1df7ffbfed0eb7000220ee8de56deee4
Instruction ID: 489d232ff1f0dccf9c42f587382d7d72ecc4aad64aa5c60fd2f1bd7688ad56ee
Opcode Fuzzy Hash: 83d948c1b98276872fbedeb4ae571c7f1df7ffbfed0eb7000220ee8de56deee4
Instruction Fuzzy Hash: 52B1F2B16083409BD714DB24C890A2FB7E2EF95304F58893EE4C6A7391D339E965CB5B

Function 0041143A Relevance: .4, Instructions: 358COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5e5a161c1ab45c4b1e480cfbddb13b76eded34dc1ce46f9e0b718e5efcd9d52
Instruction ID: 096e56480ee09cf4fa6e3d8647b88df4fcf282cc2ede199fe37932ad93176190
Opcode Fuzzy Hash: c5e5a161c1ab45c4b1e480cfbddb13b76eded34dc1ce46f9e0b718e5efcd9d52
Instruction Fuzzy Hash: 21D13EB4800B419FD320AF39C546756BFB0FB02300F548A9EE8EA5B656D335A45ACFD6

Function 00424DA8 Relevance: .3, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5adaadb379de4d0ac6695891303286d85bf5796d7f1c210cbcdbab9b523f8b94
Instruction ID: d4064eec6b76470ac9e4e0ead06daa6340ebf2db876663cb71739c9d30ed4682
Opcode Fuzzy Hash: 5adaadb379de4d0ac6695891303286d85bf5796d7f1c210cbcdbab9b523f8b94
Instruction Fuzzy Hash: 09A1F6B1B083609BE7109F69DC8076BB7E5EBC5314F49492EF9A887341E739DC04879A

Function 003CBB36 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID: ErrorLastProcess$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 3471368781-0
Opcode ID: d178b1a33114018454691d8d483abde9988b3d9ed7beeebe363761c48f446ca2
Instruction ID: d2680d0d7efc7f8d3dc0230faa7d9997c16ae50a3ccb0d3ed3f66d1aada4bcd7
Opcode Fuzzy Hash: d178b1a33114018454691d8d483abde9988b3d9ed7beeebe363761c48f446ca2
Instruction Fuzzy Hash: D3B1C1755007468BDB3AAF25CC97FB6F3A8EF44308F15442DEA83CA580EB75AD858B10

Function 003F34A4 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d6742bc921a87cbc0d7ecdfc3dd5ce11be376d8912454172b111acada42123f
Instruction ID: 8b1f3cae83f9cc49ccb7a5e07f86913a977f30fc4b892ab68e7c48ee6012d7ae
Opcode Fuzzy Hash: 7d6742bc921a87cbc0d7ecdfc3dd5ce11be376d8912454172b111acada42123f
Instruction Fuzzy Hash: CBC1F1B0500B509BD7268F24C881B67BBF1BF46300F14895DEA9B8BB92E736B945CB51

Function 00416078 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6242de2c158a3e25abd914ef81a7081ec85dc90910a15599f474a425946f381
Instruction ID: bc13f1c573b2fdf199a5cc3dd18f82118ff86717ab7f303db0a27177801de854
Opcode Fuzzy Hash: c6242de2c158a3e25abd914ef81a7081ec85dc90910a15599f474a425946f381
Instruction Fuzzy Hash: A181F737B159A147C318993D4C112FAAA931FD6330B3FC36BA9B5CB3E5DA29C8424395

Function 003E2302 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bb0e1251b43261e23572b6fe04e2d9b66b4d052610f955a5f7654400d35fefe
Instruction ID: de15bc9b0b8b27ca541d9cd3921c52ad5a30117a4e14b7222c6d6a53db5e2866
Opcode Fuzzy Hash: 9bb0e1251b43261e23572b6fe04e2d9b66b4d052610f955a5f7654400d35fefe
Instruction Fuzzy Hash: D891EAB2A083E58BD7278E569480327B7DAAFA1304F1E876DD9854B3D2E7B0DC49C741

Function 0040BADA Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a435c7ff7e61a266175cc740b2df94f4f0bcffa5dc796596f52e14c951997eae
Instruction ID: a0f1695f2f50c8ffe9695f8992d00e737d02553c708d0999c4882ac26a77406f
Opcode Fuzzy Hash: a435c7ff7e61a266175cc740b2df94f4f0bcffa5dc796596f52e14c951997eae
Instruction Fuzzy Hash: E6710873A14B254BC728892C8C5176AB6D29BC4210F4E873DDD9ADB3C6EB78AD0187C5

Function 00414A88 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8b4e1efa5495fb8a019b3a8f09c75cd24c53d3083fb3dc6746e68a82280d218
Instruction ID: 9808986ce23d59a18891d051c5f5f2375b8b53206044c81ecc80aaff6fc347dd
Opcode Fuzzy Hash: e8b4e1efa5495fb8a019b3a8f09c75cd24c53d3083fb3dc6746e68a82280d218
Instruction Fuzzy Hash: A9812B3664D5914BD7189A3C9C213FA6E934BD3330F2D876EE4F14B3E1D56D8882835A

Function 00405108 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17b631a1ef9c90cdc196109c47057cb6dd3a7c54a8c9dd28249f1b39c8e723b3
Instruction ID: 9aa6513b44e79e0d17f4379d20674f98d2216c37b58e44dc609e92c5bec8b5c4
Opcode Fuzzy Hash: 17b631a1ef9c90cdc196109c47057cb6dd3a7c54a8c9dd28249f1b39c8e723b3
Instruction Fuzzy Hash: F951B1B1600704ABEB209B64CC86BA733B4EF85354F184569F985DF3D1E379E901CB6A

Function 003E2268 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f99aab2791bd1aba6dfb3b61b9a4968c41f01324f8c9ecb9249fe38aea401d4
Instruction ID: 379682633de6abe0d87561cb4e1384feeecd588e22920c73fecd63c33d39db67
Opcode Fuzzy Hash: 5f99aab2791bd1aba6dfb3b61b9a4968c41f01324f8c9ecb9249fe38aea401d4
Instruction Fuzzy Hash: A07106B69087E287E7278A1BC550327FB96AFE2314F1A875DD86A4B3C1E371C805C741

Function 004222A8 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 260186d478aae003c652c9c0622f6da14b7ca9a12c80829d925b8ad8623de31d
Instruction ID: 37902d42345c4ea1186268323dad6061712151c87c49269f378cfc8fbef2b0e9
Opcode Fuzzy Hash: 260186d478aae003c652c9c0622f6da14b7ca9a12c80829d925b8ad8623de31d
Instruction Fuzzy Hash: 6D71F130708350ABD711DF19EA40B2BB7E6EF95304F94891EE9D5872A1C7B9DC40CB5A

Function 004118D8 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2ecac1f06bdf61436ed265659ed9f52c64cc52bcee91badaf8e5f8c506a0b22
Instruction ID: 8944ffc5ce43d3bce06772078ecab8f47fdafa7add0fd9b8d30d6b2c12ce5743
Opcode Fuzzy Hash: b2ecac1f06bdf61436ed265659ed9f52c64cc52bcee91badaf8e5f8c506a0b22
Instruction Fuzzy Hash: BC715AB44057818FDB258F29C190A66BFB0EF13310B18858ED8D65F75BD339E889CBA5

Function 003EB2D8 Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78f57911bcbd89b49419ee3ef9dd8a7705bfb666a251f11caf1017bd8e3f52b3
Instruction ID: cf72ce828d5e6e91de428b2e130fd3a856b034a47eed636f8f35cbdee5752691
Opcode Fuzzy Hash: 78f57911bcbd89b49419ee3ef9dd8a7705bfb666a251f11caf1017bd8e3f52b3
Instruction Fuzzy Hash: B8513737748AE04BC32B5D7E5C9126ABA874BC3330F2D837EA9F58B3E2EA5548015350

Function 003DE3F7 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 118f1cef26720b4861566893e0de54ebb40160411a9db2ff76e9d22af775da4a
Instruction ID: 0b81af7686b54e8ef899fb7a1a63b0025a287998ebe2b00fb52277cd14cd6ba3
Opcode Fuzzy Hash: 118f1cef26720b4861566893e0de54ebb40160411a9db2ff76e9d22af775da4a
Instruction Fuzzy Hash: 3F71A132A083519FC71ADE18D4D436EBBE2AFC4754F15892EF89A9B394D770DC448B82

Function 00414858 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b5a5ab0e6f08e1212459a1051d072897d816136cec1085f020d45d75109a894
Instruction ID: 4db4d03d324fa5826b5dbcb9f93d6282cb19fbf74ed51649297af205a1974580
Opcode Fuzzy Hash: 1b5a5ab0e6f08e1212459a1051d072897d816136cec1085f020d45d75109a894
Instruction Fuzzy Hash: E451293BA599C147C7209E7C4C412E9AA531BD737473E837BD8B44B3D1D52E8847839A

Function 003EBCB9 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98426d52609b44d71ace9bc0825109431283409a88027502b5f6118697708dcb
Instruction ID: a1a7e874be53d16fa6fa2f984ad05feba7d414bf2d619106e8ffa01006fc7995
Opcode Fuzzy Hash: 98426d52609b44d71ace9bc0825109431283409a88027502b5f6118697708dcb
Instruction Fuzzy Hash: 48516CB1D115458FDB02CFA5DA95ABEBBB2EF46301F640028E400FB3A2D7359E10CB66

Function 0041BCB8 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55836fbddb03cbdaf9cff1c314ca2634526aaf9b730aac6315943972a0646e05
Instruction ID: a1b5f06e8df849e9c20724acb5e890596154a43813661cdba8acb320369e5322
Opcode Fuzzy Hash: 55836fbddb03cbdaf9cff1c314ca2634526aaf9b730aac6315943972a0646e05
Instruction Fuzzy Hash: EA515CB15087548FE714DF29D89439BBBE1FB88314F044A2EE5D987390E379DA488F86

Function 00416378 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b9b159b4f3877c8d9d6b0debf22a3b75361e34386abef763474a0b287f0c785
Instruction ID: 173955c190ac82c2450a9abc4acb35ad00d270d12f1feefbda189e4b3f848c24
Opcode Fuzzy Hash: 6b9b159b4f3877c8d9d6b0debf22a3b75361e34386abef763474a0b287f0c785
Instruction Fuzzy Hash: 91513837A0A5C04BCB159E7C2C452E56A131BE3374B3F836BD8B18B3D6D52AC843931A

Function 00421048 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d0570097160aab1b68a550f4511c957a43b2e8abafe0f435217c9cb9528a807
Instruction ID: 3d5a73505ca7213b22ab7b08d670c9a80961b26189508c6cca37e6624f82d2ef
Opcode Fuzzy Hash: 2d0570097160aab1b68a550f4511c957a43b2e8abafe0f435217c9cb9528a807
Instruction Fuzzy Hash: D051C1347083509BDB14DF55E940A2BB7E6EFA9704F94882EE5C597322D33ADC50CB2A

Function 003EA268 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 054442773fa85cc7e7f2bc6a691852260fd407d19e094a4ce9a9a5ee557263b7
Instruction ID: 0d5ba43fd36146151d4b4901d62626b56990111a116d1a67f0148670fb9c69af
Opcode Fuzzy Hash: 054442773fa85cc7e7f2bc6a691852260fd407d19e094a4ce9a9a5ee557263b7
Instruction Fuzzy Hash: 7441367040C390ABC702BF5AD584A1EFBF5AF66701F558E1DE1C49B292C37AE8108B67

Function 003E2B08 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bda98c2f30a516d50807ce0b98e746189b08d9b89d3b03278e09447c629b6b2
Instruction ID: 68cd5250bc52e34027192f0df6a1a209ca77faea73e41dc9ee55f0a989e771de
Opcode Fuzzy Hash: 8bda98c2f30a516d50807ce0b98e746189b08d9b89d3b03278e09447c629b6b2
Instruction Fuzzy Hash: 9D51C3B1A042619FC715DF19C88092BB7E9FF85324F26476CE8959B391D631EC41CB92

Function 003EE3F3 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34b2c5dc47880b26d63c4cac224246904b14b76870b104fed36430456e3dcfb5
Instruction ID: fa646687fdaa3bb03bed425c73a22f536f31beae98d39bf9831f1b0fcf30dd2a
Opcode Fuzzy Hash: 34b2c5dc47880b26d63c4cac224246904b14b76870b104fed36430456e3dcfb5
Instruction Fuzzy Hash: C54107B49002AA9FDF028F95CC94BBEBB71FF06301F144958E811BB2D1D374A910CBA8

Function 003EE768 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5e34cb232997b27782127b8cd1ef61722e578a9a41e811742eb7c47ee6c68f4
Instruction ID: a480e60d95e5293cd9af4fad3ed7c821354ec89e2769e7956a4b5317f9184f23
Opcode Fuzzy Hash: f5e34cb232997b27782127b8cd1ef61722e578a9a41e811742eb7c47ee6c68f4
Instruction Fuzzy Hash: B0413372B0C3A84FD35DCE7A889413A7BD2ABC5310F19C73EF4A6866C4E6708A05E751

Function 0040ABBB Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b10cf0e7097aa983af4eec26b10cdff308d4fbafdfb15f8fa67f104f1a184b0
Instruction ID: 822ea9bb99d6ec549e5bfff294a4a9a2ea55c0d95468571ee4e04309634472e5
Opcode Fuzzy Hash: 6b10cf0e7097aa983af4eec26b10cdff308d4fbafdfb15f8fa67f104f1a184b0
Instruction Fuzzy Hash: 134108B16083418FC714CB28C441A6FB7E2AFDA304F49497EF495A7382D638E916CB57

Function 00425EE8 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e225b96c8bf2e769cc8697a4cfbe4e2a1212ad77f5d165699b061e557b09fc9
Instruction ID: 8f7a9a32215e18875a6700cbc08ef721553a07f2acd8c84d7655d4e3d520c5cf
Opcode Fuzzy Hash: 8e225b96c8bf2e769cc8697a4cfbe4e2a1212ad77f5d165699b061e557b09fc9
Instruction Fuzzy Hash: 0631DE32B4D6104FD308CA29DD4165EBBE79BCA324F0ED52EE898D7395CA3DC8018B45

Function 00411FF9 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d162afb33da07c4bd60f7c483336d076906e7f1409a5580b2f65c4fffe7ae7c
Instruction ID: 1edad174a10b46df5ebee7830e3728ec5435ce16cffc9c2ae065332b3d15129e
Opcode Fuzzy Hash: 0d162afb33da07c4bd60f7c483336d076906e7f1409a5580b2f65c4fffe7ae7c
Instruction Fuzzy Hash: CE31D0705047808FD7268F298010BA2BFE19F57308F28858ED4D6DB752C77AE94ACB29

Function 0041D598 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e41c94bf4b0e2099e2558e9e672031c0a6948b5c6cff94468f528954f99504a0
Instruction ID: 3473f86d30d1aadcff9d1551b736e7a4acf269a47941d0feedbb851e1d535569
Opcode Fuzzy Hash: e41c94bf4b0e2099e2558e9e672031c0a6948b5c6cff94468f528954f99504a0
Instruction Fuzzy Hash: 8531EEB2E0D7144BD7159D398C502AAB7925BC6330F19872FE9B94B3C5D6384882978A

Function 003E9AE8 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff721506fae7554bc00bc682493813926a926291962e7d101190d432c5989efe
Instruction ID: f574ec604f6e16a87440e1039d89bd3f96199387dc86a53497ea18af95bf6398
Opcode Fuzzy Hash: ff721506fae7554bc00bc682493813926a926291962e7d101190d432c5989efe
Instruction Fuzzy Hash: 13319C298497F64AC737893E94A05ADBF906D961243DA43EECCF10F7C3C5428946D3E0

Function 00420C08 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba455b42178d8c6815bdc6dc6395f760710097916b5094dc96ff09895023de6e
Instruction ID: 5531efb210681d086189b52e640d406884aa5ec3e22c06a0dbf88981277490c6
Opcode Fuzzy Hash: ba455b42178d8c6815bdc6dc6395f760710097916b5094dc96ff09895023de6e
Instruction Fuzzy Hash: B9317CB0608350AFD310DF15D584B1BFBF5AB85708F94891DE4C88B252C739D905CB5A

Function 003E1A58 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 592ae079f84e3206837f27edfef0d756db5bd63b1ae8b67b4edac06f6a01af03
Instruction ID: 85f0594aebe7e8de0db53e1b39ea934c0deec7898c7ae8a5dd3ea7aee237ae75
Opcode Fuzzy Hash: 592ae079f84e3206837f27edfef0d756db5bd63b1ae8b67b4edac06f6a01af03
Instruction Fuzzy Hash: D931E8707052A0DBD7129E5AC880A7AB7E1EFC4318F198A3DE8999B2C1D231DC42CB42

Function 003F2702 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d538187a92fb4ac2440c57b712b554e1d8159c40c43cb23878864ac6b56818ea
Instruction ID: 618e0d16da75b4964c435abdc9ea75842e587556820fa8449674028e30c275a1
Opcode Fuzzy Hash: d538187a92fb4ac2440c57b712b554e1d8159c40c43cb23878864ac6b56818ea
Instruction Fuzzy Hash: 79317CB09007158FD726CF24C480A7BB7E5AF5A700F158A2DE69B97B51E730F944CB51

Function 0040B175 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d31ba30025e973e205b9eb2b84926fbe6cfd1052fcf67400e8907e88fc818d30
Instruction ID: 082e854d3e84aa0459ad0db83b7c8ac5ce5c18d90ad5ee932735b6d946c3bf3a
Opcode Fuzzy Hash: d31ba30025e973e205b9eb2b84926fbe6cfd1052fcf67400e8907e88fc818d30
Instruction Fuzzy Hash: C7216DB05083409BD7149F55C89562BBBF1EF86390F445A5EF4C29F790E379C880CB9A

Function 00423F68 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b89c87bf8a49416322561c17cacfa981ac5946f4534b3d23e182106c98db3fcd
Instruction ID: b3d32bb2faf51b2ce3d3a0f2de1ff43dd42ad17e908dedc7d926e0b4b1431204
Opcode Fuzzy Hash: b89c87bf8a49416322561c17cacfa981ac5946f4534b3d23e182106c98db3fcd
Instruction Fuzzy Hash: DC312D35A042E24BDB26CA3D446056D7EA15E561213DA43EFD8A08F3D3DA65C980C7D5

Function 003E9BF8 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732362d4dea3aa06521cfd35fc4552f794cef7578ca5345e22e1eca341dced0c
Instruction ID: c430caf05820432c73da3bb038bbb1495fde49665bef16eb2e1bfa0745bd5b2e
Opcode Fuzzy Hash: 732362d4dea3aa06521cfd35fc4552f794cef7578ca5345e22e1eca341dced0c
Instruction Fuzzy Hash: DC113A736597E44A8B1B89298C6007BFBC59AF210479DC6BED5C693386D422EC0DC36A

Function 00408278 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10fd84eb35d493625d844e637e1fb177c40288a20f3196d160322e86c00bf206
Instruction ID: b54ceca1687efe969278c642f109f115f50778254b4d9f89d9466d7dece92954
Opcode Fuzzy Hash: 10fd84eb35d493625d844e637e1fb177c40288a20f3196d160322e86c00bf206
Instruction Fuzzy Hash: 47213B7690026586CB248F5488002AEB7B0FF52751FA4D4EED8C877380EF359A85DFA9

Function 004066E6 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a4db2e7a7e6a4b6bfbd63caea179ea7f405d1524a8af3c95513a11a8f7ada3b
Instruction ID: 55ea86040b90aa7a585501a3cb35ca0dc558c4b4ff97828bbab5f87a28ef9ed1
Opcode Fuzzy Hash: 5a4db2e7a7e6a4b6bfbd63caea179ea7f405d1524a8af3c95513a11a8f7ada3b
Instruction Fuzzy Hash: 5F1184745083459FDB00EF14CC80A2AB7F9EB96305F555D2DE0C2A72A1D339E965CB1A

Function 0040C198 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c51315b3c12bd18b55da43b597f25570391444391c721ad26d4c76662b1ac61
Instruction ID: 0c140313c780d04091d1560fb1b43f09c9c4de927c79b39c1ef7222ad25a7e30
Opcode Fuzzy Hash: 9c51315b3c12bd18b55da43b597f25570391444391c721ad26d4c76662b1ac61
Instruction Fuzzy Hash: 93214671108381EBD7508B15C88061BBBF2BB86395F94992DF4C4AB2A2D339D844CF0A

Function 003F1920 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b896b6d8164971cb7ba37414f80df5efc22a3a844d39286caadf7c5c62d1198
Instruction ID: 7788b2d5431f601f2a4b098fa22488110aa256f2fd26281f25c635a7ab2de44c
Opcode Fuzzy Hash: 5b896b6d8164971cb7ba37414f80df5efc22a3a844d39286caadf7c5c62d1198
Instruction Fuzzy Hash: 8B212570510B508FD7268B35C891A67BBF1BF46301F04495DE6879BA92D736F805CBA4

Function 00418B78 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: cfd455c61c591314ffacd0e10cd43ae80cc758bb230faff40af786a6bd3f9436
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 6811C673A091D40DC3168D3C84405B5BFA30BA3635B59839EF4B49B2D6DA269DCA8359

Function 0040E2E8 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 960e2e00e3628e1f5e3ba26c325b6cc30fadb638be8208b4fd5208f2d766984d
Instruction ID: 255d3136489a79053c1434de20367b468c4b3403a974a9e57197ed298d2fb6e9
Opcode Fuzzy Hash: 960e2e00e3628e1f5e3ba26c325b6cc30fadb638be8208b4fd5208f2d766984d
Instruction Fuzzy Hash: 4601B5F160031147EB249E9784C1B6BF6A85F91700F08093EE8446B382DB79EC258399

Function 00406410 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad1a30c5f86df9b29ac032a507831b123af95fa9cc9c1ef612b51c76bc2b554d
Instruction ID: 7081b607e063aff8fa593fd441a17a4a0d78538f226a227198aacf402fea2813
Opcode Fuzzy Hash: ad1a30c5f86df9b29ac032a507831b123af95fa9cc9c1ef612b51c76bc2b554d
Instruction Fuzzy Hash: A71126714083199FC710EF14C8807AAB7E4AF06340F06583DEC86A7291E779E558CB5E

Function 003EC81B Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7537f5fd8384a83163d866f176097abd77cb40ec27a0881dcf1d300453dad3e
Instruction ID: bde56f2558c7dccd37b288897af9a7d72ea14c1eac9e872fb8e7057e72143c04
Opcode Fuzzy Hash: d7537f5fd8384a83163d866f176097abd77cb40ec27a0881dcf1d300453dad3e
Instruction Fuzzy Hash: BF112BB1E142A54BCB0ACF65C9802BDF7B7BF97304F685028D005A7381E734A906C764

Function 0040C3AC Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc9d6f7422685d54ac9c4b229ea6dda6c46a3da1920c7261afbe68902de17981
Instruction ID: 32b39f01ae1dab4447a07b123f011efec8faae814e5cfe4a3c41f70f9abbb49e
Opcode Fuzzy Hash: cc9d6f7422685d54ac9c4b229ea6dda6c46a3da1920c7261afbe68902de17981
Instruction Fuzzy Hash: 9101BC70E01616CBCB14CF09C8906AAB3B1FF96320F04926AE811AB3E1E7389941CB54

Function 003EF058 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0bcc21ab59f3068ab92d7e069a64477687dc0058f8902c272e32a697d861a1d
Instruction ID: c63440f853c9597595619fa4ce77ea6bf8d3953273f841e4d94b7e73d783b460
Opcode Fuzzy Hash: e0bcc21ab59f3068ab92d7e069a64477687dc0058f8902c272e32a697d861a1d
Instruction Fuzzy Hash: 67012173A28921078748DD3DDC1156B7AD15BC5630F19873DB9BAC73D0D634C8458655

Function 003F8948 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1feb0ecdb06b802b1560528e9a5af3474081b4572b374f0f40b5c4f3f9bd469
Instruction ID: d8b2f6272b4787b283fe14592d1cacc4c41463c6c1d3c36e660fa4ab395efa05
Opcode Fuzzy Hash: c1feb0ecdb06b802b1560528e9a5af3474081b4572b374f0f40b5c4f3f9bd469
Instruction Fuzzy Hash: C7F0A7B2A041559BDB278B959C81B37FBDCCB87214F191855E98567102D3A15840C7E7

Function 00423A08 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 085a7920e2e5b4e779e34a684b632e4f4ebff8cfa837e5ac39cd2be3ef1db2f6
Instruction ID: 74876a525ee370b33eb248a8d0ad657e500a3c214d1a9c73a46401ed8550a3f7
Opcode Fuzzy Hash: 085a7920e2e5b4e779e34a684b632e4f4ebff8cfa837e5ac39cd2be3ef1db2f6
Instruction Fuzzy Hash: B7F0173460C2809BD305EF19D480A2EFBF5EB96606F55892DE0C597212C239D890CB2A

Function 00426140 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dba64387f099f4ffb45be2b82222d83dc5fb2b584328ce1a123674adc3a9cf20
Instruction ID: 40128f6b20227bdff527c9077768e771bb3ca2fd52fb7fa4b5ba6b2c4abc225d
Opcode Fuzzy Hash: dba64387f099f4ffb45be2b82222d83dc5fb2b584328ce1a123674adc3a9cf20
Instruction Fuzzy Hash: 95F017345082509BC301AF18D58092EFBF1EF06700F45981DE1C483212D33AE820CB5A

Function 003CA64C Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d30a52f00f890bd01d6e84b1357bca7669443c8ff688bb46904ed1c21e63159d
Instruction ID: fa30281dc2086c4977cbe1a4849bc8f190fd366525394510bf60c97204647b84
Opcode Fuzzy Hash: d30a52f00f890bd01d6e84b1357bca7669443c8ff688bb46904ed1c21e63159d
Instruction Fuzzy Hash: BCE08C3292123CEBCB16DB98C904E8AF3ECEB44B05B15049AB501E3210C270DE00C7D0

Function 0041EC08 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction ID: 25ebea29784d448d8a88e1a46a5e8d6174b10db54235fb339c89627d86cddc7b
Opcode Fuzzy Hash: a4b5204e339133bf84330416a5308528dd9e98d6cb7a6fcb91640552a86da4e7
Instruction Fuzzy Hash: 20D05B35508221469B648E1A9800877F7E0E987711B45555FF981E3244E234DC81C2AD

Function 003B2003 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0477bedc62499ce37f7a09ecf86814b67a7af3b918b39042bb25a0f69e34526d
Instruction ID: 8b292fe3721985d02ed0bad6bdde7aa49b4b8f6b263f684e78e4f4c6f8cf5f8c
Opcode Fuzzy Hash: 0477bedc62499ce37f7a09ecf86814b67a7af3b918b39042bb25a0f69e34526d
Instruction Fuzzy Hash: 4ED0CA7A605A10DFC720CF09E480D41F7B8FB9D630B2680A6E984A3B20C330FC42CAE0

Function 003C0F2E Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f509db719341cefea6c6c824f556d87c4149af31b656ab04d21882e9f704e7b0
Instruction ID: a59b822e92a052be4bf0923903c3ce0b30894e138b76bfca9a296d7339363f5d
Opcode Fuzzy Hash: f509db719341cefea6c6c824f556d87c4149af31b656ab04d21882e9f704e7b0
Instruction Fuzzy Hash: 09C08C34000980C6CE3F89108271BA43355A3A2786F8404CCDC1A8B742C51E9CC2DB21

Function 003F2D4B Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a927264b8af54b329c315b56f05fbf2d8de1dbd38e325cfc03de9a518d2d83b6
Instruction ID: aadbe13c23231eecfadd30a6692dc34302362bb253d043f04e1a43f955a09a0d
Opcode Fuzzy Hash: a927264b8af54b329c315b56f05fbf2d8de1dbd38e325cfc03de9a518d2d83b6
Instruction Fuzzy Hash: A4B092F1C00351C6EF512A232C5243AB0380563311F053530E807263C3A536D598896B

Function 0040D75B Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bde8e0a18542e65954db997d1931066d1f8d4cb0ee69fd957d26d9737444eaa
Instruction ID: a6f5af266c46bcc11fec90cf3efbdd9652419f0d96126eaac973bda640010ddd
Opcode Fuzzy Hash: 9bde8e0a18542e65954db997d1931066d1f8d4cb0ee69fd957d26d9737444eaa
Instruction Fuzzy Hash: 09B092E1C025608A98132E922D039EEB1640913201F042136F80626243AB1AE21A82AF

Function 00426343 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 005c4ba806c1f729e01d7b345e607bcf037a1a2af418616e2fc01539d0967c76
Instruction ID: 7795c8e62c6c1a2cba6d6766a4d5bb610867df3ac219b3c08ddfb2e365f90ae1
Opcode Fuzzy Hash: 005c4ba806c1f729e01d7b345e607bcf037a1a2af418616e2fc01539d0967c76
Instruction Fuzzy Hash: D2B092B09083409BE644CF04C4A053AF3B5FB87229F00A82CE15AA3152C330E808CF0E

Function 0042604C Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e353222c480a1e836f2e88ec6b0f54e01aefb973cbd9e2a65436a63ab80d9507
Instruction ID: 90b20a1011eb729eb64d159c706abf0f2e45b7b0e11e27798d7b31732cf018ce
Opcode Fuzzy Hash: e353222c480a1e836f2e88ec6b0f54e01aefb973cbd9e2a65436a63ab80d9507
Instruction Fuzzy Hash: F7A00225E5C10197C60CCF24A950571E2B95BBF205F513428C005BB852D510D440961C

Function 003F338E Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee70fe1013954b18253420cd7c879e3bafbcdc7016d02e7bb28bbb050ed5ff3e
Instruction ID: eb9c71f61387cf9290d7c446bbbdb1ba1a08eb420cde55b5b5e8e69408f34382
Opcode Fuzzy Hash: ee70fe1013954b18253420cd7c879e3bafbcdc7016d02e7bb28bbb050ed5ff3e
Instruction Fuzzy Hash: C0900224D4830086C2488E409490470E23A564F606E117018850D334924620E500850C

Function 003F165F Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0348c40113168c569ecdbaf33ce4c7ca3883923b3352dc9550a20db56e356de0
Instruction ID: 125aa2fd33e84a88d69890093f1abe8245766079576a578208108fcfe1822cf2
Opcode Fuzzy Hash: 0348c40113168c569ecdbaf33ce4c7ca3883923b3352dc9550a20db56e356de0
Instruction Fuzzy Hash: D9900228D582008A8100CE4494A0470F278620B206F1034109008F3012D210E804850C

Function 003B53B1 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 003B53B8
std::_Lockit::_Lockit.LIBCPMT ref: 003B53C2
int.LIBCPMT ref: 003B53D9

Part of subcall function 003B16B4: std::_Lockit::_Lockit.LIBCPMT ref: 003B16C5
Part of subcall function 003B16B4: std::_Lockit::~_Lockit.LIBCPMT ref: 003B16DF

std::_Facet_Register.LIBCPMT ref: 003B5413
std::_Lockit::~_Lockit.LIBCPMT ref: 003B5433
Concurrency::cancel_current_task.LIBCPMT ref: 003B5440

Strings

R[;, xrefs: 003B5420

Memory Dump Source

Source File: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID: R[;
API String ID: 55977855-2017283703
Opcode ID: fdf519fb1b44963e5a8b5f7a70f2ae43c38df5bc1037deaf72a9dd00c23bf90b
Instruction ID: 517187a3537007a639cab437906155a936d85d129c592785852ed6852d47ffda
Opcode Fuzzy Hash: fdf519fb1b44963e5a8b5f7a70f2ae43c38df5bc1037deaf72a9dd00c23bf90b
Instruction Fuzzy Hash: A61136759006159FCB13EB68D8017EEB3B4EF84329F51040EFA01ABB81CFB0AE008B94

Function 003BA5C8 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 003BA6E7
___TypeMatch.LIBVCRUNTIME ref: 003BA7F5
CallUnexpected.LIBVCRUNTIME ref: 003BA962

Strings

csm, xrefs: 003BA672
csm, xrefs: 003BA71E
csm, xrefs: 003BA605

Memory Dump Source

Source File: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID: CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 1206542248-393685449
Opcode ID: e6bfed3e35af91e2e9893ba0a403611746214574e14254a30d9223cba2db0043
Instruction ID: 8f8fef4a8692009e3007c13ce80a32c70b28f8df3fa614d998d0ecfdff6994d8
Opcode Fuzzy Hash: e6bfed3e35af91e2e9893ba0a403611746214574e14254a30d9223cba2db0043
Instruction Fuzzy Hash: 5FB18D71800E09EFCF26DFA4C8419EEBBB5FF04318B15455AEA11ABA02D731DA51DF92

Function 003C5F4A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,F8250000,?,777BD42E,?,003C6057,003BC446,?,F8250000,00000000), ref: 003C600B

Strings

api-ms-, xrefs: 003C5FA1
ext-ms-, xrefs: 003C5FB5

Memory Dump Source

Source File: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: cc62ede4c5894066ff0eaeea394d05a1c54fb75e39dcdf4318f648501d55b57c
Instruction ID: 5271d92947050e319da89052bffe4e5a5445f085d579d5589efeabfc85d4de16
Opcode Fuzzy Hash: cc62ede4c5894066ff0eaeea394d05a1c54fb75e39dcdf4318f648501d55b57c
Instruction Fuzzy Hash: EA21D572A01611E7C7279B24EC45F5E7768AB417A0F26022DF916E72D1DA30FE40C7A0

Function 003B507A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 003B5081
std::_Lockit::_Lockit.LIBCPMT ref: 003B508C
std::locale::_Setgloballocale.LIBCPMT ref: 003B50A7
_Yarn.LIBCPMT ref: 003B50BD
std::_Lockit::~_Lockit.LIBCPMT ref: 003B50FA

Strings

R[;, xrefs: 003B50C9, 003B50ED

Memory Dump Source

Source File: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID: Lockitstd::_$H_prolog3Lockit::_Lockit::~_SetgloballocaleYarnstd::locale::_
String ID: R[;
API String ID: 156189095-2017283703
Opcode ID: e5807c64fe5a484f66d828adf3ba870a8df33a4797097206defa339ce6ddbe6e
Instruction ID: d71867e58a13d51f1957ae0b81d530f8fa89501a39a75a9b4c68c4a848b100be
Opcode Fuzzy Hash: e5807c64fe5a484f66d828adf3ba870a8df33a4797097206defa339ce6ddbe6e
Instruction Fuzzy Hash: 8301BC36A00515ABD70BBB20E852ABC77A1FF84344B25400EEE115B782CB34AE01CBDA

Function 003C0F50 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,777BD42E,?,?,00000000,003D1FC8,000000FF,?,003C0EE0,003C1010,?,003C0EB4,00000000), ref: 003C0F85
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 003C0F97
FreeLibrary.KERNEL32(00000000,?,?,00000000,003D1FC8,000000FF,?,003C0EE0,003C1010,?,003C0EB4,00000000), ref: 003C0FB9

Strings

CorExitProcess, xrefs: 003C0F8F
R[;, xrefs: 003C0FA8
mscoree.dll, xrefs: 003C0F7E

Memory Dump Source

Source File: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$R[;$mscoree.dll
API String ID: 4061214504-4123092518
Opcode ID: 89cddddedff8c7edd44883dc4886cd054026e141887907cf27a9e4eff21658ac
Instruction ID: cd629a689f663798a167210e0c14ff54678db0d2bf7552797af4ce7fbe543059
Opcode Fuzzy Hash: 89cddddedff8c7edd44883dc4886cd054026e141887907cf27a9e4eff21658ac
Instruction Fuzzy Hash: 83016772544655EFDB179B50EC05FAEBBBCFB44B14F04452AF811E2290DB749D04CB50

Function 003CF356 Relevance: 9.3, APIs: 6, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bc42a482e9ab6902f28bdbf2ad350c2c0b2f7e265f8174fcc9675e3045d8e5a
Instruction ID: 344cba492972e8da486239184a6db95ba4e422b1acccfc5f123d3e7c108f2d0b
Opcode Fuzzy Hash: 0bc42a482e9ab6902f28bdbf2ad350c2c0b2f7e265f8174fcc9675e3045d8e5a
Instruction Fuzzy Hash: C3B11270A00249AFDB17DFA9D880FADBBB6AF45304F15816DE541EB2A2D7709E11CF60

Function 003BA25A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,003BA251,003B8978,003B7AFF), ref: 003BA268
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 003BA276
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 003BA28F
SetLastError.KERNEL32(00000000,003BA251,003B8978,003B7AFF), ref: 003BA2E1

Memory Dump Source

Source File: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: d1ecd4fbac00b5bbe835ad1d401836ec674875bcd8fe9a181ab6a768ce140b37
Instruction ID: 2c4b0957524c3e6ad629bd0610ca6b408ac398100440f48b6f634f71c922182d
Opcode Fuzzy Hash: d1ecd4fbac00b5bbe835ad1d401836ec674875bcd8fe9a181ab6a768ce140b37
Instruction Fuzzy Hash: 1901B13224EF116EE6272779BC866E66749EB4277CF21422AF3104DCE1EF924C025246

Function 003BA371 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 003BA438
___AdjustPointer.LIBCMT ref: 003BA45B
___AdjustPointer.LIBCMT ref: 003BA4F7

Strings

R[;, xrefs: 003BA3D0

Memory Dump Source

Source File: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID: AdjustPointer
String ID: R[;
API String ID: 1740715915-2017283703
Opcode ID: f1ca3142cc19e26daa52d7c30e942b2312135d6a1d38b3c1d1ded612d1d71c54
Instruction ID: f3d761cc1035922b546286ef2209d007715de5d555b01984fff00f9b6d97d2a0
Opcode Fuzzy Hash: f1ca3142cc19e26daa52d7c30e942b2312135d6a1d38b3c1d1ded612d1d71c54
Instruction Fuzzy Hash: F5511472504E069FDB2B8F15D845BFA77A8EF40318F15442DEA458BE91E771EC40CB92

Function 003B4436 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 003B4442
int.LIBCPMT ref: 003B4455

Part of subcall function 003B16B4: std::_Lockit::_Lockit.LIBCPMT ref: 003B16C5
Part of subcall function 003B16B4: std::_Lockit::~_Lockit.LIBCPMT ref: 003B16DF

std::_Facet_Register.LIBCPMT ref: 003B4488
std::_Lockit::~_Lockit.LIBCPMT ref: 003B449E
Concurrency::cancel_current_task.LIBCPMT ref: 003B44A9

Memory Dump Source

Source File: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 62a7a6e802fe6edebf0d9cbb1be648d8ba608f641e84f6304c36b17d084e2730
Instruction ID: 02345ea58088d6e1ba07568796184dce06b77024f846a74440af8f7414c23643
Opcode Fuzzy Hash: 62a7a6e802fe6edebf0d9cbb1be648d8ba608f641e84f6304c36b17d084e2730
Instruction Fuzzy Hash: 8801F772900118ABCB26AB55D8169ED7778EF80368B210159FA059BA92DF309E01C788

Function 003B3DB1 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 003B3DBD
int.LIBCPMT ref: 003B3DD0

Part of subcall function 003B16B4: std::_Lockit::_Lockit.LIBCPMT ref: 003B16C5
Part of subcall function 003B16B4: std::_Lockit::~_Lockit.LIBCPMT ref: 003B16DF

std::_Facet_Register.LIBCPMT ref: 003B3E03
std::_Lockit::~_Lockit.LIBCPMT ref: 003B3E19
Concurrency::cancel_current_task.LIBCPMT ref: 003B3E24

Memory Dump Source

Source File: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: c48404650ae09316564a92bbd5e3a447b9f6b8738d8380e475ecf71211ece60c
Instruction ID: 87526a29086a68c14d476efa63ee0b23df98641796d42af5b2503e2f6339ea07
Opcode Fuzzy Hash: c48404650ae09316564a92bbd5e3a447b9f6b8738d8380e475ecf71211ece60c
Instruction Fuzzy Hash: C001A773904528ABCF26AB54D8068EEB778DF81368B210159FA055B791DF30DE01C794

Function 003B4308 Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 003B4315
int.LIBCPMT ref: 003B4328

Part of subcall function 003B16B4: std::_Lockit::_Lockit.LIBCPMT ref: 003B16C5
Part of subcall function 003B16B4: std::_Lockit::~_Lockit.LIBCPMT ref: 003B16DF

std::_Facet_Register.LIBCPMT ref: 003B435B
std::_Lockit::~_Lockit.LIBCPMT ref: 003B4371
Concurrency::cancel_current_task.LIBCPMT ref: 003B437C

Memory Dump Source

Source File: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 339849b4ce9808dd1a370f4a19394aeb39d72dc2922cbe418cdad7333a9e21c0
Instruction ID: 669d8ba13526b83f45ec746fc3d125f82568d40f3409372802fd528cd81c79e3
Opcode Fuzzy Hash: 339849b4ce9808dd1a370f4a19394aeb39d72dc2922cbe418cdad7333a9e21c0
Instruction Fuzzy Hash: A5012B76904414A7CF23BF64D8029DD77B89F81318F140159FA456F692DF309E01CBC8

Function 003BA060 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 003BA09F
__IsNonwritableInCurrentImage.LIBCMT ref: 003BA153

Strings

csm, xrefs: 003BA13D
R[;, xrefs: 003BA16C

Memory Dump Source

Source File: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: R[;$csm
API String ID: 3480331319-3226767842
Opcode ID: 07f9fdcf9838fa542211250cf3db0b91c834a487230958de440827fd31c31570
Instruction ID: 34523ece2fd8beca77029285b91ef45049734eac3f38fc9a32bd3ce074ee8fa2
Opcode Fuzzy Hash: 07f9fdcf9838fa542211250cf3db0b91c834a487230958de440827fd31c31570
Instruction Fuzzy Hash: 9741B130E00A08AFCF12DF6CD881ADEBBB5AF45318F158056EA14AF752D771DA45CB92

Function 003BB3A2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,003BB353,00000000,?,004368D4,?,?,?,003BB4F6,00000004,InitializeCriticalSectionEx,003D4BD8,InitializeCriticalSectionEx), ref: 003BB3AF
GetLastError.KERNEL32(?,003BB353,00000000,?,004368D4,?,?,?,003BB4F6,00000004,InitializeCriticalSectionEx,003D4BD8,InitializeCriticalSectionEx,00000000,?,003BB2AD), ref: 003BB3B9
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 003BB3E1

Strings

api-ms-, xrefs: 003BB3C6

Memory Dump Source

Source File: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 72bc0b113d4e91b5da848b979a53eb6e0f973affbc1032a5e04cbdd22c8837dc
Instruction ID: c1d8c2e560c7df149c47fc71653cfa8aef6de3d3577478d16913401317602c18
Opcode Fuzzy Hash: 72bc0b113d4e91b5da848b979a53eb6e0f973affbc1032a5e04cbdd22c8837dc
Instruction Fuzzy Hash: 77E01274244208B7EA131B71FC46B597B589B00B45F144022FB0DE84E1DBB19D5086A5

Function 003C7747 Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(777BD42E,00000000,00000000,00000000), ref: 003C77AA

Part of subcall function 003C952A: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,003C8FD3,?,00000000,-00000008), ref: 003C95D6

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 003C7A05
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 003C7A4D
GetLastError.KERNEL32 ref: 003C7AF0

Memory Dump Source

Source File: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 93a762caa854a2cb4436afed6ada68f62f0cf6d6177d8b5c2d89980e1da8f6e3
Instruction ID: e06220f7c0f58df225c6b9be156d3a6bd61779754c59b077fd3024514e208c6f
Opcode Fuzzy Hash: 93a762caa854a2cb4436afed6ada68f62f0cf6d6177d8b5c2d89980e1da8f6e3
Instruction Fuzzy Hash: 7FD14875E042589FCB16CFA8D880AADBBB9BF49310F19452AE856EB351D730AD42CF50

Function 003D06EF Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,00000000,?,003CF713,00000000,00000001,00000000,00000000,?,003C7B44,00000000,00000000,00000000), ref: 003D0706
GetLastError.KERNEL32(?,003CF713,00000000,00000001,00000000,00000000,?,003C7B44,00000000,00000000,00000000,00000000,00000000,?,003C80CB,00000000), ref: 003D0712

Part of subcall function 003D06D8: CloseHandle.KERNEL32(FFFFFFFE,003D0722,?,003CF713,00000000,00000001,00000000,00000000,?,003C7B44,00000000,00000000,00000000,00000000,00000000), ref: 003D06E8

___initconout.LIBCMT ref: 003D0722

Part of subcall function 003D069A: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,003D06C9,003CF700,00000000,?,003C7B44,00000000,00000000,00000000,00000000), ref: 003D06AD

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,?,003CF713,00000000,00000001,00000000,00000000,?,003C7B44,00000000,00000000,00000000,00000000), ref: 003D0737

Memory Dump Source

Source File: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 5eb51b58a1f1135564861ef7937e9bc190cc1cbea0bea0f7e704a21a2309783f
Instruction ID: 4f00bd0cf352087e9c351cf7310d5e290be4b4a197f820d59306a1fa1a7a8fb8
Opcode Fuzzy Hash: 5eb51b58a1f1135564861ef7937e9bc190cc1cbea0bea0f7e704a21a2309783f
Instruction Fuzzy Hash: 24F03737441165BBCF132F95FC05A897FA9FB497A1F054012F95995230C631CD20DF91

Function 003D1093 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,003D09EF), ref: 003D10AC

Strings

Li=, xrefs: 003D1241
R[;, xrefs: 003D1176, 003D1220, 003D1266

Memory Dump Source

Source File: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID: DecodePointer
String ID: Li=$R[;
API String ID: 3527080286-3231796698
Opcode ID: f7b52fb37a642f413458786224f838eb98cf2c371bc22777db61ee8aae19bce3
Instruction ID: b13a5926dc7c59c55ff59cd11cd99159ed79e89415e4c59d29dcf3bbd1dc248a
Opcode Fuzzy Hash: f7b52fb37a642f413458786224f838eb98cf2c371bc22777db61ee8aae19bce3
Instruction Fuzzy Hash: 6951BC7790450AEBCF129FA8F84D1BDBBB8FF09314F124147D691A6718CB718A29CB45

Function 003B5F4D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

_Fputc.LIBCPMT ref: 003B6026

Strings

R[;, xrefs: 003B6005

Memory Dump Source

Source File: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID: Fputc
String ID: R[;
API String ID: 3078413507-2017283703
Opcode ID: ea78152f0fcd85bb800843c7cd20516f1861557cf8bb66236a494c20f38a10d8
Instruction ID: 9647f39b58fcee5de1e78c90f5e9d00a6c64bd33f422c928687164fbedf1663a
Opcode Fuzzy Hash: ea78152f0fcd85bb800843c7cd20516f1861557cf8bb66236a494c20f38a10d8
Instruction Fuzzy Hash: AF414C3691161AEBCB16DF64C490AFDB7B9FF09358B154026E641ABE80E731F941CB90

Function 003BA96D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 003BA992

Strings

RCC, xrefs: 003BA9AC
MOC, xrefs: 003BA9A4

Memory Dump Source

Source File: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: bd703bab9d6d750fe196b80ededb82b7024516af9bcde1cd7912bb069444b581
Instruction ID: a2c4979e16246f20fd4c4d5f4825d8fba16af8114c5669d71a5dba9d6e9f5355
Opcode Fuzzy Hash: bd703bab9d6d750fe196b80ededb82b7024516af9bcde1cd7912bb069444b581
Instruction Fuzzy Hash: 92416C71900A09AFCF16DF98CD81AEEBBB5FF48308F164059FA14AB611D335D950DB62

Function 003B6CA2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 003B7643
___raise_securityfailure.LIBCMT ref: 003B772B

Strings

peC, xrefs: 003B7726

Memory Dump Source

Source File: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: peC
API String ID: 3761405300-1559182986
Opcode ID: c1906e514f58b884d89f0d528436f8680d0043206379940732002e1e32993285
Instruction ID: 635c0abab3f099bc25d42daaf35ec88f6f258c1a12d19463c85fd9bb3ccfb405
Opcode Fuzzy Hash: c1906e514f58b884d89f0d528436f8680d0043206379940732002e1e32993285
Instruction Fuzzy Hash: AA21B0B5541206BBE701CF29F946B403BB4FB58384F12E53AE6098A7A0E3B59981CF19

Function 003B5107 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 003B5113
std::_Lockit::~_Lockit.LIBCPMT ref: 003B516F

Strings

R[;, xrefs: 003B513A, 003B5154

Memory Dump Source

Source File: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID: R[;
API String ID: 593203224-2017283703
Opcode ID: 3bab0554bbeae2412ec4f61256ce288451a111c6a4040dba61d34e84115d9d17
Instruction ID: 47f60abb577ce14786a2fd53cfee312afad4d71efee8b34e04b921380a859a9b
Opcode Fuzzy Hash: 3bab0554bbeae2412ec4f61256ce288451a111c6a4040dba61d34e84115d9d17
Instruction Fuzzy Hash: F3018C35600515AFCB12EF18D885E9977B9EF85718B05009AEA029B3A1DB70EE00CB50

Function 003B7740 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 003B774B
___raise_securityfailure.LIBCMT ref: 003B7808

Strings

peC, xrefs: 003B7803

Memory Dump Source

Source File: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: peC
API String ID: 3761405300-1559182986
Opcode ID: a981ec615020d47f385b03884d567911f3fcdc107f41dfb9098eb48ad4539db2
Instruction ID: b542775a8fe9b71eac796322e90495e95aad66471c400a3561d43a73b9c06e18
Opcode Fuzzy Hash: a981ec615020d47f385b03884d567911f3fcdc107f41dfb9098eb48ad4539db2
Instruction Fuzzy Hash: AF119CB4911206BBE701CF29F9426403BB4BB28380B02F53AE90887760E7709941CF59

Function 003B15DF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 003B15E6
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 003B161E

Part of subcall function 003B5178: _Yarn.LIBCPMT ref: 003B5197
Part of subcall function 003B5178: _Yarn.LIBCPMT ref: 003B51BB

Strings

bad locale name, xrefs: 003B162C

Memory Dump Source

Source File: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: d9abee29d2ef25dea86658b979f5a4add870cd0db7672ae7bda037e04ee55697
Instruction ID: fa7955d0c3147755586a5baa0f21f8cbe1d25b9371b4f342ef3cddd04d87ec1c
Opcode Fuzzy Hash: d9abee29d2ef25dea86658b979f5a4add870cd0db7672ae7bda037e04ee55697
Instruction Fuzzy Hash: 9FF01D71545B909E83329F7A9481587FBE4BE283107948A2FE1DEC3E12D734E404CB6A

Function 003C62A6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?), ref: 003C62E6

Strings

InitializeCriticalSectionEx, xrefs: 003C62B6
R[;, xrefs: 003C62D6

Memory Dump Source

Source File: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx$R[;
API String ID: 2593887523-1538932473
Opcode ID: f47dba91bf4bba6fb86a441cbb96883a1580b9314ae027908a2f73edd3a7c996
Instruction ID: ef93940f3924c95e8853b2d414e30198486893a5bcdc876c54e82664a8df24e0
Opcode Fuzzy Hash: f47dba91bf4bba6fb86a441cbb96883a1580b9314ae027908a2f73edd3a7c996
Instruction Fuzzy Hash: D0E06D36144228B7CB132F50FC07ECE7F19EB44BA2F004426F92869260C6B2DD209784

Function 003C612C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 003C6160

Strings

R[;, xrefs: 003C6156
FlsAlloc, xrefs: 003C613C

Memory Dump Source

Source File: 00000000.00000002.1868884376.00000000003B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003B0000, based on PE: true

Associated: 00000000.00000002.1868852974.00000000003B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868927403.00000000003D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1868960621.00000000003DD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869034912.0000000000435000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869057613.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1869083942.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3b0000_lHHfXU6Y37.jbxd

Similarity

API ID: Alloc
String ID: FlsAlloc$R[;
API String ID: 2773662609-1855747364
Opcode ID: d6cf133d3319f9a32c720a14ce03125e973a5c70f1f97d20cb96045d13016bb3
Instruction ID: cb79e9bd4ae1cf292c87df7082c2219fb90bed2c3b21ade38b42f617757920ca
Opcode Fuzzy Hash: d6cf133d3319f9a32c720a14ce03125e973a5c70f1f97d20cb96045d13016bb3
Instruction Fuzzy Hash: 31E0C277689228B382232670BC07FDE7B18CB44B62B044023FA05A62C1DAA6DE0093D6

Analysis Process: MSBuild.exePID: 7460, Parent PID: 7436COMMON

Execution Graph

Execution Coverage:	1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.3%
Total number of Nodes:	44
Total number of Limit Nodes:	6

Executed Functions

Function 0040D390 Relevance: 6.2, APIs: 4, Instructions: 154
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetInputState.USER32 ref: 0040D3A1
GetCurrentThreadId.KERNEL32 ref: 0040D3B6
GetCurrentProcessId.KERNEL32 ref: 0040D3BC
ExitProcess.KERNEL32 ref: 0040D580

Memory Dump Source

Source File: 00000002.00000002.1727456204.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: CurrentProcess$ExitInputStateThread
String ID:
API String ID: 1029096631-0
Opcode ID: 91b0cbc643e4b4ebeb18023be9ae76da3501924d19314061550aa6d351ab72eb
Instruction ID: 7fe0d86d4b211a0ed1928a564c0dc3b48ff1420feaec6627cd99d8fdc632b15c
Opcode Fuzzy Hash: 91b0cbc643e4b4ebeb18023be9ae76da3501924d19314061550aa6d351ab72eb
Instruction Fuzzy Hash: CE41277480C240ABD301BFA9D544A1EFBF5EF56708F148D2EE5C4A7392D23AD8148B6B

Function 004464F0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(00449A1D,005C003F,00000006,?,?,00000018,,?,?), ref: 0044651E

Strings

, xrefs: 004464F0, 0044650C, 0044651A

Memory Dump Source

Source File: 00000002.00000002.1727456204.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-3019521637
Opcode ID: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction ID: fb6f357373f259be8b0e83fffc5d2a3912a28e0da7d2036ce94b71e982b3a7e9
Opcode Fuzzy Hash: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction Fuzzy Hash: 76E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82

Function 00446040 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 72
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlReAllocateHeap.NTDLL(?,00000000), ref: 004460C4

Strings

aD, xrefs: 004460CA
;:9, xrefs: 004460B6, 00446093, 0044609B

Memory Dump Source

Source File: 00000002.00000002.1727456204.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: AllocateHeap
String ID: aD$;:9
API String ID: 1279760036-3784982549
Opcode ID: b2b91b6383baed23bd5779aad5e8932164b52d5e1660306671fc792bfb274a1b
Instruction ID: 81d8e38a202773684cb26477d2aab6f794b7f55265c2f37ac0847f9732ca8712
Opcode Fuzzy Hash: b2b91b6383baed23bd5779aad5e8932164b52d5e1660306671fc792bfb274a1b
Instruction Fuzzy Hash: 70119D75508200EBD301EF28E900A1ABBF5AF86B16F05483DE5C58B212E73AD854CB9B

Function 00446709 Relevance: 3.0, APIs: 2, Instructions: 22
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32 ref: 00446709
GetForegroundWindow.USER32 ref: 00446720

Memory Dump Source

Source File: 00000002.00000002.1727456204.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 61e954c21ccda2bc507880c9326b32b816de450e3ecc2bacd25776dc5b00f227
Instruction ID: 906c729b96ff40db5e6bb0cb1f2bfce635365c04e2c32f2be8addff1d813b1a5
Opcode Fuzzy Hash: 61e954c21ccda2bc507880c9326b32b816de450e3ecc2bacd25776dc5b00f227
Instruction Fuzzy Hash: 4ED05EACA12240A7EA04FB37FC1E85B3615E79221E7464838E40686312D636E851C65B

Function 00445C4A Relevance: 1.6, APIs: 1, Instructions: 71
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(33A03193,00000000,00000800), ref: 00445CD7

Memory Dump Source

Source File: 00000002.00000002.1727456204.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 72bf814f0518dc5835282787a3600c9ebb27de0fde571f4b41e5eadb2c516951
Instruction ID: 1ed73a75136f75e105c7bb7e785e3dfd24c55cc57a7816ce4e470644bd5d90c0
Opcode Fuzzy Hash: 72bf814f0518dc5835282787a3600c9ebb27de0fde571f4b41e5eadb2c516951
Instruction Fuzzy Hash: 7A218C7520C380AFE745CF29E99061BBBE1ABC9205F58C82DF5C987352C238D905DB6A

Function 00443A20 Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 00443A83

Memory Dump Source

Source File: 00000002.00000002.1727456204.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: bbe3c0725eeb12269a4fd9373789c992c7f1f0aafca5c16579677f982f5a7c14
Instruction ID: 208812190be25b9880a5f29952ef9a922b1c788544e9e186d94aa430ee1b0748
Opcode Fuzzy Hash: bbe3c0725eeb12269a4fd9373789c992c7f1f0aafca5c16579677f982f5a7c14
Instruction Fuzzy Hash: 67F0373410C2409BE301EF19D954A0EBBF4EF9A701F14886CE4C89B2A2C335E814CBAB

Function 00443AA0 Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000), ref: 00443B03

Memory Dump Source

Source File: 00000002.00000002.1727456204.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 5c61f5cf0f16499e49ba7738a8fe8bc67c56cab5a0bd252042df475734ab51e5
Instruction ID: 302f255876a8acf85142c7b8a32416b12f9909014dbe577f3d47d642ddc48781
Opcode Fuzzy Hash: 5c61f5cf0f16499e49ba7738a8fe8bc67c56cab5a0bd252042df475734ab51e5
Instruction Fuzzy Hash: 84F04F3450C2509BD701AF18E945A1EFBF5EF56706F454C68F4C4AB261C339DD60CB9A

Non-executed Functions

Function 0042D9A0 Relevance: 14.4, APIs: 1, Strings: 7, Instructions: 396COMMON

Download Yara Rule

Strings

9u9s, xrefs: 0042E183
Dtgr, xrefs: 0042E5C6
US, xrefs: 0042E1C3
RB, xrefs: 0042E64C
sB, xrefs: 0042E66D
sLlS, xrefs: 0042E5D6
WJL{, xrefs: 0042E5FA, 0042E604, 0042E464, 0042E46D, 0042E60D, 0042E62F

Memory Dump Source

Source File: 00000002.00000002.1727456204.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID:
String ID: 9u9s$Dtgr$RB$WJL{$sLlS$sB$US
API String ID: 0-3351958040
Opcode ID: 276c1ab203addd20c735120bb759d55bade8af3356c5969ab96734506833bd0c
Instruction ID: cba3938b4c7428f4d552087925c859a69b1ab55a6ae02eac8884ff4f61b23fd4
Opcode Fuzzy Hash: 276c1ab203addd20c735120bb759d55bade8af3356c5969ab96734506833bd0c
Instruction Fuzzy Hash: B1F167B4508340DFD710AF66E89061BBBF0AF86345F54892EF5848B362D3B9C844CF9A

Function 004396A0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 004396B0
GetWindowLongW.USER32 ref: 004396D5
GetClipboardData.USER32 ref: 004396E5
GlobalLock.KERNEL32 ref: 004396FE
GlobalUnlock.KERNEL32 ref: 004397EC
CloseClipboard.USER32 ref: 004397F5

Strings

=, xrefs: 00439773

Memory Dump Source

Source File: 00000002.00000002.1727456204.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID: =
API String ID: 2832541153-2322244508
Opcode ID: 78c8dc26131ed5dac9393a6ada90e30b4fdfd99cd617a6bba74dde0b2099fdf1
Instruction ID: 322da3c77394848e095178107a49c73a551c132a77b07a9a0bf135f40f579efd
Opcode Fuzzy Hash: 78c8dc26131ed5dac9393a6ada90e30b4fdfd99cd617a6bba74dde0b2099fdf1
Instruction Fuzzy Hash: 4941537551C381CED311AF7C944831EBFE09B96224F044E6DF4E5862D1D3788945C797

Function 00428230 Relevance: 1.7, APIs: 1, Instructions: 242comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(0044DB80,00000000,00000001,0044DB70), ref: 00428259

Memory Dump Source

Source File: 00000002.00000002.1727456204.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: e7c828e8500b304e47737f2c036b73e87bd74cd8a23869b162ce918d436332e7
Instruction ID: 8b374b447a84a3eb6516e4531b44e52363fa817f3f4265ccba2139a59f939f2f
Opcode Fuzzy Hash: e7c828e8500b304e47737f2c036b73e87bd74cd8a23869b162ce918d436332e7
Instruction Fuzzy Hash: C651EDB07002209BDB20EB64EC92B6B33B4EF81758F54455DF9858B390FB79E801C76A

Function 0043FDBB Relevance: 31.9, APIs: 11, Strings: 7, Instructions: 425memorycomCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(0044DCE0,00000000,00000001,0044DCD0,?), ref: 0043FE41
SysAllocString.OLEAUT32(?), ref: 0043FEC5
CoSetProxyBlanket.OLE32(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0043FF03
SysAllocString.OLEAUT32(?), ref: 0043FF65
SysAllocString.OLEAUT32(?), ref: 00440015
VariantInit.OLEAUT32(6D3F6B39), ref: 0044007E
VariantClear.OLEAUT32(?), ref: 00440123
SysFreeString.OLEAUT32(?), ref: 00440145
SysFreeString.OLEAUT32(?), ref: 0044014E
SysFreeString.OLEAUT32(?), ref: 00440181

Strings

1[!], xrefs: 0043FFA1
bS3U, xrefs: 0043FFAF
hKpM, xrefs: 0043FF85
l3u5, xrefs: 0043FF77
9k?m, xrefs: 0043FFBD
q7bI, xrefs: 0043FF7E
"_kQ, xrefs: 0043FFA8

Memory Dump Source

Source File: 00000002.00000002.1727456204.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: String$AllocFree$Variant$BlanketClearCreateInitInstanceProxy
String ID: "_kQ$1[!]$9k?m$bS3U$hKpM$l3u5$q7bI
API String ID: 2485776651-1023481837
Opcode ID: 3b03e2147dce430a0f8925663908d52cba351bca58096ea1b67891df1644cd7a
Instruction ID: abc33ae36a095545e2bb41dcd0e979c6fcd6de482cd85a6a90bd509a0ecf98e9
Opcode Fuzzy Hash: 3b03e2147dce430a0f8925663908d52cba351bca58096ea1b67891df1644cd7a
Instruction Fuzzy Hash: 1FE16974100B01EFE3208F15C985B16BBF1FF4AB02F148969E59A8BAA1C775F855CF98

Function 004365E8 Relevance: 19.3, APIs: 2, Strings: 9, Instructions: 78COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 004365F4
VariantInit.OLEAUT32 ref: 00436606

Strings

], xrefs: 00436657
S, xrefs: 0043662F
Y, xrefs: 00436647
W, xrefs: 0043663F
Q, xrefs: 00436627
O, xrefs: 0043661F
_, xrefs: 0043665F
U, xrefs: 00436637
[, xrefs: 0043664F

Memory Dump Source

Source File: 00000002.00000002.1727456204.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: Variant$ClearInit
String ID: O$Q$S$U$W$Y$[$]$_
API String ID: 2610073882-3709029455
Opcode ID: bf4df09837cc0999f8912889e458b68c9d6c2582af1171711b600cbe8bd283c9
Instruction ID: 617472aee6f7647b6791f64ddb482ed0964e05965680e50c34387cf75e2fd40f
Opcode Fuzzy Hash: bf4df09837cc0999f8912889e458b68c9d6c2582af1171711b600cbe8bd283c9
Instruction Fuzzy Hash: 8041E970008B81CED721DF38C894756BFE0AB56314F08869DD8EA4F3D6C775A549CB66

Function 004360C9 Relevance: 19.3, APIs: 2, Strings: 9, Instructions: 73COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 004360DA
VariantInit.OLEAUT32 ref: 004360EC

Strings

U, xrefs: 0043611D
[, xrefs: 00436135
_, xrefs: 00436145
Y, xrefs: 0043612D
W, xrefs: 00436125
Q, xrefs: 0043610D
S, xrefs: 00436115
], xrefs: 0043613D
O, xrefs: 00436105

Memory Dump Source

Source File: 00000002.00000002.1727456204.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: Variant$ClearInit
String ID: O$Q$S$U$W$Y$[$]$_
API String ID: 2610073882-3709029455
Opcode ID: f7635afb3bd54eb494f8a0a77bb65c5c2b8a5d4eaa981fde32eb2f6ea89c106d
Instruction ID: 3870ab933f990c28619918e5480d85312f3f30b48fe24ca90a854e860725b9d7
Opcode Fuzzy Hash: f7635afb3bd54eb494f8a0a77bb65c5c2b8a5d4eaa981fde32eb2f6ea89c106d
Instruction Fuzzy Hash: 9C41B474009BC1CEE725DF38C898B46BFA06B56314F088A9DD8E94F296C375A515CB62

Function 00438B2F Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 95COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00438B74

Strings

i, xrefs: 00438B96
}, xrefs: 00438BDE
t, xrefs: 00438BD6
p, xrefs: 00438BC6
|, xrefs: 00438BB6
d, xrefs: 00438B8E

Memory Dump Source

Source File: 00000002.00000002.1727456204.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: InitVariant
String ID: d$i$p$t$|$}
API String ID: 1927566239-2434808017
Opcode ID: 554a65b0e6783a8a587c5d9d5a1a59090ef91d405a8573379fac870fe920457a
Instruction ID: 0b84109ddb38ce271a869d6b766c0ab2b1e4120020a45687ac22dc4c2f8272eb
Opcode Fuzzy Hash: 554a65b0e6783a8a587c5d9d5a1a59090ef91d405a8573379fac870fe920457a
Instruction Fuzzy Hash: FE411870508781CED725CF28C494716BFE0AB66324F08869DD8EA4F397C775E515CBA2

Function 00438417 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 82COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00438444

Strings

}, xrefs: 004384AE
d, xrefs: 0043845E
t, xrefs: 004384A6
|, xrefs: 00438486
i, xrefs: 00438466
p, xrefs: 00438496

Memory Dump Source

Source File: 00000002.00000002.1727456204.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID: InitVariant
String ID: d$i$p$t$|$}
API String ID: 1927566239-2434808017
Opcode ID: 752ed3a4123867835ced7968c358781d81873fa4b79cdbc7d9d63c2e707b67c3
Instruction ID: 90d411813917745457a09f1c6fb0e7b6a5668ded3b473b778bf00fa4b3dd6296
Opcode Fuzzy Hash: 752ed3a4123867835ced7968c358781d81873fa4b79cdbc7d9d63c2e707b67c3
Instruction Fuzzy Hash: 9541D760108781CED721DF2CC484716BFE06B66214F088A8DD8EA4F7D7C375D519CB62

Function 004126B3 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 301COMMON

Download Yara Rule

Strings

fch%, xrefs: 00412788
GD, xrefs: 004126C0
tBA, xrefs: 00412AE7
wCA, xrefs: 00412B66

Memory Dump Source

Source File: 00000002.00000002.1727456204.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Similarity

API ID:
String ID: GD$fch%$tBA$wCA
API String ID: 0-2815851639
Opcode ID: 18b95ce0547799c8335b9632188030b7790c54437027a763add69c76ec3f01d7
Instruction ID: d035267a3a9853f3dfc0ceb4180196f553011948bb1c76c1f0fbabd1dc92564a
Opcode Fuzzy Hash: 18b95ce0547799c8335b9632188030b7790c54437027a763add69c76ec3f01d7
Instruction Fuzzy Hash: F6B158B04093C1CBE7318F149554BEFBBE0BB8A348F140A6EE4C99B242D7799545CB66

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report lHHfXU6Y37.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_lHHfXU6Y37.exe_4289d0cc4794ef2997c7d675cb426ccda579c0_7ceae026_cbacde44-b5eb-4fb9-a198-c9ae2168e41a\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER26D0.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER271F.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER274F.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Windows Analysis Report
lHHfXU6Y37.exe

Function 003B2021 Relevance: 9.4, APIs: 1, Strings: 4, Instructions: 631
memoryCOMMON

Function 003C6368 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34
COMMONLIBRARYCODE

Function 003C8E2E Relevance: 4.7, APIs: 3, Instructions: 202
COMMON

Function 003CA3A6 Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Function 003C9FAA Relevance: 1.6, APIs: 1, Instructions: 147
COMMON