Edit tour

Windows Analysis Report
tsle.exe

Overview

General Information

Sample name:	tsle.exe
Analysis ID:	1535863
MD5:	d5f8fbf6e6b2ae95f9169f81a2dffbe9
SHA1:	33c4cec57067b31fc9d4ae05e9272ed46e72e1be
SHA256:	489264133cd291ad78056ac43553c0a9f3a9ec384bdd4b33f282a06966d51f30
Tags:	exeHUNRedLineStealeruser-smica83
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected RedLine Stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE / OLE file has an invalid certificate

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

tsle.exe (PID: 2748 cmdline: "C:\Users\user\Desktop\tsle.exe" MD5: D5F8FBF6E6B2AE95F9169F81A2DFFBE9)

MSBuild.exe (PID: 3572 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

WerFault.exe (PID: 3852 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 308 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": "185.196.9.26:6302", "Bot Id": "bMi", "Authorization Header": "46fcbe623bda40581c6b2e1dc013de15"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000002.00000002.2201301926.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: tsle.exe PID: 2748	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 3572	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 3572	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.tsle.exe.310b80.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.tsle.exe.310b80.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
2.2.MSBuild.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.tsle.exe.2e0000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Suricata Signatures

ET MALWARE Redline Stealer TCP CnC - Id1Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-17T11:21:06.039315+0200	2043234	1	A Network Trojan was detected	185.196.9.26	6302	192.168.2.5	49708	TCP

ET MALWARE Redline Stealer TCP CnC Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-17T11:21:05.781623+0200	2043231	1	A Network Trojan was detected	192.168.2.5	49708	185.196.9.26	6302	TCP
2024-10-17T11:21:11.158218+0200	2043231	1	A Network Trojan was detected	192.168.2.5	49708	185.196.9.26	6302	TCP
2024-10-17T11:21:14.125267+0200	2043231	1	A Network Trojan was detected	192.168.2.5	49708	185.196.9.26	6302	TCP
2024-10-17T11:21:14.899093+0200	2043231	1	A Network Trojan was detected	192.168.2.5	49708	185.196.9.26	6302	TCP

ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-17T11:21:11.421253+0200	2046056	1	A Network Trojan was detected	185.196.9.26	6302	192.168.2.5	49708	TCP

ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-17T11:21:05.781623+0200	2046045	1	A Network Trojan was detected	192.168.2.5	49708	185.196.9.26	6302	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: RedLine {"C2 url": "185.196.9.26:6302", "Bot Id": "bMi", "Authorization Header": "46fcbe623bda40581c6b2e1dc013de15"}

Multi AV Scanner detection for submitted file

Source: tsle.exe

ReversingLabs: Detection: 55%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: tsle.exe

Joe Sandbox ML: detected

Source: tsle.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49737 version: TLS 1.0

Source: unknown

HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.5:49715 version: TLS 1.2

Source: tsle.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\tsle.exe

Code function: 0_2_002FB69F FindFirstFileExW,

0_2_002FB69F

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2043231 - Severity 1 - ET MALWARE Redline Stealer TCP CnC Activity : 192.168.2.5:49708 -> 185.196.9.26:6302
Source: Network traffic	Suricata IDS: 2046045 - Severity 1 - ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) : 192.168.2.5:49708 -> 185.196.9.26:6302
Source: Network traffic	Suricata IDS: 2043234 - Severity 1 - ET MALWARE Redline Stealer TCP CnC - Id1Response : 185.196.9.26:6302 -> 192.168.2.5:49708
Source: Network traffic	Suricata IDS: 2046056 - Severity 1 - ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) : 185.196.9.26:6302 -> 192.168.2.5:49708

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 185.196.9.26:6302

Source: global traffic

TCP traffic: 192.168.2.5:49708 -> 185.196.9.26:6302

Source: Joe Sandbox View

IP Address: 185.196.9.26 185.196.9.26

Source: Joe Sandbox View

ASN Name: SIMPLECARRIERCH SIMPLECARRIERCH

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49737 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.198.32
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.198.32

Source: tsle.exe	String found in binary or memory: http://aia.entrust.net/ts1-chain256.cer01
Source: tsle.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: tsle.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: tsle.exe	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: tsle.exe	String found in binary or memory: http://crl.entrust.net/ts1ca.crl0
Source: tsle.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: tsle.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: tsle.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: tsle.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: tsle.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: tsle.exe	String found in binary or memory: http://ocsp.entrust.net02
Source: tsle.exe	String found in binary or memory: http://ocsp.entrust.net03
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rmX
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002F48000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002F8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2203525343.0000000002F8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002F8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3ResponseD
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: Amcache.hve.5.dr	String found in binary or memory: http://upx.sf.net
Source: tsle.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: tsle.exe	String found in binary or memory: http://www.entrust.net/rpa03
Source: MSBuild.exe, 00000002.00000002.2207311506.0000000003C7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: tsle.exe, tsle.exe, 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, 00000002.00000002.2201301926.0000000000402000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: MSBuild.exe, 00000002.00000002.2207311506.0000000003C7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: MSBuild.exe, 00000002.00000002.2207311506.0000000003C7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: MSBuild.exe, 00000002.00000002.2207311506.0000000003C7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: MSBuild.exe, 00000002.00000002.2207311506.0000000003C7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: MSBuild.exe, 00000002.00000002.2207311506.0000000003C7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: MSBuild.exe, 00000002.00000002.2207311506.0000000003C7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: MSBuild.exe, 00000002.00000002.2207311506.0000000003C7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: tsle.exe	String found in binary or memory: https://www.entrust.net/rpa0
Source: MSBuild.exe, 00000002.00000002.2207311506.0000000003C7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443

Source: unknown

HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.5:49715 version: TLS 1.2

Source: C:\Users\user\Desktop\tsle.exe	Code function: 0_2_002E20A5	0_2_002E20A5
Source: C:\Users\user\Desktop\tsle.exe	Code function: 0_2_002FA89F	0_2_002FA89F
Source: C:\Users\user\Desktop\tsle.exe	Code function: 0_2_002F09C0	0_2_002F09C0
Source: C:\Users\user\Desktop\tsle.exe	Code function: 0_2_002E7A95	0_2_002E7A95
Source: C:\Users\user\Desktop\tsle.exe	Code function: 0_2_002FDB09	0_2_002FDB09
Source: C:\Users\user\Desktop\tsle.exe	Code function: 0_2_002EDB6E	0_2_002EDB6E
Source: C:\Users\user\Desktop\tsle.exe	Code function: 0_2_002E1E5D	0_2_002E1E5D
Source: C:\Users\user\Desktop\tsle.exe	Code function: 0_2_002FF68C	0_2_002FF68C
Source: C:\Users\user\Desktop\tsle.exe	Code function: 0_2_002F6F8B	0_2_002F6F8B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0101DC74	2_2_0101DC74
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0515EFF8	2_2_0515EFF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_051589E8	2_2_051589E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_05150006	2_2_05150006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_05150040	2_2_05150040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_051589D8	2_2_051589D8

Source: C:\Users\user\Desktop\tsle.exe

Code function: String function: 002E8380 appears 58 times

Source: C:\Users\user\Desktop\tsle.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 308

Source: tsle.exe

Static PE information: invalid certificate

Source: tsle.exe	Binary or memory string: OriginalFilename vs tsle.exe
Source: tsle.exe, 00000000.00000002.2327642561.000000000035B000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameLandings.exe8 vs tsle.exe

Source: tsle.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: tsle.exe

Static PE information: Section: .data ZLIB complexity 0.9887464314845025

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/6@0/1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File created: C:\Users\user\AppData\Local\SystemCache

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2748

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\0205ec2b-8c74-4d99-bf09-de6d73aeb224

Jump to behavior

Source: C:\Users\user\Desktop\tsle.exe	Command line argument: AUIshuyxgYUsuya		0_2_002E2441
Source: C:\Users\user\Desktop\tsle.exe	Command line argument: button		0_2_002E2441

Source: tsle.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process

Source: C:\Users\user\Desktop\tsle.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: MSBuild.exe, 00000002.00000002.2203525343.000000000305D000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2203525343.0000000002FE0000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2203525343.0000000003073000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2203525343.0000000002FCA000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2203525343.0000000003106000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2203525343.00000000030F0000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: tsle.exe

ReversingLabs: Detection: 55%

Source: unknown	Process created: C:\Users\user\Desktop\tsle.exe "C:\Users\user\Desktop\tsle.exe"
Source: C:\Users\user\Desktop\tsle.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\tsle.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 308
Source: C:\Users\user\Desktop\tsle.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior

Source: C:\Users\user\Desktop\tsle.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\tsle.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: tsle.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: tsle.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: C:\Users\user\Desktop\tsle.exe	Code function: 0_2_002E78BB push ecx; ret	0_2_002E78CE
Source: C:\Users\user\Desktop\tsle.exe	Code function: 0_2_002E2323 push eax; ret	0_2_002E2395
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0515D5E2 push eax; ret	2_2_0515D5F1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 1010000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 2C40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 2B90000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 575			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 2590			Jump to behavior

Source: C:\Users\user\Desktop\tsle.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-17959

Source: C:\Users\user\Desktop\tsle.exe

API coverage: 5.9 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 652	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6128	Thread sleep count: 575 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6128	Thread sleep count: 2590 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6656	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\tsle.exe

Code function: 0_2_002FB69F FindFirstFileExW,

0_2_002FB69F

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002E9B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002E9B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: Amcache.hve.5.dr	Binary or memory string: VMware
Source: MSBuild.exe, 00000002.00000002.2202514985.0000000000EFF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllDm
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002E9B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: MSBuild.exe, 00000002.00000002.2207311506.0000000003FCB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: MSBuild.exe, 00000002.00000002.2207311506.0000000003FCB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: MSBuild.exe, 00000002.00000002.2207311506.0000000003FCB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: Amcache.hve.5.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: MSBuild.exe, 00000002.00000002.2207311506.0000000003FCB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002E9B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002E9B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: Amcache.hve.5.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: MSBuild.exe, 00000002.00000002.2207311506.0000000003FCB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002E9B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002E9B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Amcache.hve.5.dr	Binary or memory string: vmci.sys
Source: MSBuild.exe, 00000002.00000002.2207311506.0000000003FCB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: MSBuild.exe, 00000002.00000002.2207311506.0000000003FCB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: MSBuild.exe, 00000002.00000002.2207311506.0000000003FCB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: MSBuild.exe, 00000002.00000002.2207311506.0000000003FCB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002E9B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: MSBuild.exe, 00000002.00000002.2207311506.0000000003FCB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.5.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: MSBuild.exe, 00000002.00000002.2207311506.0000000003FCB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Amcache.hve.5.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.5.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware VMCI Bus Device
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002E9B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002E9B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.5.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: MSBuild.exe, 00000002.00000002.2207311506.0000000003FCB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002E9B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: MSBuild.exe, 00000002.00000002.2207311506.0000000003FCB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: Amcache.hve.5.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: MSBuild.exe, 00000002.00000002.2207311506.0000000003FCB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual USB Mouse
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002E9B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.5.dr	Binary or memory string: VMware, Inc.
Source: MSBuild.exe, 00000002.00000002.2207311506.0000000003FCB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.5.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002E9B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: Amcache.hve.5.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002E9B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: MSBuild.exe, 00000002.00000002.2207311506.0000000003FCB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002E9B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: Amcache.hve.5.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002E9B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002E9B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: MSBuild.exe, 00000002.00000002.2207311506.0000000003FCB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: MSBuild.exe, 00000002.00000002.2207311506.0000000003FCB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002E9B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: MSBuild.exe, 00000002.00000002.2207311506.0000000003FCB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: MSBuild.exe, 00000002.00000002.2207311506.0000000003FCB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Amcache.hve.5.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: MSBuild.exe, 00000002.00000002.2207311506.0000000003FCB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: MSBuild.exe, 00000002.00000002.2207311506.0000000003FCB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: MSBuild.exe, 00000002.00000002.2207311506.0000000003FCB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Amcache.hve.5.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002E9B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: MSBuild.exe, 00000002.00000002.2207311506.0000000003FCB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: MSBuild.exe, 00000002.00000002.2207311506.0000000003FCB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002E9B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002F0F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: IVHSHTCODIPNTGBCHMNVKPUAILXVVKFKXVQUNCFXTBCMTEBSWXPFTMDSDGZKIAUVKOEHSXZJBPMNMGEXTJPAOEMDPTHXRQCVOULRHOXNLLEVOYSUUHJKHUBLKPVUBOWNNNYIVERGXUJXWHARSIBRHIALJWVNJGCJFSWTYNFAKHFKMWIXKIPPQTBKLVLJABTXJJAUPFFIWTLSIBHYUFUKBTZFKZOHSTUPFMPQIOKLVDQRVIJQOGXFVCXVTHXYBRKEFKTAYEVEEJSDTODNKYUKIFEJTGSCOFEGJFXUFFTUDUGNPSDSFNCYGRUOKLHTZSRYLVFROHKDEBPBTMLYGSXGAHMMJCCAHNNTHTJYHYJSYCEYHNZYLYPZZRKQCBEKCIJOMVDKLIMUKHNBXCTWEOWAPIZLIROXKDWVWPAJXRXLLBZPLBODFKBOAAIGTICFSLICMIRMFQVAOXHGTZBMVNEYHPFMVMCIZMYUKDQAJPPKRYFMFYBBZZUDRZUAXHAETNILYTWGZWXKMVYVQPTHACYZNPNUTFPXHLZGFMCFPKGKXZBEMNDEMMSUCIJVEEZVVTNLALWSOOIQWNDNBYFXIMXSYSGIHDKBLTQNHGZBSABJNNCDWHLHGGLULQOHIPDWXBOSOZDGSJICPXZOMIEHQNITIKIXBHUHPYBVDEESQCONQTQTGDIDHFZLNHGHGBNMCJMHPFYAEFORSGPQVZXVNVTODPAYYBGVVJXOQSOXDEYRXFEQHHZXPIKKKAYEDXYKYANMXDXCYRRYSRYIHJTRQILRXNGCFCDERRCTAPDWXXOUTNWBDGRIXGZFWOPASEDDSDMQOIHQDMFZFHVAKVPOTYYQXENYUVBZWKYSVATRNDKTBQJKCBIUQOGVVRSKQRXEZOQAFWIQOTGVRLVGJCXQRXZRDCAHGTXVJAEUKUYANEGPRLWIUCPMSVVQZZMIBQKJKZRROZREPQAHYLRVAFUIGNUGSAQAMAZEHHGHFNSBQQBZOSFYEVJOWSCRJNDOYFYNDGPN
Source: MSBuild.exe, 00000002.00000002.2207311506.0000000003FCB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: MSBuild.exe, 00000002.00000002.2207311506.0000000003FCB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002E9B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: Amcache.hve.5.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin`
Source: MSBuild.exe, 00000002.00000002.2207311506.0000000003FCB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Amcache.hve.5.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002E9B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: MSBuild.exe, 00000002.00000002.2207311506.0000000003FCB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Amcache.hve.5.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: MSBuild.exe, 00000002.00000002.2207311506.0000000003FCB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002E9B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002E9B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: Amcache.hve.5.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002E9B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002E9B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002E9B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002E9B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002E9B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002E9B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: MSBuild.exe, 00000002.00000002.2207311506.0000000003FCB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: MSBuild.exe, 00000002.00000002.2203525343.0000000002E9B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\tsle.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\tsle.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\tsle.exe

Code function: 0_2_002E2323 LdrInitializeThunk,

0_2_002E2323

Source: C:\Users\user\Desktop\tsle.exe

Code function: 0_2_002E812C IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_002E812C

Source: C:\Users\user\Desktop\tsle.exe	Code function: 0_2_002F6993 mov eax, dword ptr fs:[00000030h]	0_2_002F6993
Source: C:\Users\user\Desktop\tsle.exe	Code function: 0_2_002E2441 mov edi, dword ptr fs:[00000030h]	0_2_002E2441
Source: C:\Users\user\Desktop\tsle.exe	Code function: 0_2_002F69D7 mov eax, dword ptr fs:[00000030h]	0_2_002F69D7
Source: C:\Users\user\Desktop\tsle.exe	Code function: 0_2_002F1E5D mov ecx, dword ptr fs:[00000030h]	0_2_002F1E5D

Source: C:\Users\user\Desktop\tsle.exe

Code function: 0_2_002FEC1E GetProcessHeap,

0_2_002FEC1E

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\tsle.exe	Code function: 0_2_002E812C IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_002E812C
Source: C:\Users\user\Desktop\tsle.exe	Code function: 0_2_002E82B9 SetUnhandledExceptionFilter,	0_2_002E82B9
Source: C:\Users\user\Desktop\tsle.exe	Code function: 0_2_002EF48F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_002EF48F
Source: C:\Users\user\Desktop\tsle.exe	Code function: 0_2_002E7E04 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_002E7E04

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\tsle.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\tsle.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\tsle.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\tsle.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\tsle.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 432000	Jump to behavior
Source: C:\Users\user\Desktop\tsle.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 450000	Jump to behavior
Source: C:\Users\user\Desktop\tsle.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: B27008	Jump to behavior

Source: C:\Users\user\Desktop\tsle.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"

Jump to behavior

Source: C:\Users\user\Desktop\tsle.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_002FE058
Source: C:\Users\user\Desktop\tsle.exe	Code function: GetLocaleInfoW,	0_2_002FE8ED
Source: C:\Users\user\Desktop\tsle.exe	Code function: EnumSystemLocalesW,	0_2_002F5169
Source: C:\Users\user\Desktop\tsle.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_002FE9BC
Source: C:\Users\user\Desktop\tsle.exe	Code function: EnumSystemLocalesW,	0_2_002FE2FA
Source: C:\Users\user\Desktop\tsle.exe	Code function: EnumSystemLocalesW,	0_2_002FE345
Source: C:\Users\user\Desktop\tsle.exe	Code function: EnumSystemLocalesW,	0_2_002FE3E0
Source: C:\Users\user\Desktop\tsle.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_002FE46B
Source: C:\Users\user\Desktop\tsle.exe	Code function: GetLocaleInfoW,	0_2_002F5672
Source: C:\Users\user\Desktop\tsle.exe	Code function: GetLocaleInfoW,	0_2_002FE6BE
Source: C:\Users\user\Desktop\tsle.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_002FE7E7

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\tsle.exe

Code function: 0_2_002E8026 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_002E8026

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.5.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: MsMpEng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.tsle.exe.310b80.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.tsle.exe.310b80.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.tsle.exe.2e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2201301926.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: tsle.exe PID: 2748, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 3572, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 3572, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.tsle.exe.310b80.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.tsle.exe.310b80.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.tsle.exe.2e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2201301926.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: tsle.exe PID: 2748, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 3572, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	311 Process Injection	1 Masquerading	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	261 Security Software Discovery	Remote Desktop Protocol	2 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	Logon Script (Windows)	Logon Script (Windows)	251 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	311 Process Injection	NTDS	251 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Software Packing	DCSync	124 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
tsle.exe	55%	ReversingLabs	Win32.Trojan.RedLineSteal
tsle.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	0%	URL Reputation	safe
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/sc	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	0%	URL Reputation	safe
http://www.entrust.net/rpa03	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/trust	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	0%	URL Reputation	safe
http://crl.entrust.net/2048ca.crl0	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	0%	URL Reputation	safe
https://www.entrust.net/rpa0	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	0%	URL Reputation	safe
http://ocsp.entrust.net03	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	0%	URL Reputation	safe
http://ocsp.entrust.net02	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
185.196.9.26:6302	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/chrome_newtab	MSBuild.exe, 00000002.00000002.2207311506.0000000003C7B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	MSBuild.exe, 00000002.00000002.2207311506.0000000003C7B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id23ResponseD	MSBuild.exe, 00000002.00000002.2203525343.0000000002F8C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id12Response	MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/	MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id2Response	MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id21Response	MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id9	MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id8	MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id5	MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id4	MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id7	MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id6	MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id19Response	MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat	MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id15Response	MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id6Response	MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ip.sb/ip	tsle.exe, tsle.exe, 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, 00000002.00000002.2201301926.0000000000402000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/sc	MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id1ResponseD	MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.entrust.net/rpa03	tsle.exe	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id9Response	MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	MSBuild.exe, 00000002.00000002.2207311506.0000000003C7B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id20	MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id21	MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id22	MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id23	MSBuild.exe, 00000002.00000002.2203525343.0000000002F48000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id24	MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id24Response	MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	MSBuild.exe, 00000002.00000002.2207311506.0000000003C7B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id1Response	MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust	MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id10	MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id11	MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id12	MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id16Response	MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id13	MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id14	MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id15	MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id16	MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id17	MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id18	MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id5Response	MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://crl.entrust.net/2048ca.crl0	tsle.exe	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id19	MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.entrust.net/rpa0	tsle.exe	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id10Response	MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id8Response	MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.entrust.net03	tsle.exe	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.entrust.net02	tsle.exe	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	MSBuild.exe, 00000002.00000002.2203525343.0000000002C41000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1	MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	MSBuild.exe, 00000002.00000002.2207311506.0000000003C7B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust	MSBuild.exe, 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.196.9.26	unknown	Switzerland		42624	SIMPLECARRIERCH	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1535863
Start date and time:	2024-10-17 11:20:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	tsle.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/6@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 93% Number of executed functions: 22 Number of non-executed functions: 53
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.190.159.2, 20.190.159.0, 20.190.159.68, 20.190.159.75, 20.190.159.4, 20.190.159.73, 20.190.159.71, 40.126.31.67, 199.232.210.172, 192.229.221.95, 20.109.210.53, 13.95.31.18, 20.42.65.92, 52.165.164.15, 52.149.20.212, 199.232.214.172
Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, ctldl.windowsupdate.com.delivery.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, www.tm.v4.a.prd.aadg.akadns.net, otelrules.afd.azureedge.net, ctldl.windowsupdate.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, onedsblobprdeus17.eastus.cloudapp.azure.com, ocsp.digicert.com, login.live.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, blobcollector.events.data.trafficmanager.net, sls.update.microsoft.com, azureedge-t-prod.trafficmanager.net, umwatson.events.data.microsoft.com, wu-b-net.trafficmanager.net, www.tm.lg.prod.aadmsa.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: tsle.exe

Simulations

Behavior and APIs

Time	Type	Description
05:21:12	API Interceptor	18x Sleep call for process: MSBuild.exe modified
05:21:26	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
185.196.9.26	#U0415Sh#U0430rk.exe	Get hash	malicious	RedLine	Browse
	GX9zyKVNXR.exe	Get hash	malicious	RedLine	Browse
	Lys2hJAvd1.exe	Get hash	malicious	RedLine	Browse
	JfvFiUr0DO.exe	Get hash	malicious	RedLine	Browse
	gLKtR4HuEw.exe	Get hash	malicious	RedLine	Browse
	injector V2.5.exe	Get hash	malicious	RedLine	Browse
	Jeverly.exe	Get hash	malicious	RedLine	Browse
	by_execute.exe	Get hash	malicious	RedLine	Browse
	Shark#U041ePShC.exe	Get hash	malicious	RedLine	Browse
	GipsonyVelo.exe	Get hash	malicious	RedLine	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0032.t-0009.t-msedge.net	ATT037484_Msg#189815.html	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.246.60
	New PO-RFQ14101524CM.xla.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.60
	http://ghiud.harvis.cloud/4mwBgt17516lNdm1204vejpbatzjo21000KUALJDQWQJDDMWF10719LGSH20036h17	Get hash	malicious	Unknown	Browse	13.107.246.60
	ATTN1.html	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://www.google.com/aclk?sa=L&ai=DChcSEwiT4_zk8I-JAxV3GaIDHa9sMjMYABAAGgJsZQ&co=1&ase=2&gclid=EAIaIQobChMIk-P85PCPiQMVdxmiAx2vbDIzEAAYASAAEgJo_PD_BwE&sig=AOD64_2yX-61DuN5RlloHZ07RHFcOg00sw&adurl=http://instructionhub.net%3Fgad_source%3D2&ms=%5BCLICK_MS%5D&nx=338&ny=49&nb=41&nis=6	Get hash	malicious	WinSearchAbuse	Browse	13.107.246.60
	Play_VoiceMsg_daniel.rivera2@adiglobal.com_{RANDOM_NUMBER6}CQDM.html	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	13.107.246.60
	http://track.reviewmgr.com/ls/click?upn=u001.W5y-2Fhe84rCuLxXDO470nfq-2BDsGaih9TJTK05FSTRx5pFScitax3FUEF3FYarJNjoe0gbViAS8jbYVGOh55tt6w-3D-3DALAy_Yp4ydSxZWNatis3HtI6bBrJjg57JYwT6kbyY2f89Z-2FBhxNJZyCBl9w6yXNV0YfiKQdwtXugPBS5IgbCZiSgFn5y-2FXanCHuoz0IrCdIwRSw6Oki9JwBnt8mD5zlTDFmLZPJP7N-2FTa-2FucVNlrLbBcPLFuUM1FhCPywwetCXDujsRUUNcuG3SMgbAXTEsQDLKgRd2J-2FcB8m29vTGLglqz-2FlTNuUOJOC45kyifsFuGuZoyuG878VO8X1OvvfJSe4f1uVtQy44Xwx8Eb48hvflvn4Y01f6heBfF6aH5ZHhFL9-2FvI-3D	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://bitbucket.org/aaa14/aaaa/downloads/script3.txt	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://bitbucket.org/aaa14/aaaa/downloads/xwormberlyn.txt	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://constructionbybricco.com/n/?c3Y9bzM2NV8xX29uZSZyYW5kPWEwRlNjRzQ9JnVpZD1VU0VSMTgwOTIwMjRVMTYwOTE4MjQ=N0123N%5BEMAIL%5D	Get hash	malicious	Mamba2FA	Browse	13.107.246.60
bg.microsoft.map.fastly.net	Pedido de Cota#U00e7#U00e3o-24100004_lista comercial.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	199.232.210.172
	Bestireno Transformados SL PEDIDO 268884.vbs	Get hash	malicious	Unknown	Browse	199.232.214.172
	Transferencias6231.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	199.232.214.172
	234229735414511158.js	Get hash	malicious	Unknown	Browse	199.232.210.172
	Justificante de pago.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	199.232.210.172
	Justificante de pago.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	199.232.214.172
	elevator.vbs	Get hash	malicious	Unknown	Browse	199.232.210.172
	TRANSFERENCIA BANCARIA.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	199.232.214.172
	Thermo Fisher RFQ_TFS-1702.xls	Get hash	malicious	Unknown	Browse	199.232.210.172
	Nowe zam.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	199.232.210.172
fp2e7a.wpc.phicdn.net	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	192.229.221.95
	new order 32724.bat.exe	Get hash	malicious	FormBook	Browse	192.229.221.95
	http://ghiud.harvis.cloud/4mwBgt17516lNdm1204vejpbatzjo21000KUALJDQWQJDDMWF10719LGSH20036h17	Get hash	malicious	Unknown	Browse	192.229.221.95
	http://nndpdnm.3utilities.com/#bd5on/p8la73b/LoiU9/1oQd1tRDE-SUREIDANt92YuMXZpJHZuV3bmxWYi9GbnBUY5hGZhBHc15Cdp1WY	Get hash	malicious	HTMLPhisher	Browse	192.229.221.95
	https://information-adsmanager.com/action-needed/	Get hash	malicious	Unknown	Browse	192.229.221.95
	http://iuf89olclwo0fufk.weebly.com	Get hash	malicious	Unknown	Browse	192.229.221.95
	http://track.reviewmgr.com/ls/click?upn=u001.W5y-2Fhe84rCuLxXDO470nfq-2BDsGaih9TJTK05FSTRx5pFScitax3FUEF3FYarJNjoe0gbViAS8jbYVGOh55tt6w-3D-3DALAy_Yp4ydSxZWNatis3HtI6bBrJjg57JYwT6kbyY2f89Z-2FBhxNJZyCBl9w6yXNV0YfiKQdwtXugPBS5IgbCZiSgFn5y-2FXanCHuoz0IrCdIwRSw6Oki9JwBnt8mD5zlTDFmLZPJP7N-2FTa-2FucVNlrLbBcPLFuUM1FhCPywwetCXDujsRUUNcuG3SMgbAXTEsQDLKgRd2J-2FcB8m29vTGLglqz-2FlTNuUOJOC45kyifsFuGuZoyuG878VO8X1OvvfJSe4f1uVtQy44Xwx8Eb48hvflvn4Y01f6heBfF6aH5ZHhFL9-2FvI-3D	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://bitbucket.org/aaa14/aaaa/downloads/script3.txt	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://blueshiftideas.com/CompaniesCovered/Copie.html	Get hash	malicious	Phisher	Browse	192.229.221.95
	https://bitbucket.org/aaa14/aaaa/downloads/xwormberlyn.txt	Get hash	malicious	Unknown	Browse	192.229.221.95

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SIMPLECARRIERCH	dG2gzbQyzZ.exe	Get hash	malicious	Unknown	Browse	185.196.10.98
	dG2gzbQyzZ.exe	Get hash	malicious	Unknown	Browse	185.196.10.98
	http://learnthelanguage.nl/?wptouch_switch=desktop&redirect=http://basinindustriesinc.com	Get hash	malicious	HTMLPhisher	Browse	185.196.10.27
	http://learnthelanguage.nl/?wptouch_switch=desktop&redirect=http://basinindustriesinc.com	Get hash	malicious	HTMLPhisher	Browse	185.196.10.27
	#U0415Sh#U0430rk.exe	Get hash	malicious	RedLine	Browse	185.196.9.26
	fBcMVl6ns6.lnk	Get hash	malicious	RHADAMANTHYS	Browse	185.196.9.174
	rpQF1aDIK4.lnk	Get hash	malicious	RHADAMANTHYS	Browse	185.196.9.174
	test.ps1	Get hash	malicious	RHADAMANTHYS	Browse	185.196.9.174
	path.ps1	Get hash	malicious	DcRat	Browse	185.196.9.174
	g3y89237.exe	Get hash	malicious	DcRat	Browse	185.196.9.174

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	SafeguardPDFViewer_v3.exe	Get hash	malicious	Unknown	Browse	23.1.237.91
	PI-90349003421.xlsx	Get hash	malicious	Unknown	Browse	23.1.237.91
	EMPLOYEE APPRAISAL REVIEW FOR Alejandra.madrazo Q4 2024.pdf	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	23.1.237.91
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	23.1.237.91
	Pyt Copy.scr.exe	Get hash	malicious	Snake Keylogger	Browse	23.1.237.91
	new order 32724.bat.exe	Get hash	malicious	FormBook	Browse	23.1.237.91
	Account report.docx	Get hash	malicious	Unknown	Browse	23.1.237.91
	JimyDeftons.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	https://information-adsmanager.com/action-needed/	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://bitbucket.org/aaa14/aaaa/downloads/script3.txt	Get hash	malicious	Unknown	Browse	23.1.237.91
28a2c9bd18a11de089ef85a160da29e4	SafeguardPDFViewer_v3.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	SafeguardPDFViewer_v3.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	PI-90349003421.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.60
	ATT037484_Msg#189815.html	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.246.60
	EMPLOYEE APPRAISAL REVIEW FOR Alejandra.madrazo Q4 2024.pdf	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.246.60
	Pyt Copy.scr.exe	Get hash	malicious	Snake Keylogger	Browse	13.107.246.60
	new order 32724.bat.exe	Get hash	malicious	FormBook	Browse	13.107.246.60
	http://ghiud.harvis.cloud/4mwBgt17516lNdm1204vejpbatzjo21000KUALJDQWQJDDMWF10719LGSH20036h17	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://onedrive.live.com/redir?resid=7EA77BA2B31F5860%21809&authkey=%21ACBUocwpcr44pZ4&page=View&wd=target%28Quick%20Notes.one%7C332160b9-4557-46d8-85f4-3a5f81cbb137%2FASP%20%E2%80%9CProgetto%20Persona%E2%80%9D%7C57dac1b5-636f-4aae-88ec-832b5318580f%2F%29&wdorigin=NavigationUrl	Get hash	malicious	HtmlDropper	Browse	13.107.246.60
	Account report.docx	Get hash	malicious	Unknown	Browse	13.107.246.60

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_tsle.exe_355e8546985d9dcce4d61437496d879d61db39b_08b7ce8b_0885b6fd-cff6-4a46-b8da-29a518c74190\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7136261297073719
Encrypted:	false
SSDEEP:	192:FHQlxvvfHn0BU/Dc3juGzuiFyZ24IO88pB:CBfUBU/QjfzuiFyY4IO8e
MD5:	27C8941738B1724CB639FDB0B3318416
SHA1:	11734B40992A76BAC701DD3B1D00621116A67807
SHA-256:	249A66825A9E724AA2294BD46E9B1C8E2B92103CCC84C9DF4765798C230B39AC
SHA-512:	EBA23D21E0C265FA8F2240F71E2A078090BFB7659FD4FE6B9C2F863256ABBE8ABD41337E527A2F0A262485E1E1ABFFEAFBCC81620618B81098773016ED621E66
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.3.6.3.0.4.6.2.6.1.0.8.3.2.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.3.6.3.0.4.6.3.4.0.7.7.0.8.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.8.8.5.b.6.f.d.-.c.f.f.6.-.4.a.4.6.-.b.8.d.a.-.2.9.a.5.1.8.c.7.4.1.9.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.e.9.4.a.9.b.6.-.9.d.2.4.-.4.d.8.2.-.a.8.a.f.-.0.0.4.0.d.6.7.2.1.b.d.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.t.s.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.a.b.c.-.0.0.0.1.-.0.0.1.4.-.3.4.d.b.-.c.8.e.1.7.5.2.0.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.c.f.6.a.b.3.6.8.e.7.6.d.3.3.3.2.1.9.b.c.3.8.c.7.1.0.5.4.e.e.6.4.0.0.0.0.f.f.f.f.!.0.0.0.0.3.3.c.4.c.e.c.5.7.0.6.7.b.3.1.f.c.9.d.4.a.e.0.5.e.9.2.7.2.e.d.4.6.e.7.2.e.1.b.e.!.t.s.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.0././.1.5.:.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2FE.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Oct 17 09:21:03 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	43218
Entropy (8bit):	1.6996017927052944
Encrypted:	false
SSDEEP:	192:yDeyKg7uyREtOX1zMfKjuhedzAX3YOJFDP:geyKlMFzMfKoYO
MD5:	9A62D23C2F7EC6562BAD791A45F82DCD
SHA1:	063E49DEE309F916A9626FC6BAA7ACB3DD5B1DA0
SHA-256:	42B0B0359FAAB299B0CF19E36C651F7522D74DDC01DBFD12C54E931CFDEFD815
SHA-512:	2B217D7FAC1291A103AC6DF5F119C0D026BFAC50B3A511567838DD84370F2D1340D78711C5E2131ED803C3A80630AA7BC5296C1F55FE5150CC5D989E1C1E5B90
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ..........g........................0...........4...f!..........T.......8...........T.......................................................................................................................eJ..............GenuineIntel............T..............g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER502.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8380
Entropy (8bit):	3.6954028828402055
Encrypted:	false
SSDEEP:	192:R6l7wVeJLCy6Uz6YEIsSUdQgmfSWoprZ89bv4ssfLdOm:R6lXJz6C6YEDSUdQgmfjbw/fZ
MD5:	F2540D0FA279C3E6B620AF4E09E451E9
SHA1:	7A7E5A476F41BD9D47BE7FFDD7FE134DABC8A617
SHA-256:	8C255D0E0B8C6B76A7A0B8D341E120D58B9CFB95A36ED6A2DF809CE9FB7F88BE
SHA-512:	1F5EF832233E0072ACD18FCE2D3C04E488515D61CAE1CA20F1840B418C6537468B6741A561C253BEE77E1A9F50EF0A01CB49EEB83DD9DA6B8370863333AEF52F
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.7.4.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER522.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4690
Entropy (8bit):	4.452902323248918
Encrypted:	false
SSDEEP:	48:cvIwWl8zsHNJg77aI9q9WpW8VYzYm8M4J7JF6m+q8v0qCYgD/EIfd:uIjfHnI7YM7VDJfKjbC/EIfd
MD5:	DA52782EEA482E1DDD49572D612832DD
SHA1:	175FCBDF5D5CDE5ED87EC5CD5F90E574A57A5FD6
SHA-256:	011B1E625FEDB6E40370D3F3B9C6A182113193AF17FCD60A3C896F8033A420F8
SHA-512:	CE0815548B4F266626AFA1F2F6126C6EBAED2B72B50BE4F5CA7C5FACAB47D5C21883174B05D616B73EDCEAC3295CF0347B1F3B4D5B213428DFE51BC97D08A2B5
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="547223" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MSBuild.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3094
Entropy (8bit):	5.33145931749415
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymTqdqlq7qqjqcEZ5D:Pq5qHwCYqh3qtI6eqzxP0atTqdqlq7qV
MD5:	3FD5C0634443FB2EF2796B9636159CB6
SHA1:	366DDE94AEFCFFFAB8E03AD8B448E05D7489EB48
SHA-256:	58307E94C67E2348F5A838DE4FF668983B38B7E9A3B1D61535D3A392814A57D6
SHA-512:	8535E7C0777C6B0876936D84BDE2BDC59963CF0954D4E50D65808E6E806E8B131DF5DB8FA0E030FAE2702143A7C3A70698A2B9A80519C9E2FFC286A71F0B797C
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.421309360437747
Encrypted:	false
SSDEEP:	6144:7Svfpi6ceLP/9skLmb0OTfWSPHaJG8nAgeMZMMhA2fX4WABlEnNt0uhiTw:mvloTfW+EZMM6DFyb03w
MD5:	8054828354970CF6E5B85DD3A18765B2
SHA1:	B9BE4F31791704F8E97873C35EC67D30EB43976B
SHA-256:	5125F1DF542654C2FCC8AC971C46C872EB2AE7C79041DDFA3D053F789CBB7C6B
SHA-512:	8AE308E25350B260FBB976B5BB12EE67E619AD5E3420341C036C881D2305BBA3B8E532AA1A48A064D4D1E56A416CBE64E0809A227105D874F743DB9C1473BB91
Malicious:	false
Reputation:	low
Preview:	regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmb?..u .........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.660179430567182
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	tsle.exe
File size:	522'280 bytes
MD5:	d5f8fbf6e6b2ae95f9169f81a2dffbe9
SHA1:	33c4cec57067b31fc9d4ae05e9272ed46e72e1be
SHA256:	489264133cd291ad78056ac43553c0a9f3a9ec384bdd4b33f282a06966d51f30
SHA512:	465b287702ebcbd1e2cae9c8312eb1142002aed5197b7b61aeb0ed5e903e091cfac85a4a514303c7af781c94f1f30fe6cc18bfcd88714078ebb1e2946031bec0
SSDEEP:	6144:Z1E05yKx2W1JdOJjIdO/nCgCQb6Srm1PIG+QrvrhDqCZWSwjVHTJ0WyYCTaYJb0A:v5yKx2W1frPeQbxRIHuYedJ6eTcmEO
TLSH:	F6B4F151B9C08072C563163206F4DBB5AE3EFC710E614E8FA7954F7E4F31690EA2266B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........d.............^.......^...<...^.......................^.......................................Rich....................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x407660
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x670E7F81 [Tue Oct 15 14:43:13 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	c283cae75da6f2198ef9d182bf49a86f

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	13/01/2023 01:00:00 17/01/2026 00:59:59
Subject Chain	CN=NVIDIA Corporation, OU=2-J, O=NVIDIA Corporation, L=Santa Clara, S=California, C=US
Version:	3
Thumbprint MD5:	5F1B6B6C408DB2B4D60BAA489E9A0E5A
Thumbprint SHA-1:	15F760D82C79D22446CC7D4806540BF632B1E104
Thumbprint SHA-256:	28AF76241322F210DA473D9569EFF6F27124C4CA9F43933DA547E8D068B0A95D
Serial:	0997C56CAA59055394D9A9CDB8BEEB56

Entrypoint Preview

Instruction
call 00007F42C13C95B3h
jmp 00007F42C13C8A1Fh
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
cmp edx, esi
je 00007F42C13C8BBBh
mov ecx, dword ptr [ebp+0Ch]
cmp ecx, dword ptr [edx+0Ch]
jc 00007F42C13C8BACh
mov eax, dword ptr [edx+08h]
add eax, dword ptr [edx+0Ch]
cmp ecx, eax
jc 00007F42C13C8BAEh
add edx, 28h
cmp edx, esi
jne 00007F42C13C8B8Ch
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 00007F42C13C8B9Bh
push esi
call 00007F42C13C98B6h
test eax, eax
je 00007F42C13C8BC2h
mov eax, dword ptr fs:[00000018h]
mov esi, 0047CED0h
mov edx, dword ptr [eax+04h]
jmp 00007F42C13C8BA6h
cmp edx, eax
je 00007F42C13C8BB2h
xor eax, eax
mov ecx, edx
lock cmpxchg dword ptr [esi], ecx
test eax, eax
jne 00007F42C13C8B92h
xor al, al
pop esi
ret
mov al, 01h
pop esi
ret
push ebp
mov ebp, esp
cmp dword ptr [ebp+08h], 00000000h
jne 00007F42C13C8BA9h
mov byte ptr [0047CED4h], 00000001h
call 00007F42C13C8F45h
call 00007F42C13CBE69h
test al, al
jne 00007F42C13C8BA6h
xor al, al
pop ebp
ret
call 00007F42C13D50F6h
test al, al
jne 00007F42C13C8BACh
push 00000000h
call 00007F42C13CBE70h
pop ecx
jmp 00007F42C13C8B8Bh
mov al, 01h
pop ebp
ret
push ebp
mov ebp, esp
cmp byte ptr [0047CED5h], 00000000h
je 00007F42C13C8BA6h
mov al, 01h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2eee0	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x7d200	0x2628
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7e000	0x1e40	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2ced0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2ce10	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x25000	0x15c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x23b8f	0x23c00	e210c2e94393adbc5ed4ea7704d5f2c7	False	0.5863540756118881	data	6.640441568121751	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x25000	0xa6e2	0xa800	b8768086bb000322a5cf6e0ccbfe2e85	False	0.43143136160714285	data	4.9538247529461	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x30000	0x4da04	0x4ca00	9ef69bb3eab42cef3bb7b96ee5b45368	False	0.9887464314845025	data	7.989719014606504	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x7e000	0x1e40	0x2000	9e3e35e78fc23f918d48bf3cb7bd892a	False	0.7120361328125	data	6.405268985829102	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL

Import

USER32.dll

CreateWindowExW

KERNEL32.dll

IsDebuggerPresent, WriteConsoleW, HeapSize, CreateFileW, GetProcessHeap, SetStdHandle, CloseHandle, GetConsoleWindow, MultiByteToWideChar, GetStringTypeW, WideCharToMultiByte, GetCurrentThreadId, WaitForSingleObjectEx, GetExitCodeThread, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, LCMapStringEx, ReleaseSRWLockExclusive, AcquireSRWLockExclusive, TryAcquireSRWLockExclusive, WakeAllConditionVariable, QueryPerformanceCounter, GetSystemTimeAsFileTime, GetModuleHandleW, GetProcAddress, GetCPInfo, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, GetCurrentProcessId, InitializeSListHead, SetEndOfFile, GetStartupInfoW, RaiseException, RtlUnwind, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, CreateThread, ExitThread, FreeLibraryAndExitThread, GetModuleHandleExW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetFileSizeEx, SetFilePointerEx, GetFileType, HeapAlloc, HeapFree, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, ReadConsoleW, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-17T11:21:05.781623+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49708	185.196.9.26	6302	TCP
2024-10-17T11:21:05.781623+0200	2046045	ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	1	192.168.2.5	49708	185.196.9.26	6302	TCP
2024-10-17T11:21:06.039315+0200	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	1	185.196.9.26	6302	192.168.2.5	49708	TCP
2024-10-17T11:21:11.158218+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49708	185.196.9.26	6302	TCP
2024-10-17T11:21:11.421253+0200	2046056	ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)	1	185.196.9.26	6302	192.168.2.5	49708	TCP
2024-10-17T11:21:14.125267+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49708	185.196.9.26	6302	TCP
2024-10-17T11:21:14.899093+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.5	49708	185.196.9.26	6302	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 17, 2024 11:20:59.230899096 CEST	49675	443	192.168.2.5	23.1.237.91
Oct 17, 2024 11:20:59.230901957 CEST	49674	443	192.168.2.5	23.1.237.91
Oct 17, 2024 11:20:59.356251001 CEST	49673	443	192.168.2.5	23.1.237.91
Oct 17, 2024 11:21:04.872795105 CEST	49708	6302	192.168.2.5	185.196.9.26
Oct 17, 2024 11:21:04.877780914 CEST	6302	49708	185.196.9.26	192.168.2.5
Oct 17, 2024 11:21:04.877909899 CEST	49708	6302	192.168.2.5	185.196.9.26
Oct 17, 2024 11:21:04.886768103 CEST	49708	6302	192.168.2.5	185.196.9.26
Oct 17, 2024 11:21:04.891582012 CEST	6302	49708	185.196.9.26	192.168.2.5
Oct 17, 2024 11:21:05.727001905 CEST	6302	49708	185.196.9.26	192.168.2.5
Oct 17, 2024 11:21:05.777724981 CEST	49708	6302	192.168.2.5	185.196.9.26
Oct 17, 2024 11:21:05.781622887 CEST	49708	6302	192.168.2.5	185.196.9.26
Oct 17, 2024 11:21:05.786688089 CEST	6302	49708	185.196.9.26	192.168.2.5
Oct 17, 2024 11:21:06.039314985 CEST	6302	49708	185.196.9.26	192.168.2.5
Oct 17, 2024 11:21:06.090235949 CEST	49708	6302	192.168.2.5	185.196.9.26
Oct 17, 2024 11:21:08.840241909 CEST	49674	443	192.168.2.5	23.1.237.91
Oct 17, 2024 11:21:08.840272903 CEST	49675	443	192.168.2.5	23.1.237.91
Oct 17, 2024 11:21:08.965245008 CEST	49673	443	192.168.2.5	23.1.237.91
Oct 17, 2024 11:21:10.716626883 CEST	443	49706	23.1.237.91	192.168.2.5
Oct 17, 2024 11:21:10.716722012 CEST	49706	443	192.168.2.5	23.1.237.91
Oct 17, 2024 11:21:11.158217907 CEST	49708	6302	192.168.2.5	185.196.9.26
Oct 17, 2024 11:21:11.163186073 CEST	6302	49708	185.196.9.26	192.168.2.5
Oct 17, 2024 11:21:11.420614958 CEST	6302	49708	185.196.9.26	192.168.2.5
Oct 17, 2024 11:21:11.420726061 CEST	6302	49708	185.196.9.26	192.168.2.5
Oct 17, 2024 11:21:11.420739889 CEST	6302	49708	185.196.9.26	192.168.2.5
Oct 17, 2024 11:21:11.420806885 CEST	49708	6302	192.168.2.5	185.196.9.26
Oct 17, 2024 11:21:11.421252966 CEST	6302	49708	185.196.9.26	192.168.2.5
Oct 17, 2024 11:21:11.421263933 CEST	6302	49708	185.196.9.26	192.168.2.5
Oct 17, 2024 11:21:11.421274900 CEST	6302	49708	185.196.9.26	192.168.2.5
Oct 17, 2024 11:21:11.421312094 CEST	49708	6302	192.168.2.5	185.196.9.26
Oct 17, 2024 11:21:11.421349049 CEST	49708	6302	192.168.2.5	185.196.9.26
Oct 17, 2024 11:21:13.547358990 CEST	49708	6302	192.168.2.5	185.196.9.26
Oct 17, 2024 11:21:13.552227020 CEST	6302	49708	185.196.9.26	192.168.2.5
Oct 17, 2024 11:21:13.552262068 CEST	6302	49708	185.196.9.26	192.168.2.5
Oct 17, 2024 11:21:13.552308083 CEST	6302	49708	185.196.9.26	192.168.2.5
Oct 17, 2024 11:21:13.552318096 CEST	6302	49708	185.196.9.26	192.168.2.5
Oct 17, 2024 11:21:13.552328110 CEST	6302	49708	185.196.9.26	192.168.2.5
Oct 17, 2024 11:21:13.552347898 CEST	49708	6302	192.168.2.5	185.196.9.26
Oct 17, 2024 11:21:13.552370071 CEST	49708	6302	192.168.2.5	185.196.9.26
Oct 17, 2024 11:21:13.552396059 CEST	49708	6302	192.168.2.5	185.196.9.26
Oct 17, 2024 11:21:13.552413940 CEST	49708	6302	192.168.2.5	185.196.9.26
Oct 17, 2024 11:21:13.552493095 CEST	6302	49708	185.196.9.26	192.168.2.5
Oct 17, 2024 11:21:13.552510977 CEST	6302	49708	185.196.9.26	192.168.2.5
Oct 17, 2024 11:21:13.552526951 CEST	6302	49708	185.196.9.26	192.168.2.5
Oct 17, 2024 11:21:13.552535057 CEST	6302	49708	185.196.9.26	192.168.2.5
Oct 17, 2024 11:21:13.552736044 CEST	6302	49708	185.196.9.26	192.168.2.5
Oct 17, 2024 11:21:13.557126045 CEST	6302	49708	185.196.9.26	192.168.2.5
Oct 17, 2024 11:21:13.557137012 CEST	6302	49708	185.196.9.26	192.168.2.5
Oct 17, 2024 11:21:13.557200909 CEST	6302	49708	185.196.9.26	192.168.2.5
Oct 17, 2024 11:21:13.557209015 CEST	6302	49708	185.196.9.26	192.168.2.5
Oct 17, 2024 11:21:13.557216883 CEST	6302	49708	185.196.9.26	192.168.2.5
Oct 17, 2024 11:21:13.557226896 CEST	6302	49708	185.196.9.26	192.168.2.5
Oct 17, 2024 11:21:13.557318926 CEST	6302	49708	185.196.9.26	192.168.2.5
Oct 17, 2024 11:21:14.124130964 CEST	6302	49708	185.196.9.26	192.168.2.5
Oct 17, 2024 11:21:14.125267029 CEST	49708	6302	192.168.2.5	185.196.9.26
Oct 17, 2024 11:21:14.130208969 CEST	6302	49708	185.196.9.26	192.168.2.5
Oct 17, 2024 11:21:14.855581999 CEST	6302	49708	185.196.9.26	192.168.2.5
Oct 17, 2024 11:21:14.899092913 CEST	49708	6302	192.168.2.5	185.196.9.26
Oct 17, 2024 11:21:15.723726034 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:15.723777056 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:15.723968029 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:15.724400997 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:15.724420071 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:16.472961903 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:16.473145962 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:16.477351904 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:16.477360964 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:16.477612019 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:16.490283966 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:16.535402060 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:16.737982988 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:16.738004923 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:16.738050938 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:16.738107920 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:16.738121986 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:16.738156080 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:16.741341114 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:16.857451916 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:16.857487917 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:16.861475945 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:16.861495972 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:16.869359970 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:16.976888895 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:16.976918936 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:16.977046967 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:16.977046967 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:16.977082968 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:16.977703094 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:17.096769094 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:17.096787930 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:17.096880913 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:17.096882105 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:17.096906900 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:17.097028971 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:17.215864897 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:17.215883970 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:17.215935946 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:17.215946913 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:17.215985060 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:17.216011047 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:17.527849913 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:17.527888060 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:17.527940989 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:17.527940989 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:17.528012037 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:17.528027058 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:17.528063059 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:17.528096914 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:17.531634092 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:17.531656981 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:17.531703949 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:17.531713009 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:17.531759024 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:17.531759024 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:17.572951078 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:17.573004007 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:17.573067904 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:17.573092937 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:17.573105097 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:17.573209047 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:17.691639900 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:17.691708088 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:17.691775084 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:17.691775084 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:17.691797972 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:17.691871881 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:17.777585030 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:17.777637005 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:17.777672052 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:17.777690887 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:17.777717113 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:17.777775049 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:17.812377930 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:17.812426090 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:17.812515020 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:17.812540054 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:17.812668085 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:17.812668085 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:17.931195974 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:17.931256056 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:17.931476116 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:17.931476116 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:17.931505919 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:17.931555986 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:18.180311918 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:18.180344105 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:18.180389881 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:18.180506945 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:18.180506945 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:18.180526972 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:18.180581093 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:18.181222916 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:18.181292057 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:18.181299925 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:18.181345940 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:18.181374073 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:18.181390047 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:18.181407928 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:18.181418896 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:18.181418896 CEST	49715	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:18.181425095 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:18.181431055 CEST	443	49715	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:18.218569040 CEST	49717	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:18.218616009 CEST	443	49717	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:18.218775988 CEST	49717	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:18.220343113 CEST	49718	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:18.220350027 CEST	443	49718	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:18.220416069 CEST	49718	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:18.220509052 CEST	49717	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:18.220521927 CEST	443	49717	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:18.220998049 CEST	49718	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:18.221007109 CEST	443	49718	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:18.222204924 CEST	49719	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:18.222243071 CEST	443	49719	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:18.222297907 CEST	49719	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:18.222394943 CEST	49719	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:18.222408056 CEST	443	49719	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:18.222882032 CEST	49720	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:18.222924948 CEST	443	49720	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:18.222971916 CEST	49720	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:18.223387003 CEST	49720	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:18.223397970 CEST	443	49720	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:18.223952055 CEST	49721	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:18.223984957 CEST	443	49721	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:18.224040985 CEST	49721	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:18.224126101 CEST	49721	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:18.224138021 CEST	443	49721	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:18.957848072 CEST	443	49721	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:18.958295107 CEST	49721	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:18.958321095 CEST	443	49721	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:18.958746910 CEST	49721	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:18.958753109 CEST	443	49721	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:18.962311029 CEST	443	49720	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:18.962692022 CEST	49720	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:18.962719917 CEST	443	49720	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:18.963104963 CEST	49720	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:18.963114023 CEST	443	49720	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:18.963304996 CEST	443	49718	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:18.963571072 CEST	49718	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:18.963603973 CEST	443	49718	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:18.963973045 CEST	49718	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:18.963979006 CEST	443	49718	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:18.968103886 CEST	443	49717	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:18.968446970 CEST	49717	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:18.968460083 CEST	443	49717	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:18.968849897 CEST	49717	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:18.968854904 CEST	443	49717	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:18.987894058 CEST	443	49719	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:18.988245964 CEST	49719	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:18.988276005 CEST	443	49719	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:18.988621950 CEST	49719	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:18.988629103 CEST	443	49719	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.090492964 CEST	443	49721	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.090553999 CEST	443	49721	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.090631008 CEST	49721	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.093329906 CEST	49721	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.093348980 CEST	443	49721	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.093359947 CEST	49721	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.093365908 CEST	443	49721	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.095731974 CEST	443	49718	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.096050024 CEST	443	49720	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.096064091 CEST	443	49720	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.096120119 CEST	49720	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.096148014 CEST	443	49720	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.096179962 CEST	443	49718	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.096189022 CEST	443	49720	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.096235037 CEST	49718	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.096251965 CEST	49720	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.096376896 CEST	49723	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.096409082 CEST	443	49723	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.096462965 CEST	49723	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.096489906 CEST	49718	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.096509933 CEST	443	49718	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.096520901 CEST	49718	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.096527100 CEST	443	49718	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.096582890 CEST	49720	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.096592903 CEST	443	49720	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.096602917 CEST	49720	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.096606970 CEST	443	49720	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.097121954 CEST	49723	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.097132921 CEST	443	49723	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.098994017 CEST	49724	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.099030018 CEST	443	49724	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.099087000 CEST	49724	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.099414110 CEST	49724	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.099431038 CEST	443	49724	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.100298882 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.100332975 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.100388050 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.100500107 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.100513935 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.102794886 CEST	443	49717	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.102849960 CEST	443	49717	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.102907896 CEST	49717	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.102917910 CEST	443	49717	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.102957010 CEST	49717	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.102989912 CEST	443	49717	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.103035927 CEST	49717	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.103116035 CEST	49717	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.103120089 CEST	443	49717	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.103128910 CEST	49717	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.103132010 CEST	443	49717	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.104969978 CEST	49726	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.104979992 CEST	443	49726	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.105041981 CEST	49726	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.105216026 CEST	49726	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.105228901 CEST	443	49726	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.125830889 CEST	443	49719	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.125855923 CEST	443	49719	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.125916004 CEST	443	49719	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.125926018 CEST	49719	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.125961065 CEST	49719	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.133680105 CEST	49719	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.133711100 CEST	443	49719	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.133729935 CEST	49719	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.133738041 CEST	443	49719	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.150973082 CEST	49727	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.151031971 CEST	443	49727	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.151139975 CEST	49727	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.154454947 CEST	49727	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.154469013 CEST	443	49727	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.831049919 CEST	443	49723	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.831617117 CEST	49723	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.831656933 CEST	443	49723	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.832446098 CEST	49723	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.832452059 CEST	443	49723	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.836452007 CEST	443	49724	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.836987972 CEST	49724	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.837003946 CEST	443	49724	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.837698936 CEST	49724	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.837704897 CEST	443	49724	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.847758055 CEST	443	49726	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.851630926 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.853116989 CEST	49726	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.853137016 CEST	443	49726	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.853446007 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.853458881 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.853595972 CEST	49726	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.853600979 CEST	443	49726	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.854048967 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.854053974 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.892724037 CEST	443	49727	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.893101931 CEST	49727	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.893119097 CEST	443	49727	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.893785000 CEST	49727	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.893790960 CEST	443	49727	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.961664915 CEST	443	49723	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.961960077 CEST	443	49723	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.962022066 CEST	49723	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.962111950 CEST	49723	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.962162018 CEST	443	49723	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.962213039 CEST	49723	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.962232113 CEST	443	49723	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.965452909 CEST	49729	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.965497017 CEST	443	49729	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.965557098 CEST	49729	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.965841055 CEST	49729	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.965854883 CEST	443	49729	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.970737934 CEST	443	49724	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.971404076 CEST	443	49724	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.971462011 CEST	49724	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.971497059 CEST	49724	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.971518993 CEST	443	49724	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.971529007 CEST	49724	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.971534967 CEST	443	49724	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.973959923 CEST	49730	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.973969936 CEST	443	49730	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.974024057 CEST	49730	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.974244118 CEST	49730	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.974256039 CEST	443	49730	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.981529951 CEST	443	49726	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.981705904 CEST	443	49726	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.981796026 CEST	49726	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.981796026 CEST	49726	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.981796026 CEST	49726	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.983850956 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.984028101 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.984093904 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.984148979 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.984148979 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.984184980 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.984225988 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.984343052 CEST	49731	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.984420061 CEST	443	49731	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.984482050 CEST	49731	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.984608889 CEST	49731	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.984627008 CEST	443	49731	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.986248970 CEST	49732	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.986272097 CEST	443	49732	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:19.986323118 CEST	49732	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.986426115 CEST	49732	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:19.986430883 CEST	443	49732	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:20.022218943 CEST	443	49727	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:20.022628069 CEST	443	49727	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:20.022686958 CEST	49727	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:20.022727013 CEST	49727	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:20.022746086 CEST	443	49727	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:20.022766113 CEST	49727	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:20.022773027 CEST	443	49727	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:20.025212049 CEST	49734	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:20.025280952 CEST	443	49734	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:20.025358915 CEST	49734	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:20.025492907 CEST	49734	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:20.025520086 CEST	443	49734	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:20.293390989 CEST	49726	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:20.293443918 CEST	443	49726	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:20.695044041 CEST	443	49729	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:20.695496082 CEST	49729	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:20.695523977 CEST	443	49729	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:20.695965052 CEST	49729	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:20.695969105 CEST	443	49729	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:20.713259935 CEST	443	49730	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:20.713650942 CEST	49730	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:20.713661909 CEST	443	49730	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:20.714065075 CEST	49730	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:20.714068890 CEST	443	49730	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:20.727866888 CEST	443	49731	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:20.728199005 CEST	49731	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:20.728292942 CEST	443	49731	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:20.728650093 CEST	49731	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:20.728666067 CEST	443	49731	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:20.737035036 CEST	443	49732	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:20.737390041 CEST	49732	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:20.737406969 CEST	443	49732	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:20.737853050 CEST	49732	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:20.737859964 CEST	443	49732	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:20.762006998 CEST	443	49734	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:20.762403011 CEST	49734	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:20.762420893 CEST	443	49734	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:20.762845993 CEST	49734	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:20.762850046 CEST	443	49734	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:20.812175989 CEST	49706	443	192.168.2.5	23.1.237.91
Oct 17, 2024 11:21:20.812247992 CEST	49706	443	192.168.2.5	23.1.237.91
Oct 17, 2024 11:21:20.812566996 CEST	49737	443	192.168.2.5	23.1.237.91
Oct 17, 2024 11:21:20.812680006 CEST	443	49737	23.1.237.91	192.168.2.5
Oct 17, 2024 11:21:20.812771082 CEST	49737	443	192.168.2.5	23.1.237.91
Oct 17, 2024 11:21:20.813108921 CEST	49737	443	192.168.2.5	23.1.237.91
Oct 17, 2024 11:21:20.813146114 CEST	443	49737	23.1.237.91	192.168.2.5
Oct 17, 2024 11:21:20.817162037 CEST	443	49706	23.1.237.91	192.168.2.5
Oct 17, 2024 11:21:20.817203045 CEST	443	49706	23.1.237.91	192.168.2.5
Oct 17, 2024 11:21:20.824888945 CEST	443	49729	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:20.825540066 CEST	443	49729	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:20.825773954 CEST	49729	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:20.825810909 CEST	49729	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:20.825829029 CEST	443	49729	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:20.825840950 CEST	49729	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:20.825848103 CEST	443	49729	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:20.828140974 CEST	49738	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:20.828172922 CEST	443	49738	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:20.828351974 CEST	49738	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:20.828480959 CEST	49738	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:20.828493118 CEST	443	49738	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:20.844089031 CEST	443	49730	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:20.844782114 CEST	443	49730	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:20.844845057 CEST	49730	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:20.844882965 CEST	49730	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:20.844888926 CEST	443	49730	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:20.844902039 CEST	49730	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:20.844906092 CEST	443	49730	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:20.847170115 CEST	49739	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:20.847193003 CEST	443	49739	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:20.847388983 CEST	49739	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:20.847645998 CEST	49739	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:20.847660065 CEST	443	49739	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:20.857584000 CEST	443	49731	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:20.857903004 CEST	443	49731	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:20.857986927 CEST	49731	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:20.857986927 CEST	49731	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:20.858071089 CEST	49731	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:20.858115911 CEST	443	49731	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:20.860331059 CEST	49740	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:20.860366106 CEST	443	49740	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:20.860610962 CEST	49740	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:20.860734940 CEST	49740	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:20.860757113 CEST	443	49740	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:20.868114948 CEST	443	49732	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:20.868247986 CEST	443	49732	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:20.868366003 CEST	49732	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:20.868366003 CEST	49732	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:20.868366003 CEST	49732	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:20.870186090 CEST	49741	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:20.870229959 CEST	443	49741	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:20.870325089 CEST	49741	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:20.870440960 CEST	49741	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:20.870452881 CEST	443	49741	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:20.891518116 CEST	443	49734	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:20.891659975 CEST	443	49734	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:20.891742945 CEST	49734	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:20.898642063 CEST	49734	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:20.898643017 CEST	49734	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:20.898683071 CEST	443	49734	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:20.898780107 CEST	443	49734	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:20.901149035 CEST	49742	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:20.901175976 CEST	443	49742	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:20.901235104 CEST	49742	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:20.901406050 CEST	49742	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:20.901422024 CEST	443	49742	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:21.168402910 CEST	49732	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:21.168428898 CEST	443	49732	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:21.503374100 CEST	443	49737	23.1.237.91	192.168.2.5
Oct 17, 2024 11:21:21.503493071 CEST	49737	443	192.168.2.5	23.1.237.91
Oct 17, 2024 11:21:21.567338943 CEST	443	49738	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:21.570826054 CEST	49738	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:21.570842981 CEST	443	49738	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:21.571434975 CEST	49738	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:21.571440935 CEST	443	49738	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:21.595609903 CEST	443	49739	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:21.598654032 CEST	49739	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:21.598671913 CEST	443	49739	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:21.599428892 CEST	49739	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:21.599435091 CEST	443	49739	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:21.614408016 CEST	443	49740	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:21.617367029 CEST	49740	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:21.617410898 CEST	443	49740	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:21.618006945 CEST	49740	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:21.618020058 CEST	443	49740	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:21.618263006 CEST	443	49741	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:21.618633032 CEST	49741	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:21.618665934 CEST	443	49741	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:21.619347095 CEST	49741	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:21.619359016 CEST	443	49741	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:21.661303997 CEST	443	49742	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:21.661990881 CEST	49742	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:21.662020922 CEST	443	49742	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:21.662611961 CEST	49742	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:21.662625074 CEST	443	49742	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:21.694925070 CEST	443	49738	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:21.695426941 CEST	443	49738	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:21.695564032 CEST	49738	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:21.695594072 CEST	49738	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:21.695594072 CEST	49738	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:21.695616961 CEST	443	49738	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:21.695626020 CEST	443	49738	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:21.698153973 CEST	49743	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:21.698206902 CEST	443	49743	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:21.698281050 CEST	49743	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:21.698437929 CEST	49743	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:21.698451042 CEST	443	49743	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:21.723351955 CEST	443	49739	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:21.723532915 CEST	443	49739	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:21.723598957 CEST	49739	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:21.723640919 CEST	49739	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:21.723655939 CEST	443	49739	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:21.723668098 CEST	49739	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:21.723673105 CEST	443	49739	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:21.726330996 CEST	49744	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:21.726418018 CEST	443	49744	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:21.726506948 CEST	49744	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:21.726675034 CEST	49744	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:21.726706028 CEST	443	49744	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:21.746870995 CEST	443	49741	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:21.747016907 CEST	443	49741	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:21.747096062 CEST	49741	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:21.747258902 CEST	443	49740	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:21.747536898 CEST	443	49740	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:21.747585058 CEST	49740	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:21.747740030 CEST	49741	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:21.747762918 CEST	443	49741	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:21.747772932 CEST	49741	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:21.747780085 CEST	443	49741	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:21.748744011 CEST	49740	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:21.748765945 CEST	443	49740	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:21.751808882 CEST	49745	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:21.751852036 CEST	443	49745	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:21.751907110 CEST	49745	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:21.752500057 CEST	49745	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:21.752513885 CEST	443	49745	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:21.752780914 CEST	49746	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:21.752799034 CEST	443	49746	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:21.752866983 CEST	49746	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:21.753022909 CEST	49746	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:21.753035069 CEST	443	49746	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:21.795847893 CEST	443	49742	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:21.796030045 CEST	443	49742	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:21.796087027 CEST	49742	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:21.796204090 CEST	49742	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:21.796230078 CEST	443	49742	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:21.796246052 CEST	49742	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:21.796252012 CEST	443	49742	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:21.799654961 CEST	49747	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:21.799700022 CEST	443	49747	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:21.799772978 CEST	49747	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:21.799943924 CEST	49747	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:21.799953938 CEST	443	49747	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:22.458364964 CEST	443	49744	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:22.459184885 CEST	49744	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:22.459213018 CEST	443	49744	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:22.459619045 CEST	49744	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:22.459626913 CEST	443	49744	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:22.460534096 CEST	443	49743	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:22.460912943 CEST	49743	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:22.460937023 CEST	443	49743	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:22.461368084 CEST	49743	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:22.461374044 CEST	443	49743	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:22.482669115 CEST	443	49745	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:22.483238935 CEST	49745	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:22.483263969 CEST	443	49745	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:22.483890057 CEST	49745	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:22.483896017 CEST	443	49745	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:22.489239931 CEST	443	49746	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:22.489650011 CEST	49746	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:22.489667892 CEST	443	49746	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:22.490186930 CEST	49746	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:22.490194082 CEST	443	49746	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:22.519823074 CEST	443	49747	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:22.520402908 CEST	49747	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:22.520431995 CEST	443	49747	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:22.520766020 CEST	49747	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:22.520776033 CEST	443	49747	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:22.590425968 CEST	443	49744	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:22.590696096 CEST	443	49744	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:22.590764999 CEST	49744	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:22.592401028 CEST	443	49743	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:22.592698097 CEST	443	49743	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:22.592746019 CEST	49743	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:22.600620031 CEST	49744	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:22.600657940 CEST	443	49744	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:22.600673914 CEST	49744	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:22.600682020 CEST	443	49744	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:22.600862980 CEST	49743	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:22.600898027 CEST	443	49743	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:22.600919008 CEST	49743	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:22.600927114 CEST	443	49743	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:22.604454994 CEST	49749	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:22.604513884 CEST	443	49749	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:22.604633093 CEST	49749	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:22.605133057 CEST	49749	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:22.605150938 CEST	443	49749	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:22.606254101 CEST	49750	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:22.606266022 CEST	443	49750	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:22.606311083 CEST	49750	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:22.606443882 CEST	49750	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:22.606456995 CEST	443	49750	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:22.612406969 CEST	443	49745	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:22.612505913 CEST	443	49745	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:22.612762928 CEST	49745	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:22.615871906 CEST	49745	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:22.615871906 CEST	49745	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:22.615894079 CEST	443	49745	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:22.615922928 CEST	443	49745	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:22.618730068 CEST	49751	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:22.618782043 CEST	443	49751	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:22.618876934 CEST	443	49746	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:22.618951082 CEST	49751	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:22.619168997 CEST	443	49746	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:22.619179964 CEST	49751	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:22.619200945 CEST	443	49751	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:22.619218111 CEST	49746	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:22.619352102 CEST	49746	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:22.619357109 CEST	443	49746	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:22.619366884 CEST	49746	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:22.619371891 CEST	443	49746	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:22.622860909 CEST	49752	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:22.622905016 CEST	443	49752	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:22.622972012 CEST	49752	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:22.623302937 CEST	49752	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:22.623316050 CEST	443	49752	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:22.651648045 CEST	443	49747	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:22.651794910 CEST	443	49747	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:22.651851892 CEST	49747	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:22.651971102 CEST	49747	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:22.651989937 CEST	443	49747	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:22.656003952 CEST	49753	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:22.656061888 CEST	443	49753	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:22.656121969 CEST	49753	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:22.656780958 CEST	49753	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:22.656805038 CEST	443	49753	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:23.339504004 CEST	443	49750	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:23.340392113 CEST	49750	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:23.340476036 CEST	443	49750	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:23.340604067 CEST	49750	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:23.340620041 CEST	443	49750	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:23.342714071 CEST	443	49751	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:23.343400002 CEST	49751	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:23.343400002 CEST	49751	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:23.343427896 CEST	443	49751	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:23.343450069 CEST	443	49751	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:23.355776072 CEST	443	49749	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:23.356580019 CEST	49749	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:23.356580019 CEST	49749	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:23.356600046 CEST	443	49749	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:23.356652975 CEST	443	49749	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:23.367927074 CEST	443	49752	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:23.368278027 CEST	49752	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:23.368307114 CEST	443	49752	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:23.368669033 CEST	49752	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:23.368674040 CEST	443	49752	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:23.394958019 CEST	443	49753	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:23.395718098 CEST	49753	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:23.395718098 CEST	49753	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:23.395749092 CEST	443	49753	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:23.395762920 CEST	443	49753	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:23.471616030 CEST	443	49750	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:23.471692085 CEST	443	49750	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:23.471932888 CEST	49750	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:23.471932888 CEST	49750	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:23.471932888 CEST	49750	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:23.471965075 CEST	443	49751	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:23.472163916 CEST	443	49751	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:23.472328901 CEST	49751	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:23.472328901 CEST	49751	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:23.472377062 CEST	49751	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:23.472393990 CEST	443	49751	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:23.474638939 CEST	49755	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:23.474641085 CEST	49754	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:23.474675894 CEST	443	49755	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:23.474687099 CEST	443	49754	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:23.474766016 CEST	49755	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:23.474767923 CEST	49754	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:23.474944115 CEST	49755	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:23.474946976 CEST	49754	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:23.474958897 CEST	443	49755	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:23.474965096 CEST	443	49754	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:23.485476971 CEST	443	49749	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:23.485686064 CEST	443	49749	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:23.485816956 CEST	49749	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:23.485816956 CEST	49749	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:23.485996008 CEST	49749	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:23.486030102 CEST	443	49749	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:23.487870932 CEST	49756	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:23.487903118 CEST	443	49756	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:23.488111019 CEST	49756	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:23.488142014 CEST	49756	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:23.488149881 CEST	443	49756	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:23.497999907 CEST	443	49752	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:23.498142004 CEST	443	49752	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:23.498255014 CEST	49752	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:23.498255014 CEST	49752	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:23.498255014 CEST	49752	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:23.500190020 CEST	49757	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:23.500224113 CEST	443	49757	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:23.500379086 CEST	49757	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:23.500430107 CEST	49757	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:23.500437021 CEST	443	49757	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:23.523649931 CEST	443	49753	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:23.523737907 CEST	443	49753	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:23.523834944 CEST	49753	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:23.523896933 CEST	49753	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:23.523896933 CEST	49753	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:23.523910999 CEST	443	49753	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:23.523922920 CEST	443	49753	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:23.525902987 CEST	49758	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:23.525943995 CEST	443	49758	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:23.526056051 CEST	49758	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:23.526120901 CEST	49758	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:23.526132107 CEST	443	49758	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:23.774837971 CEST	49750	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:23.774871111 CEST	443	49750	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:23.809062958 CEST	49752	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:23.809073925 CEST	443	49752	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:24.209186077 CEST	443	49755	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:24.212527990 CEST	49755	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:24.212555885 CEST	443	49755	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:24.213026047 CEST	49755	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:24.213031054 CEST	443	49755	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:24.222959042 CEST	443	49756	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:24.223592043 CEST	49756	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:24.223608971 CEST	443	49756	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:24.225054026 CEST	443	49754	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:24.226275921 CEST	49756	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:24.226280928 CEST	443	49756	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:24.226680994 CEST	49754	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:24.226702929 CEST	443	49754	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:24.227169991 CEST	49754	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:24.227175951 CEST	443	49754	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:24.239218950 CEST	443	49757	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:24.239671946 CEST	49757	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:24.239686966 CEST	443	49757	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:24.240088940 CEST	49757	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:24.240093946 CEST	443	49757	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:24.266222954 CEST	443	49758	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:24.266629934 CEST	49758	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:24.266643047 CEST	443	49758	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:24.267038107 CEST	49758	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:24.267041922 CEST	443	49758	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:24.338790894 CEST	443	49755	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:24.338956118 CEST	443	49755	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:24.339015961 CEST	49755	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:24.339140892 CEST	49755	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:24.339165926 CEST	443	49755	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:24.339178085 CEST	49755	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:24.339184999 CEST	443	49755	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:24.341944933 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:24.341989040 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:24.342084885 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:24.342252016 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:24.342267036 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:24.351644039 CEST	443	49756	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:24.351731062 CEST	443	49756	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:24.351778030 CEST	49756	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:24.351857901 CEST	49756	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:24.351869106 CEST	443	49756	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:24.351886988 CEST	49756	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:24.351891041 CEST	443	49756	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:24.354103088 CEST	49761	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:24.354139090 CEST	443	49761	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:24.354203939 CEST	49761	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:24.354351997 CEST	49761	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:24.354366064 CEST	443	49761	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:24.357707024 CEST	443	49754	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:24.357779026 CEST	443	49754	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:24.357835054 CEST	49754	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:24.358011007 CEST	49754	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:24.358011007 CEST	49754	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:24.358030081 CEST	443	49754	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:24.358041048 CEST	443	49754	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:24.359824896 CEST	49762	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:24.359839916 CEST	443	49762	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:24.360004902 CEST	49762	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:24.360153913 CEST	49762	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:24.360163927 CEST	443	49762	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:24.371350050 CEST	443	49757	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:24.372065067 CEST	443	49757	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:24.372132063 CEST	49757	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:24.372350931 CEST	49757	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:24.372361898 CEST	443	49757	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:24.372370958 CEST	49757	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:24.372375011 CEST	443	49757	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:24.374420881 CEST	49763	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:24.374444962 CEST	443	49763	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:24.374614954 CEST	49763	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:24.374778986 CEST	49763	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:24.374789000 CEST	443	49763	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:24.397808075 CEST	443	49758	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:24.397941113 CEST	443	49758	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:24.398042917 CEST	49758	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:24.398147106 CEST	49758	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:24.398152113 CEST	443	49758	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:24.398205042 CEST	49758	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:24.398209095 CEST	443	49758	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:24.400415897 CEST	49764	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:24.400458097 CEST	443	49764	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:24.400513887 CEST	49764	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:24.400825024 CEST	49764	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:24.400839090 CEST	443	49764	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:25.900593042 CEST	443	49762	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:25.901674986 CEST	49762	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:25.901691914 CEST	443	49762	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:25.902254105 CEST	49762	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:25.902257919 CEST	443	49762	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:25.913279057 CEST	443	49761	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:25.913665056 CEST	49761	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:25.913671970 CEST	443	49761	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:25.914174080 CEST	49761	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:25.914177895 CEST	443	49761	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:25.916390896 CEST	443	49764	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:25.916692972 CEST	49764	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:25.916702032 CEST	443	49763	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:25.916718960 CEST	443	49764	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:25.916986942 CEST	49763	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:25.917002916 CEST	443	49763	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:25.917260885 CEST	49764	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:25.917268038 CEST	443	49764	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:25.917464972 CEST	49763	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:25.917469978 CEST	443	49763	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:25.918127060 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:25.918493032 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:25.918498993 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:25.918981075 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:25.918986082 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.031800985 CEST	443	49762	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.032197952 CEST	443	49762	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.032267094 CEST	49762	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.032490015 CEST	49762	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.032506943 CEST	443	49762	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.032532930 CEST	49762	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.032538891 CEST	443	49762	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.035330057 CEST	49765	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.035410881 CEST	443	49765	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.035502911 CEST	49765	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.035619974 CEST	49765	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.035630941 CEST	443	49765	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.042515993 CEST	443	49761	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.042658091 CEST	443	49761	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.042720079 CEST	49761	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.042856932 CEST	49761	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.042864084 CEST	443	49761	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.042871952 CEST	49761	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.042876005 CEST	443	49761	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.045326948 CEST	49766	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.045372009 CEST	443	49766	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.046194077 CEST	443	49763	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.046291113 CEST	49766	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.046430111 CEST	443	49763	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.046498060 CEST	49763	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.046541929 CEST	49766	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.046566963 CEST	443	49766	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.046586990 CEST	49763	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.046602011 CEST	443	49763	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.046619892 CEST	49763	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.046626091 CEST	443	49763	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.047420025 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.047477007 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.047534943 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.047786951 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.047792912 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.047826052 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.047831059 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.048312902 CEST	443	49764	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.048388004 CEST	443	49764	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.049798965 CEST	49767	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.049840927 CEST	443	49767	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.049851894 CEST	49764	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.049851894 CEST	49764	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.049875021 CEST	49764	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.049881935 CEST	443	49764	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.049932957 CEST	49767	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.050085068 CEST	49767	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.050097942 CEST	443	49767	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.051773071 CEST	49768	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.051784992 CEST	443	49768	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.051860094 CEST	49768	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.051948071 CEST	49768	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.051961899 CEST	443	49768	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.052791119 CEST	49769	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.052819014 CEST	443	49769	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.057409048 CEST	49769	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.057564020 CEST	49769	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.057591915 CEST	443	49769	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.778055906 CEST	443	49765	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.778943062 CEST	49765	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.778963089 CEST	443	49765	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.779680014 CEST	49765	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.779685020 CEST	443	49765	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.784379005 CEST	443	49767	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.784835100 CEST	49767	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.784859896 CEST	443	49767	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.785330057 CEST	49767	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.785336018 CEST	443	49767	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.791182995 CEST	443	49766	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.791726112 CEST	49766	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.791737080 CEST	443	49766	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.792133093 CEST	49766	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.792136908 CEST	443	49766	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.800285101 CEST	443	49768	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.800657988 CEST	49768	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.800667048 CEST	443	49768	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.801538944 CEST	49768	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.801543951 CEST	443	49768	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.812741041 CEST	443	49769	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.813261032 CEST	49769	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.813283920 CEST	443	49769	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.813702106 CEST	49769	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.813715935 CEST	443	49769	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.906980038 CEST	443	49765	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.907299995 CEST	443	49765	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.907363892 CEST	49765	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.907444000 CEST	49765	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.907458067 CEST	443	49765	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.907490015 CEST	49765	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.907495975 CEST	443	49765	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.910233974 CEST	49771	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.910269976 CEST	443	49771	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.910336971 CEST	49771	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.910480022 CEST	49771	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.910509109 CEST	443	49771	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.913379908 CEST	443	49767	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.913770914 CEST	443	49767	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.913826942 CEST	49767	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.913858891 CEST	49767	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.913872004 CEST	443	49767	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.913881063 CEST	49767	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.913886070 CEST	443	49767	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.915841103 CEST	49772	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.915869951 CEST	443	49772	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.915941000 CEST	49772	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.916055918 CEST	49772	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.916071892 CEST	443	49772	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.923960924 CEST	443	49766	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.924032927 CEST	443	49766	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.924081087 CEST	49766	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.924209118 CEST	49766	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.924212933 CEST	443	49766	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.924238920 CEST	49766	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.924242973 CEST	443	49766	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.926214933 CEST	49773	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.926234007 CEST	443	49773	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.926310062 CEST	49773	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.926440001 CEST	49773	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.926450014 CEST	443	49773	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.932935953 CEST	443	49768	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.933054924 CEST	443	49768	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.933104992 CEST	49768	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.933134079 CEST	49768	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.933142900 CEST	443	49768	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.933154106 CEST	49768	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.933159113 CEST	443	49768	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.935169935 CEST	49774	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.935178995 CEST	443	49774	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.935252905 CEST	49774	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.935364008 CEST	49774	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.935373068 CEST	443	49774	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.943118095 CEST	443	49769	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.943212032 CEST	443	49769	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.943275928 CEST	49769	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.943350077 CEST	49769	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.943350077 CEST	49769	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.943413019 CEST	443	49769	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.943444014 CEST	443	49769	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.945264101 CEST	49775	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.945317030 CEST	443	49775	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:26.945419073 CEST	49775	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.945544958 CEST	49775	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:26.945578098 CEST	443	49775	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:27.646106005 CEST	443	49771	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:27.646754980 CEST	49771	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:27.646795988 CEST	443	49771	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:27.647219896 CEST	49771	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:27.647227049 CEST	443	49771	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:27.658184052 CEST	443	49772	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:27.658535004 CEST	49772	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:27.658545017 CEST	443	49772	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:27.658937931 CEST	49772	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:27.658942938 CEST	443	49772	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:27.660969973 CEST	443	49773	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:27.661279917 CEST	49773	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:27.661288977 CEST	443	49773	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:27.661647081 CEST	49773	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:27.661653042 CEST	443	49773	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:27.667108059 CEST	443	49774	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:27.667412996 CEST	49774	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:27.667422056 CEST	443	49774	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:27.667836905 CEST	49774	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:27.667843103 CEST	443	49774	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:27.690968037 CEST	443	49775	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:27.691296101 CEST	49775	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:27.691317081 CEST	443	49775	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:27.691692114 CEST	49775	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:27.691704035 CEST	443	49775	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:27.780333996 CEST	443	49771	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:27.780427933 CEST	443	49771	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:27.781151056 CEST	49771	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:27.781196117 CEST	49771	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:27.781196117 CEST	49771	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:27.781220913 CEST	443	49771	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:27.781235933 CEST	443	49771	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:27.783926964 CEST	49776	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:27.783970118 CEST	443	49776	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:27.784182072 CEST	49776	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:27.784321070 CEST	49776	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:27.784341097 CEST	443	49776	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:27.791028976 CEST	443	49772	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:27.791440964 CEST	443	49772	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:27.791501045 CEST	49772	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:27.791529894 CEST	49772	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:27.791538000 CEST	443	49772	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:27.791548967 CEST	49772	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:27.791553974 CEST	443	49772	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:27.792560101 CEST	443	49773	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:27.792763948 CEST	443	49773	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:27.792866945 CEST	49773	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:27.792992115 CEST	49773	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:27.793000937 CEST	443	49773	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:27.793013096 CEST	49773	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:27.793018103 CEST	443	49773	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:27.793723106 CEST	49777	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:27.793759108 CEST	443	49777	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:27.793911934 CEST	49777	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:27.794095039 CEST	49777	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:27.794109106 CEST	443	49777	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:27.796027899 CEST	49778	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:27.796036005 CEST	443	49778	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:27.796297073 CEST	49778	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:27.800575018 CEST	443	49774	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:27.800635099 CEST	443	49774	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:27.801124096 CEST	49774	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:27.805022955 CEST	49774	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:27.805032969 CEST	443	49774	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:27.805043936 CEST	49774	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:27.805051088 CEST	443	49774	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:27.805402994 CEST	49778	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:27.805413961 CEST	443	49778	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:27.807463884 CEST	49779	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:27.807476997 CEST	443	49779	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:27.807538986 CEST	49779	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:27.807702065 CEST	49779	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:27.807715893 CEST	443	49779	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:27.822474003 CEST	443	49775	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:27.822515965 CEST	443	49775	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:27.822590113 CEST	49775	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:27.822695017 CEST	49775	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:27.822695017 CEST	49775	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:27.822726965 CEST	443	49775	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:27.822753906 CEST	443	49775	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:27.825831890 CEST	49780	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:27.825865984 CEST	443	49780	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:27.826029062 CEST	49780	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:27.826255083 CEST	49780	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:27.826277018 CEST	443	49780	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:28.515912056 CEST	443	49776	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:28.516541958 CEST	49776	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:28.516575098 CEST	443	49776	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:28.517000914 CEST	49776	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:28.517010927 CEST	443	49776	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:28.535608053 CEST	443	49778	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:28.535727024 CEST	443	49777	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:28.536041021 CEST	49778	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:28.536056995 CEST	443	49778	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:28.536273956 CEST	49777	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:28.536288977 CEST	443	49777	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:28.536428928 CEST	49778	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:28.536433935 CEST	443	49778	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:28.536772013 CEST	49777	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:28.536777020 CEST	443	49777	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:28.537971020 CEST	443	49779	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:28.538264990 CEST	49779	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:28.538285971 CEST	443	49779	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:28.538619995 CEST	49779	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:28.538625956 CEST	443	49779	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:28.548588037 CEST	443	49780	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:28.548976898 CEST	49780	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:28.548990965 CEST	443	49780	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:28.549386978 CEST	49780	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:28.549392939 CEST	443	49780	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:28.647023916 CEST	443	49776	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:28.647109032 CEST	443	49776	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:28.647286892 CEST	49776	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:28.647371054 CEST	49776	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:28.647397995 CEST	443	49776	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:28.647413969 CEST	49776	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:28.647420883 CEST	443	49776	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:28.650285006 CEST	49781	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:28.650322914 CEST	443	49781	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:28.650418043 CEST	49781	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:28.650592089 CEST	49781	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:28.650604963 CEST	443	49781	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:28.661484003 CEST	443	49778	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:28.661741018 CEST	443	49778	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:28.661835909 CEST	49778	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:28.661955118 CEST	49778	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:28.661958933 CEST	443	49778	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:28.661967039 CEST	49778	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:28.661969900 CEST	443	49778	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:28.664316893 CEST	443	49777	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:28.664468050 CEST	443	49777	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:28.664541960 CEST	49777	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:28.665082932 CEST	49782	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:28.665107012 CEST	443	49782	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:28.665194988 CEST	49782	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:28.665357113 CEST	49777	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:28.665360928 CEST	443	49777	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:28.665369987 CEST	49777	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:28.665373087 CEST	443	49777	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:28.665535927 CEST	49782	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:28.665560961 CEST	443	49782	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:28.667597055 CEST	49783	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:28.667639971 CEST	443	49783	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:28.667742014 CEST	49783	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:28.667853117 CEST	443	49779	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:28.667877913 CEST	49783	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:28.667898893 CEST	443	49783	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:28.668103933 CEST	443	49779	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:28.668155909 CEST	49779	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:28.668185949 CEST	49779	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:28.668185949 CEST	49779	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:28.668201923 CEST	443	49779	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:28.668211937 CEST	443	49779	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:28.670352936 CEST	49784	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:28.670397043 CEST	443	49784	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:28.670445919 CEST	49784	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:28.670572996 CEST	49784	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:28.670586109 CEST	443	49784	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:28.675559044 CEST	443	49780	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:28.676054001 CEST	443	49780	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:28.676104069 CEST	49780	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:28.676146030 CEST	49780	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:28.676146030 CEST	49780	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:28.676166058 CEST	443	49780	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:28.676178932 CEST	443	49780	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:28.678419113 CEST	49785	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:28.678431988 CEST	443	49785	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:28.678489923 CEST	49785	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:28.678653002 CEST	49785	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:28.678669930 CEST	443	49785	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:29.381057024 CEST	443	49781	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:29.381563902 CEST	49781	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:29.381604910 CEST	443	49781	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:29.382292986 CEST	49781	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:29.382298946 CEST	443	49781	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:29.400727987 CEST	443	49783	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:29.401232004 CEST	49783	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:29.401247025 CEST	443	49783	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:29.401583910 CEST	49783	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:29.401591063 CEST	443	49783	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:29.410773993 CEST	443	49782	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:29.411369085 CEST	49782	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:29.411401033 CEST	443	49782	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:29.411633015 CEST	49782	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:29.411638975 CEST	443	49782	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:29.412800074 CEST	443	49784	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:29.413160086 CEST	49784	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:29.413198948 CEST	443	49784	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:29.413480997 CEST	49784	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:29.413489103 CEST	443	49784	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:29.420229912 CEST	443	49785	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:29.420561075 CEST	49785	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:29.420593977 CEST	443	49785	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:29.420897007 CEST	49785	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:29.420906067 CEST	443	49785	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:29.510466099 CEST	443	49781	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:29.510643005 CEST	443	49781	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:29.510811090 CEST	49781	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:29.510900021 CEST	49781	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:29.510900021 CEST	49781	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:29.510921955 CEST	443	49781	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:29.510931015 CEST	443	49781	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:29.513955116 CEST	49786	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:29.514056921 CEST	443	49786	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:29.514190912 CEST	49786	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:29.514434099 CEST	49786	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:29.514473915 CEST	443	49786	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:29.529031038 CEST	443	49783	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:29.529165983 CEST	443	49783	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:29.529225111 CEST	49783	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:29.529280901 CEST	49783	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:29.529280901 CEST	49783	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:29.529301882 CEST	443	49783	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:29.529314041 CEST	443	49783	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:29.531903982 CEST	49787	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:29.531946898 CEST	443	49787	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:29.532023907 CEST	49787	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:29.532201052 CEST	49787	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:29.532218933 CEST	443	49787	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:29.542262077 CEST	443	49782	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:29.542479992 CEST	443	49782	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:29.542596102 CEST	49782	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:29.542628050 CEST	49782	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:29.542628050 CEST	49782	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:29.542644978 CEST	443	49782	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:29.542653084 CEST	443	49782	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:29.545445919 CEST	49788	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:29.545495033 CEST	443	49788	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:29.545588017 CEST	49788	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:29.545737982 CEST	49788	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:29.545757055 CEST	443	49788	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:29.546231031 CEST	443	49784	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:29.546325922 CEST	443	49784	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:29.546379089 CEST	49784	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:29.546447039 CEST	49784	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:29.546464920 CEST	443	49784	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:29.546479940 CEST	49784	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:29.546488047 CEST	443	49784	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:29.548602104 CEST	49789	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:29.548615932 CEST	443	49789	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:29.548697948 CEST	49789	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:29.548837900 CEST	49789	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:29.548849106 CEST	443	49789	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:29.553649902 CEST	443	49785	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:29.553735971 CEST	443	49785	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:29.553811073 CEST	49785	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:29.553946972 CEST	49785	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:29.553947926 CEST	49785	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:29.553981066 CEST	443	49785	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:29.554007053 CEST	443	49785	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:29.556163073 CEST	49790	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:29.556171894 CEST	443	49790	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:29.556247950 CEST	49790	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:29.556392908 CEST	49790	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:29.556402922 CEST	443	49790	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:30.236743927 CEST	443	49786	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:30.241475105 CEST	49786	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:30.241519928 CEST	443	49786	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:30.242044926 CEST	49786	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:30.242059946 CEST	443	49786	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:30.263216019 CEST	443	49787	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:30.263787985 CEST	49787	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:30.263816118 CEST	443	49787	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:30.264147043 CEST	49787	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:30.264153957 CEST	443	49787	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:30.274055004 CEST	443	49788	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:30.274501085 CEST	49788	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:30.274539948 CEST	443	49788	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:30.274851084 CEST	49788	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:30.274857998 CEST	443	49788	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:30.281318903 CEST	443	49789	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:30.281683922 CEST	49789	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:30.281703949 CEST	443	49789	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:30.282027006 CEST	49789	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:30.282032013 CEST	443	49789	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:30.289710999 CEST	443	49790	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:30.290101051 CEST	49790	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:30.290112019 CEST	443	49790	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:30.290436983 CEST	49790	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:30.290443897 CEST	443	49790	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:30.366048098 CEST	443	49786	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:30.367213011 CEST	443	49786	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:30.367429972 CEST	49786	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:30.367429972 CEST	49786	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:30.367429972 CEST	49786	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:30.370008945 CEST	49791	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:30.370084047 CEST	443	49791	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:30.370165110 CEST	49791	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:30.370301962 CEST	49791	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:30.370322943 CEST	443	49791	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:30.391704082 CEST	443	49787	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:30.391803026 CEST	443	49787	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:30.391995907 CEST	49787	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:30.392211914 CEST	49787	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:30.392211914 CEST	49787	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:30.392234087 CEST	443	49787	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:30.392245054 CEST	443	49787	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:30.394582987 CEST	49792	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:30.394617081 CEST	443	49792	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:30.394692898 CEST	49792	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:30.394876003 CEST	49792	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:30.394889116 CEST	443	49792	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:30.401866913 CEST	443	49788	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:30.402131081 CEST	443	49788	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:30.402189970 CEST	49788	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:30.402226925 CEST	49788	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:30.402226925 CEST	49788	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:30.402247906 CEST	443	49788	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:30.402261019 CEST	443	49788	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:30.404387951 CEST	49793	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:30.404442072 CEST	443	49793	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:30.404618979 CEST	49793	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:30.404618979 CEST	49793	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:30.404689074 CEST	443	49793	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:30.413023949 CEST	443	49789	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:30.413155079 CEST	443	49789	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:30.413240910 CEST	49789	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:30.413265944 CEST	49789	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:30.413265944 CEST	49789	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:30.413279057 CEST	443	49789	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:30.413286924 CEST	443	49789	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:30.415169001 CEST	49794	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:30.415209055 CEST	443	49794	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:30.415278912 CEST	49794	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:30.415400982 CEST	49794	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:30.415410995 CEST	443	49794	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:30.420473099 CEST	443	49790	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:30.421200991 CEST	443	49790	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:30.421247959 CEST	49790	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:30.421273947 CEST	49790	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:30.421284914 CEST	443	49790	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:30.421293974 CEST	49790	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:30.421298027 CEST	443	49790	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:30.423095942 CEST	49795	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:30.423122883 CEST	443	49795	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:30.423202038 CEST	49795	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:30.423310041 CEST	49795	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:30.423322916 CEST	443	49795	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:30.668381929 CEST	49786	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:30.668416977 CEST	443	49786	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:31.106188059 CEST	443	49791	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:31.106725931 CEST	49791	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:31.106758118 CEST	443	49791	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:31.107161045 CEST	49791	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:31.107168913 CEST	443	49791	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:31.115737915 CEST	443	49792	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:31.116070986 CEST	49792	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:31.116086006 CEST	443	49792	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:31.116527081 CEST	49792	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:31.116533041 CEST	443	49792	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:31.136516094 CEST	443	49794	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:31.136811018 CEST	49794	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:31.136832952 CEST	443	49794	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:31.137178898 CEST	49794	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:31.137185097 CEST	443	49794	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:31.143073082 CEST	443	49795	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:31.143362045 CEST	49795	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:31.143369913 CEST	443	49795	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:31.143768072 CEST	49795	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:31.143771887 CEST	443	49795	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:31.146383047 CEST	443	49793	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:31.146680117 CEST	49793	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:31.146692038 CEST	443	49793	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:31.146998882 CEST	49793	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:31.147005081 CEST	443	49793	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:31.237019062 CEST	443	49791	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:31.237281084 CEST	443	49791	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:31.237345934 CEST	49791	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:31.237394094 CEST	49791	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:31.237394094 CEST	49791	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:31.237417936 CEST	443	49791	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:31.237432957 CEST	443	49791	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:31.240041018 CEST	49796	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:31.240082026 CEST	443	49796	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:31.240163088 CEST	49796	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:31.240312099 CEST	49796	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:31.240323067 CEST	443	49796	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:31.242810965 CEST	443	49792	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:31.243069887 CEST	443	49792	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:31.243129969 CEST	49792	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:31.243153095 CEST	49792	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:31.243168116 CEST	443	49792	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:31.243218899 CEST	49792	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:31.243227005 CEST	443	49792	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:31.245044947 CEST	49797	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:31.245080948 CEST	443	49797	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:31.245146990 CEST	49797	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:31.245265007 CEST	49797	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:31.245277882 CEST	443	49797	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:31.264585972 CEST	443	49794	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:31.264672995 CEST	443	49794	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:31.264725924 CEST	49794	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:31.264799118 CEST	49794	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:31.264817953 CEST	443	49794	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:31.264830112 CEST	49794	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:31.264837980 CEST	443	49794	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:31.266685009 CEST	49798	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:31.266707897 CEST	443	49798	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:31.266908884 CEST	49798	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:31.266908884 CEST	49798	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:31.266930103 CEST	443	49798	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:31.270068884 CEST	443	49795	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:31.270131111 CEST	443	49795	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:31.270272970 CEST	49795	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:31.270272970 CEST	49795	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:31.270272970 CEST	49795	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:31.272044897 CEST	49799	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:31.272058010 CEST	443	49799	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:31.272124052 CEST	49799	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:31.272249937 CEST	49799	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:31.272262096 CEST	443	49799	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:31.276909113 CEST	443	49793	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:31.277189016 CEST	443	49793	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:31.277241945 CEST	49793	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:31.277261019 CEST	49793	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:31.277267933 CEST	443	49793	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:31.277280092 CEST	49793	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:31.277283907 CEST	443	49793	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:31.279058933 CEST	49800	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:31.279086113 CEST	443	49800	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:31.279287100 CEST	49800	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:31.279287100 CEST	49800	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:31.279309988 CEST	443	49800	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:31.574635983 CEST	49795	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:31.574655056 CEST	443	49795	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:32.138206005 CEST	443	49796	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:32.139096975 CEST	49796	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:32.139123917 CEST	443	49796	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:32.139473915 CEST	49796	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:32.139486074 CEST	443	49796	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:32.141230106 CEST	443	49797	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:32.141489983 CEST	49797	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:32.141513109 CEST	443	49797	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:32.141796112 CEST	49797	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:32.141803026 CEST	443	49797	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:32.142302990 CEST	443	49800	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:32.142488956 CEST	443	49798	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:32.142527103 CEST	49800	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:32.142549992 CEST	443	49800	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:32.142736912 CEST	49798	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:32.142746925 CEST	443	49798	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:32.142848015 CEST	49800	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:32.142853022 CEST	443	49800	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:32.143187046 CEST	49798	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:32.143193960 CEST	443	49798	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:32.145526886 CEST	443	49799	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:32.145801067 CEST	49799	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:32.145819902 CEST	443	49799	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:32.146199942 CEST	49799	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:32.146209002 CEST	443	49799	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:32.267736912 CEST	443	49796	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:32.267894983 CEST	443	49796	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:32.267985106 CEST	49796	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:32.268028975 CEST	49796	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:32.268054962 CEST	443	49796	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:32.268065929 CEST	49796	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:32.268073082 CEST	443	49796	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:32.269093990 CEST	443	49797	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:32.269257069 CEST	443	49797	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:32.269316912 CEST	49797	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:32.269367933 CEST	49797	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:32.269397974 CEST	443	49797	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:32.269412041 CEST	49797	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:32.269418955 CEST	443	49797	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:32.270838976 CEST	49801	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:32.270935059 CEST	443	49801	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:32.271029949 CEST	49801	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:32.271156073 CEST	49801	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:32.271183014 CEST	443	49801	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:32.271435022 CEST	49802	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:32.271456957 CEST	443	49802	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:32.271524906 CEST	49802	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:32.271682978 CEST	49802	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:32.271708965 CEST	443	49802	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:32.273679018 CEST	443	49798	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:32.273762941 CEST	443	49798	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:32.273813009 CEST	49798	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:32.273875952 CEST	49798	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:32.273875952 CEST	49798	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:32.273888111 CEST	443	49798	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:32.273897886 CEST	443	49798	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:32.275773048 CEST	49803	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:32.275820017 CEST	443	49803	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:32.275892973 CEST	49803	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:32.276022911 CEST	49803	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:32.276036024 CEST	443	49803	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:32.283463955 CEST	443	49799	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:32.283633947 CEST	443	49799	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:32.283704042 CEST	49799	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:32.283759117 CEST	49799	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:32.283759117 CEST	49799	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:32.283766031 CEST	443	49799	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:32.283772945 CEST	443	49799	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:32.285496950 CEST	49804	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:32.285590887 CEST	443	49804	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:32.285672903 CEST	49804	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:32.285806894 CEST	49804	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:32.285840988 CEST	443	49804	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:32.420413971 CEST	443	49800	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:32.420567036 CEST	443	49800	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:32.420630932 CEST	49800	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:32.420739889 CEST	49800	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:32.420758963 CEST	443	49800	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:32.420773983 CEST	49800	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:32.420778990 CEST	443	49800	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:32.423625946 CEST	49805	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:32.423649073 CEST	443	49805	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:32.423732042 CEST	49805	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:32.423938990 CEST	49805	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:32.423954964 CEST	443	49805	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:32.999376059 CEST	443	49802	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:32.999876976 CEST	49802	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:32.999926090 CEST	443	49802	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:33.000343084 CEST	49802	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:33.000370979 CEST	443	49802	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:33.006794930 CEST	443	49801	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:33.007158995 CEST	49801	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:33.007174015 CEST	443	49801	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:33.007540941 CEST	49801	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:33.007551908 CEST	443	49801	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:33.019675970 CEST	443	49804	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:33.020035028 CEST	49804	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:33.020100117 CEST	443	49804	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:33.020401001 CEST	49804	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:33.020416975 CEST	443	49804	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:33.021908998 CEST	443	49803	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:33.022228956 CEST	49803	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:33.022253990 CEST	443	49803	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:33.022629976 CEST	49803	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:33.022634983 CEST	443	49803	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:33.129165888 CEST	443	49802	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:33.129287004 CEST	443	49802	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:33.129371881 CEST	49802	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:33.129558086 CEST	49802	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:33.129558086 CEST	49802	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:33.129600048 CEST	443	49802	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:33.129627943 CEST	443	49802	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:33.137818098 CEST	443	49801	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:33.137871027 CEST	443	49801	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:33.137928009 CEST	49801	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:33.137948990 CEST	443	49801	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:33.137991905 CEST	443	49801	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:33.138040066 CEST	49801	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:33.139458895 CEST	49801	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:33.139480114 CEST	443	49801	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:33.139502048 CEST	49801	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:33.139516115 CEST	443	49801	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:33.141743898 CEST	49806	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:33.141782999 CEST	443	49806	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:33.141844988 CEST	49806	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:33.143558025 CEST	49807	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:33.143632889 CEST	49806	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:33.143651962 CEST	443	49806	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:33.143651009 CEST	443	49807	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:33.143728018 CEST	49807	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:33.143924952 CEST	49807	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:33.143959999 CEST	443	49807	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:33.153671026 CEST	443	49804	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:33.153717995 CEST	443	49804	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:33.153779984 CEST	49804	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:33.153805017 CEST	443	49804	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:33.153892994 CEST	443	49804	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:33.153947115 CEST	49804	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:33.154316902 CEST	443	49803	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:33.154799938 CEST	49804	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:33.154800892 CEST	49804	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:33.154824972 CEST	443	49804	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:33.154848099 CEST	443	49804	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:33.154961109 CEST	443	49803	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:33.155005932 CEST	49803	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:33.155885935 CEST	443	49805	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:33.156267881 CEST	49803	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:33.156275034 CEST	443	49803	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:33.156286001 CEST	49803	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:33.156291008 CEST	443	49803	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:33.157658100 CEST	49805	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:33.157670021 CEST	443	49805	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:33.158072948 CEST	49805	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:33.158077955 CEST	443	49805	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:33.160223961 CEST	49808	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:33.160270929 CEST	443	49808	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:33.160337925 CEST	49808	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:33.160463095 CEST	49808	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:33.160478115 CEST	443	49808	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:33.161608934 CEST	49809	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:33.161648989 CEST	443	49809	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:33.161700964 CEST	49809	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:33.161997080 CEST	49809	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:33.162012100 CEST	443	49809	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:33.286825895 CEST	443	49805	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:33.286885023 CEST	443	49805	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:33.286967993 CEST	49805	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:33.286993980 CEST	443	49805	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:33.287018061 CEST	443	49805	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:33.287040949 CEST	49805	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:33.287065029 CEST	49805	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:33.287226915 CEST	49805	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:33.287245035 CEST	443	49805	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:33.287255049 CEST	49805	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:33.287260056 CEST	443	49805	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:33.289691925 CEST	49810	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:33.289732933 CEST	443	49810	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:33.289798021 CEST	49810	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:33.289943933 CEST	49810	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:33.289958954 CEST	443	49810	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:33.929337025 CEST	443	49808	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:33.929872036 CEST	49808	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:33.929887056 CEST	443	49808	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:33.930330992 CEST	49808	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:33.930336952 CEST	443	49808	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:33.938096046 CEST	443	49807	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:33.938838959 CEST	49807	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:33.938853979 CEST	443	49807	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:33.939176083 CEST	49807	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:33.939182997 CEST	443	49807	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:33.944474936 CEST	443	49806	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:33.945657015 CEST	49806	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:33.945668936 CEST	443	49806	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:33.946074009 CEST	49806	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:33.946079016 CEST	443	49806	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:33.950269938 CEST	443	49809	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:33.953428984 CEST	49809	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:33.953448057 CEST	443	49809	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:33.953820944 CEST	49809	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:33.953825951 CEST	443	49809	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.058088064 CEST	443	49810	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.058588982 CEST	49810	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.058624029 CEST	443	49810	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.059079885 CEST	49810	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.059086084 CEST	443	49810	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.063069105 CEST	443	49808	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.063190937 CEST	443	49808	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.063291073 CEST	49808	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.063314915 CEST	49808	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.063325882 CEST	443	49808	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.063340902 CEST	49808	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.063344955 CEST	443	49808	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.065922976 CEST	49811	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.065948009 CEST	443	49811	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.066015005 CEST	49811	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.066138983 CEST	49811	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.066148996 CEST	443	49811	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.068082094 CEST	443	49807	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.068520069 CEST	443	49807	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.068571091 CEST	49807	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.068612099 CEST	49807	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.068625927 CEST	443	49807	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.068639040 CEST	49807	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.068645000 CEST	443	49807	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.070729971 CEST	49812	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.070758104 CEST	443	49812	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.070832014 CEST	49812	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.070960999 CEST	49812	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.070975065 CEST	443	49812	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.074749947 CEST	443	49806	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.074798107 CEST	443	49806	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.074928999 CEST	49806	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.074939966 CEST	443	49806	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.074958086 CEST	443	49806	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.075002909 CEST	49806	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.075028896 CEST	49806	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.075038910 CEST	443	49806	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.075050116 CEST	49806	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.075054884 CEST	443	49806	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.076839924 CEST	49813	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.076873064 CEST	443	49813	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.077073097 CEST	49813	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.077073097 CEST	49813	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.077100992 CEST	443	49813	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.080995083 CEST	443	49809	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.081127882 CEST	443	49809	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.081177950 CEST	49809	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.081223965 CEST	49809	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.081235886 CEST	443	49809	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.081247091 CEST	49809	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.081252098 CEST	443	49809	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.083143950 CEST	49814	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.083152056 CEST	443	49814	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.083223104 CEST	49814	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.083344936 CEST	49814	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.083359003 CEST	443	49814	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.205135107 CEST	443	49810	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.205287933 CEST	443	49810	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.205410957 CEST	49810	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.205496073 CEST	49810	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.205504894 CEST	443	49810	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.205513954 CEST	49810	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.205518961 CEST	443	49810	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.208288908 CEST	49815	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.208303928 CEST	443	49815	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.208626986 CEST	49815	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.208626986 CEST	49815	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.208647966 CEST	443	49815	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.800244093 CEST	443	49812	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.800844908 CEST	49812	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.800858021 CEST	443	49812	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.801395893 CEST	49812	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.801399946 CEST	443	49812	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.801902056 CEST	443	49811	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.802158117 CEST	49811	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.802172899 CEST	443	49811	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.802500963 CEST	49811	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.802505016 CEST	443	49811	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.822900057 CEST	443	49814	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.823415041 CEST	49814	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.823431015 CEST	443	49814	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.823889017 CEST	49814	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.823894024 CEST	443	49814	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.827338934 CEST	443	49813	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.827589035 CEST	49813	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.827594995 CEST	443	49813	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.827912092 CEST	49813	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.827915907 CEST	443	49813	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.927853107 CEST	443	49812	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.928047895 CEST	443	49812	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.928200960 CEST	49812	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.928200960 CEST	49812	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.928200960 CEST	49812	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.930619955 CEST	49816	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.930691004 CEST	443	49816	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.930774927 CEST	49816	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.930826902 CEST	443	49811	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.930877924 CEST	443	49811	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.930918932 CEST	49816	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.930929899 CEST	49811	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.930948973 CEST	443	49816	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.931068897 CEST	49811	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.931068897 CEST	49811	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.931082010 CEST	443	49811	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.931088924 CEST	443	49811	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.933187008 CEST	49817	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.933239937 CEST	443	49817	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.933324099 CEST	49817	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.933487892 CEST	49817	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.933518887 CEST	443	49817	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.951453924 CEST	443	49814	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.951605082 CEST	443	49814	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.951679945 CEST	49814	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.951890945 CEST	49814	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.951890945 CEST	49814	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.951905012 CEST	443	49814	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.951915026 CEST	443	49814	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.953772068 CEST	49818	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.953795910 CEST	443	49818	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.953933954 CEST	49818	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.954056025 CEST	49818	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.954082012 CEST	443	49818	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.958242893 CEST	443	49813	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.958379984 CEST	443	49813	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.958435059 CEST	49813	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.958479881 CEST	49813	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.958486080 CEST	443	49813	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.958493948 CEST	49813	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.958498001 CEST	443	49813	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.959785938 CEST	443	49815	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.960200071 CEST	49819	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.960257053 CEST	443	49819	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.960501909 CEST	49815	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.960511923 CEST	443	49815	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.960541010 CEST	49819	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.960649967 CEST	49819	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.960665941 CEST	443	49819	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:34.960896969 CEST	49815	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:34.960901976 CEST	443	49815	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:35.094177961 CEST	443	49815	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:35.094362974 CEST	443	49815	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:35.094569921 CEST	49815	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:35.094646931 CEST	49815	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:35.094660044 CEST	443	49815	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:35.094671011 CEST	49815	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:35.094676018 CEST	443	49815	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:35.097146034 CEST	49820	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:35.097243071 CEST	443	49820	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:35.097338915 CEST	49820	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:35.097474098 CEST	49820	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:35.097511053 CEST	443	49820	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:35.152760983 CEST	49812	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:35.152769089 CEST	443	49812	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:35.662801027 CEST	443	49817	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:35.663275957 CEST	49817	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:35.663311958 CEST	443	49817	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:35.663727045 CEST	49817	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:35.663746119 CEST	443	49817	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:35.672055006 CEST	443	49816	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:35.672353029 CEST	49816	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:35.672367096 CEST	443	49816	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:35.672738075 CEST	49816	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:35.672744036 CEST	443	49816	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:35.708039045 CEST	443	49818	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:35.708524942 CEST	49818	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:35.708545923 CEST	443	49818	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:35.709074020 CEST	49818	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:35.709085941 CEST	443	49818	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:35.791591883 CEST	443	49817	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:35.791618109 CEST	443	49817	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:35.791656971 CEST	443	49817	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:35.791688919 CEST	49817	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:35.791724920 CEST	49817	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:35.791923046 CEST	49817	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:35.791950941 CEST	443	49817	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:35.791975975 CEST	49817	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:35.791991949 CEST	443	49817	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:35.798845053 CEST	49821	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:35.798871040 CEST	443	49821	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:35.798947096 CEST	49821	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:35.799241066 CEST	49821	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:35.799252987 CEST	443	49821	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:35.801812887 CEST	443	49816	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:35.801878929 CEST	443	49816	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:35.801927090 CEST	49816	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:35.802050114 CEST	49816	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:35.802069902 CEST	443	49816	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:35.802078962 CEST	49816	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:35.802084923 CEST	443	49816	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:35.804656029 CEST	49822	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:35.804665089 CEST	443	49822	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:35.804739952 CEST	49822	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:35.804852009 CEST	49822	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:35.804860115 CEST	443	49822	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:35.831435919 CEST	443	49820	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:35.831902027 CEST	49820	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:35.831957102 CEST	443	49820	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:35.832323074 CEST	49820	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:35.832340002 CEST	443	49820	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:35.840092897 CEST	443	49818	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:35.840225935 CEST	443	49818	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:35.840312004 CEST	49818	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:35.840359926 CEST	49818	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:35.840380907 CEST	443	49818	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:35.840404987 CEST	49818	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:35.840416908 CEST	443	49818	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:35.842905045 CEST	49823	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:35.842931032 CEST	443	49823	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:35.843081951 CEST	49823	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:35.843224049 CEST	49823	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:35.843250990 CEST	443	49823	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:35.958759069 CEST	443	49820	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:35.958920956 CEST	443	49820	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:35.959011078 CEST	49820	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:35.959059000 CEST	49820	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:35.959059000 CEST	49820	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:35.959086895 CEST	443	49820	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:35.959124088 CEST	443	49820	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:35.961253881 CEST	49824	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:35.961298943 CEST	443	49824	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:35.961385012 CEST	49824	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:35.961523056 CEST	49824	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:35.961545944 CEST	443	49824	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:36.535151005 CEST	443	49821	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:36.535727024 CEST	49821	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:36.535742998 CEST	443	49821	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:36.536214113 CEST	49821	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:36.536218882 CEST	443	49821	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:36.543196917 CEST	443	49822	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:36.543536901 CEST	49822	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:36.543541908 CEST	443	49822	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:36.544014931 CEST	49822	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:36.544018984 CEST	443	49822	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:36.589981079 CEST	443	49823	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:36.590421915 CEST	49823	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:36.590462923 CEST	443	49823	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:36.590842009 CEST	49823	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:36.590854883 CEST	443	49823	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:36.666665077 CEST	443	49821	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:36.666800022 CEST	443	49821	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:36.666861057 CEST	49821	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:36.667115927 CEST	49821	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:36.667124987 CEST	443	49821	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:36.667135954 CEST	49821	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:36.667140007 CEST	443	49821	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:36.669934034 CEST	49825	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:36.669950008 CEST	443	49825	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:36.670037985 CEST	49825	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:36.670156002 CEST	49825	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:36.670171976 CEST	443	49825	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:36.673563957 CEST	443	49822	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:36.673636913 CEST	443	49822	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:36.673685074 CEST	49822	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:36.673772097 CEST	49822	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:36.673775911 CEST	443	49822	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:36.673805952 CEST	49822	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:36.673810005 CEST	443	49822	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:36.675935984 CEST	49826	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:36.675944090 CEST	443	49826	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:36.676017046 CEST	49826	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:36.676158905 CEST	49826	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:36.676170111 CEST	443	49826	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:36.701256037 CEST	443	49824	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:36.702379942 CEST	49824	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:36.702455997 CEST	443	49824	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:36.709919930 CEST	49824	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:36.709934950 CEST	443	49824	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:36.719793081 CEST	443	49823	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:36.719856024 CEST	443	49823	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:36.719906092 CEST	49823	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:36.719923973 CEST	443	49823	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:36.719954014 CEST	443	49823	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:36.720011950 CEST	49823	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:36.720084906 CEST	49823	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:36.720103979 CEST	443	49823	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:36.720125914 CEST	49823	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:36.720140934 CEST	443	49823	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:36.722867012 CEST	49827	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:36.722913027 CEST	443	49827	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:36.722987890 CEST	49827	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:36.723181963 CEST	49827	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:36.723210096 CEST	443	49827	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:36.727513075 CEST	443	49819	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:36.727935076 CEST	49819	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:36.727960110 CEST	443	49819	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:36.728401899 CEST	49819	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:36.728406906 CEST	443	49819	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:36.835966110 CEST	443	49824	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:36.836129904 CEST	443	49824	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:36.836205959 CEST	49824	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:36.836308002 CEST	49824	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:36.836338043 CEST	443	49824	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:36.836383104 CEST	49824	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:36.836395979 CEST	443	49824	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:36.839366913 CEST	49828	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:36.839411974 CEST	443	49828	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:36.839503050 CEST	49828	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:36.839689970 CEST	49828	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:36.839709997 CEST	443	49828	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:36.972203016 CEST	443	49819	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:36.972278118 CEST	443	49819	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:36.972347975 CEST	49819	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:36.972358942 CEST	443	49819	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:36.972394943 CEST	443	49819	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:36.972439051 CEST	49819	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:36.972548962 CEST	49819	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:36.972565889 CEST	443	49819	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:36.972580910 CEST	49819	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:36.972585917 CEST	443	49819	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:36.975074053 CEST	49829	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:36.975135088 CEST	443	49829	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:36.975274086 CEST	49829	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:36.975425005 CEST	49829	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:36.975452900 CEST	443	49829	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:37.412188053 CEST	443	49825	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:37.417889118 CEST	443	49826	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:37.429557085 CEST	49825	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:37.429573059 CEST	443	49825	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:37.429960966 CEST	49825	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:37.429965973 CEST	443	49825	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:37.430282116 CEST	49826	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:37.430289030 CEST	443	49826	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:37.430736065 CEST	49826	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:37.430738926 CEST	443	49826	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:37.465847969 CEST	443	49827	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:37.466368914 CEST	49827	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:37.466424942 CEST	443	49827	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:37.466824055 CEST	49827	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:37.466840029 CEST	443	49827	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:37.557348967 CEST	443	49826	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:37.557418108 CEST	443	49826	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:37.557468891 CEST	49826	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:37.557683945 CEST	49826	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:37.557692051 CEST	443	49826	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:37.557730913 CEST	49826	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:37.557735920 CEST	443	49826	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:37.559468031 CEST	443	49825	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:37.559663057 CEST	443	49825	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:37.559711933 CEST	49825	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:37.560565948 CEST	49830	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:37.560600042 CEST	443	49830	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:37.560621977 CEST	49825	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:37.560626030 CEST	443	49825	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:37.560655117 CEST	49830	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:37.561949015 CEST	49830	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:37.561964035 CEST	443	49830	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:37.562927961 CEST	49831	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:37.562973022 CEST	443	49831	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:37.563034058 CEST	49831	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:37.563169956 CEST	49831	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:37.563188076 CEST	443	49831	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:37.577476978 CEST	443	49828	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:37.577841997 CEST	49828	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:37.577860117 CEST	443	49828	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:37.578274012 CEST	49828	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:37.578279018 CEST	443	49828	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:37.596298933 CEST	443	49827	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:37.596359015 CEST	443	49827	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:37.596422911 CEST	49827	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:37.596452951 CEST	443	49827	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:37.596482992 CEST	443	49827	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:37.596529961 CEST	49827	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:37.596529961 CEST	49827	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:37.596573114 CEST	443	49827	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:37.598409891 CEST	49832	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:37.598428011 CEST	443	49832	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:37.598618031 CEST	49832	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:37.598761082 CEST	49832	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:37.598772049 CEST	443	49832	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:37.706407070 CEST	443	49828	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:37.706558943 CEST	443	49828	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:37.706625938 CEST	49828	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:37.706716061 CEST	49828	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:37.706732035 CEST	443	49828	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:37.706743956 CEST	49828	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:37.706748962 CEST	443	49828	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:37.709177017 CEST	49833	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:37.709202051 CEST	443	49833	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:37.709384918 CEST	49833	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:37.709435940 CEST	49833	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:37.709439993 CEST	443	49833	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:37.710083008 CEST	443	49829	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:37.710447073 CEST	49829	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:37.710462093 CEST	443	49829	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:37.710913897 CEST	49829	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:37.710922003 CEST	443	49829	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:37.838274956 CEST	443	49829	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:37.838345051 CEST	443	49829	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:37.838395119 CEST	49829	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:37.838422060 CEST	443	49829	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:37.838453054 CEST	443	49829	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:37.838501930 CEST	49829	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:37.838638067 CEST	49829	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:37.838653088 CEST	443	49829	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:37.838665009 CEST	49829	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:37.838671923 CEST	443	49829	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:37.841654062 CEST	49834	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:37.841706038 CEST	443	49834	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:37.841813087 CEST	49834	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:37.841908932 CEST	49834	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:37.841916084 CEST	443	49834	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:37.902803898 CEST	49827	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:37.902854919 CEST	443	49827	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:38.283539057 CEST	443	49831	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:38.283984900 CEST	49831	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:38.283998013 CEST	443	49831	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:38.284420967 CEST	49831	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:38.284425974 CEST	443	49831	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:38.288306952 CEST	443	49830	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:38.288686037 CEST	49830	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:38.288748980 CEST	443	49830	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:38.289170027 CEST	49830	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:38.289228916 CEST	443	49830	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:38.350702047 CEST	443	49832	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:38.351329088 CEST	49832	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:38.351336956 CEST	443	49832	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:38.351548910 CEST	49832	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:38.351552963 CEST	443	49832	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:38.413947105 CEST	443	49831	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:38.414007902 CEST	443	49831	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:38.414067984 CEST	49831	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:38.414197922 CEST	49831	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:38.414216042 CEST	443	49831	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:38.414225101 CEST	49831	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:38.414231062 CEST	443	49831	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:38.416754007 CEST	49835	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:38.416783094 CEST	443	49835	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:38.416887999 CEST	49835	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:38.417224884 CEST	49835	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:38.417236090 CEST	443	49835	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:38.423166037 CEST	443	49830	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:38.423329115 CEST	443	49830	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:38.423422098 CEST	49830	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:38.429634094 CEST	49830	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:38.429635048 CEST	49830	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:38.429663897 CEST	443	49830	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:38.429687977 CEST	443	49830	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:38.432039022 CEST	49836	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:38.432063103 CEST	443	49836	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:38.432131052 CEST	49836	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:38.432262897 CEST	49836	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:38.432271004 CEST	443	49836	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:38.472902060 CEST	443	49833	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:38.473304987 CEST	49833	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:38.473324060 CEST	443	49833	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:38.473726988 CEST	49833	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:38.473731995 CEST	443	49833	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:38.482094049 CEST	443	49832	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:38.482237101 CEST	443	49832	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:38.482315063 CEST	49832	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:38.482377052 CEST	49832	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:38.482377052 CEST	49832	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:38.482386112 CEST	443	49832	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:38.482393026 CEST	443	49832	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:38.484221935 CEST	49837	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:38.484265089 CEST	443	49837	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:38.484332085 CEST	49837	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:38.484441996 CEST	49837	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:38.484457970 CEST	443	49837	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:38.574477911 CEST	443	49834	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:38.574994087 CEST	49834	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:38.575011015 CEST	443	49834	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:38.575409889 CEST	49834	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:38.575414896 CEST	443	49834	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:38.604787111 CEST	443	49833	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:38.604854107 CEST	443	49833	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:38.604912996 CEST	49833	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:38.604923964 CEST	443	49833	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:38.604991913 CEST	443	49833	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:38.605041981 CEST	49833	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:38.605060101 CEST	443	49833	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:38.605072975 CEST	49833	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:38.605072975 CEST	49833	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:38.605078936 CEST	443	49833	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:38.605084896 CEST	443	49833	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:38.607557058 CEST	49838	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:38.607568979 CEST	443	49838	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:38.607662916 CEST	49838	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:38.607793093 CEST	49838	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:38.607815027 CEST	443	49838	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:38.701946974 CEST	443	49834	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:38.704781055 CEST	443	49834	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:38.704833984 CEST	49834	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:38.704866886 CEST	49834	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:38.704879999 CEST	443	49834	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:38.704889059 CEST	49834	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:38.704895020 CEST	443	49834	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:38.707542896 CEST	49839	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:38.707585096 CEST	443	49839	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:38.707639933 CEST	49839	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:38.707772970 CEST	49839	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:38.707791090 CEST	443	49839	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:39.151557922 CEST	443	49835	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:39.152017117 CEST	49835	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:39.152036905 CEST	443	49835	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:39.152456999 CEST	49835	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:39.152462959 CEST	443	49835	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:39.175343990 CEST	443	49836	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:39.175683022 CEST	49836	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:39.175705910 CEST	443	49836	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:39.176021099 CEST	49836	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:39.176026106 CEST	443	49836	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:39.212922096 CEST	443	49837	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:39.213258982 CEST	49837	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:39.213285923 CEST	443	49837	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:39.213661909 CEST	49837	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:39.213668108 CEST	443	49837	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:39.280404091 CEST	443	49835	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:39.280458927 CEST	443	49835	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:39.280520916 CEST	49835	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:39.291599989 CEST	49835	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:39.291613102 CEST	443	49835	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:39.291646004 CEST	49835	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:39.291651964 CEST	443	49835	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:39.295166016 CEST	49840	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:39.295231104 CEST	443	49840	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:39.295309067 CEST	49840	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:39.295531988 CEST	49840	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:39.295562983 CEST	443	49840	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:39.305313110 CEST	443	49836	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:39.305515051 CEST	443	49836	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:39.305573940 CEST	49836	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:39.305651903 CEST	49836	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:39.305663109 CEST	443	49836	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:39.305672884 CEST	49836	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:39.305677891 CEST	443	49836	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:39.308139086 CEST	49841	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:39.308185101 CEST	443	49841	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:39.308233976 CEST	49841	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:39.308496952 CEST	49841	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:39.308511972 CEST	443	49841	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:39.340600967 CEST	443	49837	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:39.340683937 CEST	443	49837	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:39.340742111 CEST	49837	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:39.340759039 CEST	443	49837	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:39.340786934 CEST	443	49837	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:39.340827942 CEST	49837	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:39.340917110 CEST	49837	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:39.340930939 CEST	443	49837	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:39.340948105 CEST	49837	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:39.340953112 CEST	443	49837	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:39.342777014 CEST	49842	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:39.342808962 CEST	443	49842	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:39.342869997 CEST	49842	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:39.342978954 CEST	49842	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:39.342993975 CEST	443	49842	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:39.343497992 CEST	443	49838	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:39.343782902 CEST	49838	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:39.343791962 CEST	443	49838	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:39.344185114 CEST	49838	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:39.344189882 CEST	443	49838	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:39.461848974 CEST	443	49839	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:39.470468998 CEST	443	49838	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:39.470629930 CEST	443	49838	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:39.470726967 CEST	49838	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:39.481194973 CEST	49839	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:39.481224060 CEST	443	49839	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:39.481643915 CEST	49839	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:39.481650114 CEST	443	49839	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:39.481842995 CEST	49838	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:39.481858969 CEST	443	49838	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:39.481867075 CEST	49838	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:39.481872082 CEST	443	49838	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:39.484142065 CEST	49843	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:39.484184027 CEST	443	49843	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:39.484261990 CEST	49843	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:39.484488964 CEST	49843	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:39.484515905 CEST	443	49843	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:39.608952999 CEST	443	49839	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:39.609112978 CEST	443	49839	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:39.609205008 CEST	49839	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:39.612158060 CEST	49839	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:39.612171888 CEST	443	49839	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:39.612181902 CEST	49839	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:39.612186909 CEST	443	49839	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:39.633347034 CEST	49844	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:39.633371115 CEST	443	49844	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:39.633460999 CEST	49844	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:39.633591890 CEST	49844	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:39.633599997 CEST	443	49844	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:40.023710012 CEST	443	49840	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:40.024285078 CEST	49840	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:40.024373055 CEST	443	49840	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:40.024625063 CEST	49840	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:40.024642944 CEST	443	49840	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:40.048301935 CEST	443	49841	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:40.048677921 CEST	49841	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:40.048697948 CEST	443	49841	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:40.049057007 CEST	49841	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:40.049062967 CEST	443	49841	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:40.093832016 CEST	443	49842	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:40.094088078 CEST	49842	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:40.094096899 CEST	443	49842	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:40.094407082 CEST	49842	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:40.094412088 CEST	443	49842	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:40.152461052 CEST	443	49840	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:40.152527094 CEST	443	49840	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:40.152580976 CEST	49840	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:40.152729034 CEST	49840	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:40.152745962 CEST	443	49840	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:40.156006098 CEST	49845	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:40.156044006 CEST	443	49845	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:40.156110048 CEST	49845	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:40.156277895 CEST	49845	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:40.156294107 CEST	443	49845	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:40.178791046 CEST	443	49841	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:40.178874969 CEST	443	49841	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:40.178934097 CEST	49841	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:40.178947926 CEST	443	49841	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:40.178988934 CEST	443	49841	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:40.179008961 CEST	49841	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:40.179030895 CEST	443	49841	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:40.179042101 CEST	49841	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:40.179042101 CEST	49841	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:40.179049015 CEST	443	49841	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:40.179054976 CEST	443	49841	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:40.181061029 CEST	49846	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:40.181071997 CEST	443	49846	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:40.181149006 CEST	49846	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:40.181284904 CEST	49846	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:40.181288958 CEST	443	49846	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:40.215423107 CEST	443	49843	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:40.215825081 CEST	49843	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:40.215842009 CEST	443	49843	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:40.216231108 CEST	49843	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:40.216237068 CEST	443	49843	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:40.225784063 CEST	443	49842	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:40.225923061 CEST	443	49842	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:40.225980043 CEST	49842	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:40.226010084 CEST	49842	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:40.226016998 CEST	443	49842	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:40.226026058 CEST	49842	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:40.226028919 CEST	443	49842	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:40.227874994 CEST	49847	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:40.227905035 CEST	443	49847	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:40.227979898 CEST	49847	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:40.228121996 CEST	49847	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:40.228136063 CEST	443	49847	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:40.342022896 CEST	443	49843	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:40.342235088 CEST	443	49843	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:40.342303038 CEST	49843	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:40.342425108 CEST	49843	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:40.342442989 CEST	443	49843	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:40.342457056 CEST	49843	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:40.342463970 CEST	443	49843	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:40.345108986 CEST	49848	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:40.345144987 CEST	443	49848	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:40.345221996 CEST	49848	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:40.345386028 CEST	49848	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:40.345395088 CEST	443	49848	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:40.388595104 CEST	443	49844	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:40.389007092 CEST	49844	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:40.389039040 CEST	443	49844	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:40.389419079 CEST	49844	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:40.389425993 CEST	443	49844	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:40.521147966 CEST	443	49844	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:40.521392107 CEST	443	49844	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:40.521461010 CEST	49844	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:40.521502972 CEST	49844	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:40.521522045 CEST	443	49844	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:40.521534920 CEST	49844	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:40.521541119 CEST	443	49844	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:40.524354935 CEST	49849	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:40.524399996 CEST	443	49849	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:40.524480104 CEST	49849	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:40.524637938 CEST	49849	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:40.524646044 CEST	443	49849	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:40.650672913 CEST	443	49737	23.1.237.91	192.168.2.5
Oct 17, 2024 11:21:40.650768042 CEST	49737	443	192.168.2.5	23.1.237.91
Oct 17, 2024 11:21:40.887140036 CEST	443	49845	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:40.887711048 CEST	49845	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:40.887759924 CEST	443	49845	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:40.888159037 CEST	49845	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:40.888173103 CEST	443	49845	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:40.941632986 CEST	443	49846	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:40.942070961 CEST	49846	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:40.942094088 CEST	443	49846	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:40.942454100 CEST	49846	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:40.942465067 CEST	443	49846	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:40.966109991 CEST	443	49847	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:40.966559887 CEST	49847	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:40.966573954 CEST	443	49847	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:40.966967106 CEST	49847	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:40.966970921 CEST	443	49847	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.016844034 CEST	443	49845	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.016869068 CEST	443	49845	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.016906023 CEST	443	49845	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.016922951 CEST	49845	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.016963005 CEST	49845	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.017151117 CEST	49845	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.017187119 CEST	443	49845	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.017215967 CEST	49845	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.017230988 CEST	443	49845	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.019916058 CEST	49850	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.019947052 CEST	443	49850	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.020016909 CEST	49850	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.020298958 CEST	49850	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.020312071 CEST	443	49850	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.071528912 CEST	443	49846	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.071609020 CEST	443	49846	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.071666002 CEST	49846	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.071777105 CEST	49846	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.071795940 CEST	443	49846	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.071821928 CEST	49846	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.071834087 CEST	443	49846	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.073987961 CEST	49851	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.073999882 CEST	443	49851	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.074069977 CEST	49851	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.074204922 CEST	49851	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.074210882 CEST	443	49851	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.077759981 CEST	443	49848	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.078078985 CEST	49848	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.078097105 CEST	443	49848	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.078479052 CEST	49848	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.078485012 CEST	443	49848	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.093893051 CEST	443	49847	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.093955040 CEST	443	49847	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.094002008 CEST	49847	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.094011068 CEST	443	49847	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.094086885 CEST	443	49847	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.094140053 CEST	49847	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.094152927 CEST	49847	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.094161034 CEST	443	49847	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.094187975 CEST	49847	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.094192982 CEST	443	49847	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.096023083 CEST	49852	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.096055984 CEST	443	49852	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.096127987 CEST	49852	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.096244097 CEST	49852	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.096257925 CEST	443	49852	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.211415052 CEST	443	49848	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.211581945 CEST	443	49848	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.211647987 CEST	49848	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.211743116 CEST	49848	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.211760044 CEST	443	49848	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.211770058 CEST	49848	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.211775064 CEST	443	49848	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.214301109 CEST	49853	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.214354038 CEST	443	49853	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.214467049 CEST	49853	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.214570045 CEST	49853	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.214580059 CEST	443	49853	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.265974998 CEST	443	49849	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.266365051 CEST	49849	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.266388893 CEST	443	49849	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.266808033 CEST	49849	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.266814947 CEST	443	49849	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.396300077 CEST	443	49849	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.396380901 CEST	443	49849	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.396492958 CEST	49849	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.396517992 CEST	443	49849	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.396539927 CEST	443	49849	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.396591902 CEST	49849	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.396760941 CEST	49849	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.396773100 CEST	443	49849	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.396780968 CEST	49849	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.396785975 CEST	443	49849	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.399599075 CEST	49854	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.399620056 CEST	443	49854	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.399692059 CEST	49854	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.400041103 CEST	49854	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.400053978 CEST	443	49854	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.777437925 CEST	443	49850	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.778120041 CEST	49850	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.778142929 CEST	443	49850	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.778723955 CEST	49850	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.778728962 CEST	443	49850	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.826169968 CEST	443	49851	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.826966047 CEST	49851	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.826973915 CEST	443	49851	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.827677965 CEST	49851	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.827682018 CEST	443	49851	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.832851887 CEST	443	49852	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.833148956 CEST	49852	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.833168983 CEST	443	49852	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.833494902 CEST	49852	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.833502054 CEST	443	49852	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.908950090 CEST	443	49850	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.909115076 CEST	443	49850	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.909164906 CEST	49850	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.909279108 CEST	49850	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.909295082 CEST	443	49850	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.909307957 CEST	49850	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.909313917 CEST	443	49850	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.911792994 CEST	49855	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.911834955 CEST	443	49855	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.911904097 CEST	49855	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.912034035 CEST	49855	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.912046909 CEST	443	49855	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.957451105 CEST	443	49851	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.957528114 CEST	443	49851	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.957581043 CEST	49851	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.957592010 CEST	443	49851	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.957649946 CEST	443	49851	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.957698107 CEST	49851	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.957817078 CEST	49851	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.957822084 CEST	443	49851	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.957848072 CEST	49851	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.957853079 CEST	443	49851	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.960906029 CEST	49856	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.960930109 CEST	443	49856	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.961002111 CEST	49856	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.961165905 CEST	49856	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.961177111 CEST	443	49856	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.962300062 CEST	443	49852	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.962383986 CEST	443	49852	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.962428093 CEST	49852	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.962534904 CEST	49852	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.962554932 CEST	443	49852	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.962565899 CEST	49852	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.962570906 CEST	443	49852	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.964500904 CEST	443	49853	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.965090036 CEST	49857	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.965125084 CEST	443	49857	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.965173006 CEST	49857	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.965625048 CEST	49853	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.965637922 CEST	443	49853	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.966192961 CEST	49857	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.966209888 CEST	443	49857	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:41.966268063 CEST	49853	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:41.966278076 CEST	443	49853	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:42.096807003 CEST	443	49853	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:42.096889973 CEST	443	49853	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:42.096975088 CEST	49853	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:42.096983910 CEST	443	49853	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:42.097026110 CEST	443	49853	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:42.097069025 CEST	49853	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:42.097280979 CEST	49853	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:42.097280979 CEST	49853	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:42.097292900 CEST	443	49853	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:42.097300053 CEST	443	49853	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:42.100275040 CEST	49858	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:42.100292921 CEST	443	49858	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:42.100366116 CEST	49858	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:42.100528002 CEST	49858	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:42.100541115 CEST	443	49858	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:42.134613037 CEST	443	49854	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:42.135412931 CEST	49854	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:42.135423899 CEST	443	49854	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:42.135461092 CEST	49854	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:42.135464907 CEST	443	49854	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:42.271553040 CEST	443	49854	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:42.271717072 CEST	443	49854	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:42.271790028 CEST	49854	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:42.273077965 CEST	49854	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:42.273077965 CEST	49854	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:42.273099899 CEST	443	49854	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:42.273139000 CEST	443	49854	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:42.393937111 CEST	49859	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:42.393974066 CEST	443	49859	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:42.394028902 CEST	49859	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:42.395328045 CEST	49859	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:42.395340919 CEST	443	49859	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:42.646318913 CEST	443	49855	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:42.646748066 CEST	49855	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:42.646766901 CEST	443	49855	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:42.647202015 CEST	49855	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:42.647211075 CEST	443	49855	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:42.698246956 CEST	443	49856	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:42.698776007 CEST	49856	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:42.698796034 CEST	443	49856	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:42.699354887 CEST	49856	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:42.699359894 CEST	443	49856	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:42.709388018 CEST	443	49857	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:42.709796906 CEST	49857	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:42.709829092 CEST	443	49857	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:42.710222960 CEST	49857	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:42.710231066 CEST	443	49857	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:42.779212952 CEST	443	49855	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:42.779334068 CEST	443	49855	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:42.779484034 CEST	49855	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:42.779674053 CEST	49855	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:42.779691935 CEST	443	49855	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:42.779711962 CEST	49855	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:42.779717922 CEST	443	49855	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:42.782438993 CEST	49860	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:42.782464027 CEST	443	49860	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:42.782521963 CEST	49860	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:42.782677889 CEST	49860	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:42.782686949 CEST	443	49860	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:42.831598043 CEST	443	49856	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:42.831690073 CEST	443	49856	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:42.831744909 CEST	49856	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:42.831958055 CEST	49856	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:42.831974983 CEST	443	49856	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:42.831984043 CEST	49856	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:42.831990004 CEST	443	49856	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:42.834716082 CEST	49861	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:42.834752083 CEST	443	49861	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:42.834851980 CEST	49861	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:42.834975004 CEST	49861	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:42.834989071 CEST	443	49861	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:42.840574980 CEST	443	49857	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:42.840632915 CEST	443	49857	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:42.840679884 CEST	443	49857	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:42.840723038 CEST	49857	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:42.840723991 CEST	49857	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:42.840826035 CEST	49857	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:42.840851068 CEST	443	49857	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:42.840864897 CEST	49857	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:42.840874910 CEST	443	49857	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:42.843478918 CEST	49862	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:42.843492031 CEST	443	49862	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:42.843616962 CEST	49862	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:42.843713999 CEST	49862	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:42.843727112 CEST	443	49862	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:42.850001097 CEST	443	49858	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:42.850472927 CEST	49858	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:42.850486040 CEST	443	49858	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:42.850939989 CEST	49858	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:42.850945950 CEST	443	49858	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:42.990044117 CEST	443	49858	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:42.990159988 CEST	443	49858	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:42.990216970 CEST	49858	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:42.990551949 CEST	49858	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:42.990570068 CEST	443	49858	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:42.990592957 CEST	49858	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:42.990608931 CEST	443	49858	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:42.994702101 CEST	49863	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:42.994756937 CEST	443	49863	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:42.994854927 CEST	49863	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:42.994954109 CEST	49863	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:42.994962931 CEST	443	49863	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:43.172275066 CEST	443	49859	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:43.172806978 CEST	49859	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:43.172827959 CEST	443	49859	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:43.173643112 CEST	49859	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:43.173648119 CEST	443	49859	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:43.300143957 CEST	443	49859	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:43.300178051 CEST	443	49859	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:43.300230980 CEST	49859	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:43.300241947 CEST	443	49859	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:43.300353050 CEST	49859	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:43.300571918 CEST	49859	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:43.300592899 CEST	443	49859	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:43.300606966 CEST	49859	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:43.300611973 CEST	443	49859	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:43.303361893 CEST	49864	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:43.303426027 CEST	443	49864	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:43.304160118 CEST	49864	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:43.304709911 CEST	49864	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:43.304725885 CEST	443	49864	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:43.571435928 CEST	443	49862	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:43.572169065 CEST	49862	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:43.572195053 CEST	443	49862	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:43.572743893 CEST	49862	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:43.572752953 CEST	443	49862	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:43.579219103 CEST	443	49861	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:43.580828905 CEST	443	49860	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:43.585107088 CEST	49861	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:43.585135937 CEST	443	49861	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:43.585154057 CEST	49860	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:43.585180044 CEST	443	49860	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:43.585621119 CEST	49861	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:43.585627079 CEST	443	49861	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:43.585728884 CEST	49860	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:43.585735083 CEST	443	49860	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:43.700258970 CEST	443	49862	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:43.700323105 CEST	443	49862	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:43.700589895 CEST	49862	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:43.701231003 CEST	49862	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:43.701231003 CEST	49862	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:43.701253891 CEST	443	49862	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:43.701267004 CEST	443	49862	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:43.704468012 CEST	49865	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:43.704499006 CEST	443	49865	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:43.704601049 CEST	49865	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:43.704749107 CEST	49865	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:43.704761982 CEST	443	49865	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:43.711492062 CEST	443	49861	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:43.711581945 CEST	443	49861	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:43.711751938 CEST	49861	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:43.711783886 CEST	49861	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:43.711783886 CEST	49861	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:43.711812973 CEST	443	49861	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:43.711826086 CEST	443	49861	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:43.713175058 CEST	443	49863	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:43.714253902 CEST	49866	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:43.714270115 CEST	443	49866	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:43.714617968 CEST	49863	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:43.714628935 CEST	443	49863	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:43.714698076 CEST	49866	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:43.714807987 CEST	49866	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:43.714819908 CEST	443	49866	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:43.715075016 CEST	49863	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:43.715080976 CEST	443	49863	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:43.768807888 CEST	443	49860	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:43.768892050 CEST	443	49860	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:43.769097090 CEST	49860	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:43.769177914 CEST	49860	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:43.769196987 CEST	443	49860	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:43.769213915 CEST	49860	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:43.769220114 CEST	443	49860	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:43.772263050 CEST	49867	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:43.772305965 CEST	443	49867	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:43.772387028 CEST	49867	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:43.772552967 CEST	49867	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:43.772571087 CEST	443	49867	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:43.840281963 CEST	443	49863	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:43.840318918 CEST	443	49863	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:43.840358973 CEST	443	49863	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:43.840405941 CEST	49863	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:43.840641022 CEST	49863	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:43.840656996 CEST	443	49863	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:43.840667009 CEST	49863	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:43.840672016 CEST	443	49863	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:43.843334913 CEST	49868	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:43.843362093 CEST	443	49868	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:43.843447924 CEST	49868	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:43.843560934 CEST	49868	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:43.843573093 CEST	443	49868	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:44.030467987 CEST	443	49864	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:44.030994892 CEST	49864	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:44.031043053 CEST	443	49864	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:44.031466007 CEST	49864	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:44.031480074 CEST	443	49864	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:44.158301115 CEST	443	49864	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:44.158498049 CEST	443	49864	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:44.159527063 CEST	49864	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:44.159706116 CEST	49864	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:44.159706116 CEST	49864	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:44.159759998 CEST	443	49864	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:44.159789085 CEST	443	49864	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:44.162241936 CEST	49869	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:44.162312984 CEST	443	49869	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:44.163486004 CEST	49869	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:44.163606882 CEST	49869	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:44.163625956 CEST	443	49869	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:44.425724983 CEST	443	49865	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:44.427913904 CEST	49865	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:44.427933931 CEST	443	49865	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:44.428385973 CEST	49865	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:44.428391933 CEST	443	49865	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:44.457264900 CEST	443	49866	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:44.459867001 CEST	49866	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:44.459875107 CEST	443	49866	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:44.460324049 CEST	49866	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:44.460328102 CEST	443	49866	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:44.529444933 CEST	443	49867	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:44.531924963 CEST	49867	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:44.531984091 CEST	443	49867	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:44.532371998 CEST	49867	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:44.532390118 CEST	443	49867	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:44.553981066 CEST	443	49865	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:44.554035902 CEST	443	49865	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:44.554085970 CEST	443	49865	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:44.554128885 CEST	49865	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:44.554172993 CEST	49865	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:44.554414988 CEST	49865	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:44.554430962 CEST	443	49865	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:44.554440975 CEST	49865	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:44.554446936 CEST	443	49865	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:44.557020903 CEST	49870	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:44.557074070 CEST	443	49870	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:44.557153940 CEST	49870	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:44.557281971 CEST	49870	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:44.557296991 CEST	443	49870	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:44.574353933 CEST	443	49868	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:44.575361967 CEST	49868	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:44.575393915 CEST	443	49868	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:44.575891018 CEST	49868	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:44.575901985 CEST	443	49868	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:44.588406086 CEST	443	49866	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:44.589087009 CEST	443	49866	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:44.589171886 CEST	49866	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:44.589464903 CEST	49866	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:44.589472055 CEST	443	49866	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:44.589481115 CEST	49866	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:44.589484930 CEST	443	49866	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:44.592216969 CEST	49871	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:44.592247963 CEST	443	49871	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:44.592309952 CEST	49871	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:44.592430115 CEST	49871	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:44.592447996 CEST	443	49871	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:44.663681030 CEST	443	49867	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:44.663836956 CEST	443	49867	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:44.664061069 CEST	49867	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:44.664315939 CEST	49867	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:44.664315939 CEST	49867	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:44.664354086 CEST	443	49867	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:44.664377928 CEST	443	49867	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:44.666946888 CEST	49872	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:44.666989088 CEST	443	49872	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:44.667102098 CEST	49872	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:44.667258024 CEST	49872	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:44.667270899 CEST	443	49872	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:44.703012943 CEST	443	49868	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:44.703068018 CEST	443	49868	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:44.703269005 CEST	49868	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:44.703300953 CEST	49868	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:44.703300953 CEST	49868	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:44.703315020 CEST	443	49868	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:44.703324080 CEST	443	49868	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:44.705566883 CEST	49873	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:44.705591917 CEST	443	49873	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:44.705662012 CEST	49873	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:44.705785990 CEST	49873	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:44.705796003 CEST	443	49873	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:44.909046888 CEST	443	49869	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:44.912656069 CEST	49869	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:44.912693024 CEST	443	49869	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:44.913253069 CEST	49869	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:44.913261890 CEST	443	49869	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:45.041299105 CEST	443	49869	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:45.041460037 CEST	443	49869	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:45.041884899 CEST	49869	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:45.041940928 CEST	49869	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:45.041940928 CEST	49869	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:45.041975021 CEST	443	49869	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:45.042083979 CEST	443	49869	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:45.044785023 CEST	49874	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:45.044835091 CEST	443	49874	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:45.045206070 CEST	49874	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:45.045325041 CEST	49874	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:45.045335054 CEST	443	49874	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:45.303949118 CEST	443	49870	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:45.304605007 CEST	49870	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:45.304640055 CEST	443	49870	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:45.305092096 CEST	49870	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:45.305104971 CEST	443	49870	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:45.337435007 CEST	443	49871	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:45.337894917 CEST	49871	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:45.337918997 CEST	443	49871	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:45.338335037 CEST	49871	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:45.338340998 CEST	443	49871	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:45.421562910 CEST	443	49872	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:45.425930977 CEST	49872	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:45.425951958 CEST	443	49872	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:45.426364899 CEST	49872	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:45.426372051 CEST	443	49872	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:45.437957048 CEST	443	49870	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:45.438009024 CEST	443	49870	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:45.438144922 CEST	49870	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:45.438414097 CEST	49870	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:45.438445091 CEST	443	49870	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:45.438471079 CEST	49870	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:45.438486099 CEST	443	49870	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:45.441404104 CEST	49875	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:45.441435099 CEST	443	49875	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:45.445622921 CEST	49875	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:45.445622921 CEST	49875	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:45.445667028 CEST	443	49875	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:45.458000898 CEST	443	49873	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:45.461793900 CEST	49873	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:45.461811066 CEST	443	49873	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:45.462236881 CEST	49873	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:45.462244034 CEST	443	49873	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:45.469029903 CEST	443	49871	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:45.469095945 CEST	443	49871	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:45.469176054 CEST	49871	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:45.469383001 CEST	49871	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:45.469398975 CEST	443	49871	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:45.469410896 CEST	49871	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:45.469415903 CEST	443	49871	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:45.471875906 CEST	49876	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:45.471890926 CEST	443	49876	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:45.471973896 CEST	49876	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:45.472124100 CEST	49876	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:45.472132921 CEST	443	49876	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:45.555289984 CEST	443	49872	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:45.555372000 CEST	443	49872	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:45.555496931 CEST	49872	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:45.555635929 CEST	49872	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:45.555635929 CEST	49872	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:45.555655956 CEST	443	49872	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:45.555670977 CEST	443	49872	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:45.558057070 CEST	49877	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:45.558100939 CEST	443	49877	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:45.558280945 CEST	49877	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:45.558456898 CEST	49877	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:45.558470964 CEST	443	49877	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:45.588581085 CEST	443	49873	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:45.588610888 CEST	443	49873	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:45.588653088 CEST	443	49873	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:45.588685989 CEST	49873	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:45.588706970 CEST	49873	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:45.588874102 CEST	49873	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:45.588895082 CEST	443	49873	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:45.588906050 CEST	49873	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:45.588912010 CEST	443	49873	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:45.591711044 CEST	49878	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:45.591744900 CEST	443	49878	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:45.591813087 CEST	49878	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:45.591954947 CEST	49878	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:45.591969013 CEST	443	49878	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:45.770704985 CEST	443	49874	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:45.771358967 CEST	49874	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:45.771390915 CEST	443	49874	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:45.771797895 CEST	49874	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:45.771804094 CEST	443	49874	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:45.896498919 CEST	443	49874	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:45.896663904 CEST	443	49874	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:45.896718979 CEST	49874	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:45.896910906 CEST	49874	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:45.896929026 CEST	443	49874	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:45.896946907 CEST	49874	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:45.896953106 CEST	443	49874	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:45.899688959 CEST	49879	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:45.899745941 CEST	443	49879	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:45.899972916 CEST	49879	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:45.900103092 CEST	49879	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:45.900113106 CEST	443	49879	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:46.170955896 CEST	443	49875	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:46.171469927 CEST	49875	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:46.171495914 CEST	443	49875	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:46.172121048 CEST	49875	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:46.172128916 CEST	443	49875	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:46.212903023 CEST	443	49876	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:46.213625908 CEST	49876	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:46.213649988 CEST	443	49876	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:46.214083910 CEST	49876	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:46.214090109 CEST	443	49876	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:46.301521063 CEST	443	49875	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:46.301662922 CEST	443	49875	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:46.301855087 CEST	49875	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:46.301939011 CEST	49875	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:46.301939964 CEST	49875	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:46.301965952 CEST	443	49875	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:46.301980019 CEST	443	49875	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:46.304898977 CEST	49880	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:46.304980993 CEST	443	49880	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:46.305175066 CEST	49880	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:46.305263042 CEST	49880	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:46.305277109 CEST	443	49880	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:46.307893991 CEST	443	49877	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:46.308271885 CEST	49877	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:46.308300972 CEST	443	49877	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:46.308697939 CEST	49877	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:46.308702946 CEST	443	49877	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:46.339526892 CEST	443	49878	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:46.340034008 CEST	49878	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:46.340085030 CEST	443	49878	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:46.340620041 CEST	49878	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:46.340632915 CEST	443	49878	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:46.345200062 CEST	443	49876	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:46.345274925 CEST	443	49876	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:46.345366001 CEST	49876	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:46.350660086 CEST	49876	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:46.350673914 CEST	443	49876	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:46.350706100 CEST	49876	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:46.350713015 CEST	443	49876	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:46.353764057 CEST	49881	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:46.353797913 CEST	443	49881	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:46.353880882 CEST	49881	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:46.354003906 CEST	49881	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:46.354020119 CEST	443	49881	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:46.440771103 CEST	443	49877	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:46.440797091 CEST	443	49877	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:46.440850019 CEST	49877	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:46.440865993 CEST	443	49877	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:46.440910101 CEST	49877	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:46.441112041 CEST	49877	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:46.441132069 CEST	443	49877	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:46.441143990 CEST	49877	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:46.441148996 CEST	443	49877	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:46.443950891 CEST	49882	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:46.444000006 CEST	443	49882	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:46.444094896 CEST	49882	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:46.444250107 CEST	49882	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:46.444261074 CEST	443	49882	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:46.471107006 CEST	443	49878	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:46.471137047 CEST	443	49878	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:46.471184969 CEST	443	49878	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:46.471277952 CEST	49878	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:46.471400023 CEST	49878	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:46.471766949 CEST	49878	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:46.471786022 CEST	443	49878	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:46.471796989 CEST	49878	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:46.471801996 CEST	443	49878	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:46.474436998 CEST	49883	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:46.474493027 CEST	443	49883	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:46.474611044 CEST	49883	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:46.474777937 CEST	49883	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:46.474808931 CEST	443	49883	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:46.654315948 CEST	443	49879	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:46.654911041 CEST	49879	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:46.654944897 CEST	443	49879	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:46.655381918 CEST	49879	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:46.655396938 CEST	443	49879	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:46.785200119 CEST	443	49879	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:46.785279036 CEST	443	49879	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:46.785340071 CEST	49879	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:46.785375118 CEST	443	49879	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:46.785399914 CEST	443	49879	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:46.785548925 CEST	49879	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:46.785548925 CEST	49879	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:46.785550117 CEST	49879	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:46.788002968 CEST	49884	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:46.788043976 CEST	443	49884	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:46.788116932 CEST	49884	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:46.788248062 CEST	49884	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:46.788259029 CEST	443	49884	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:46.996587038 CEST	49879	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:46.996615887 CEST	443	49879	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:47.051261902 CEST	443	49880	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:47.051855087 CEST	49880	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:47.051911116 CEST	443	49880	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:47.052196980 CEST	49880	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:47.052215099 CEST	443	49880	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:47.099529028 CEST	443	49881	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:47.099973917 CEST	49881	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:47.100003004 CEST	443	49881	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:47.100410938 CEST	49881	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:47.100416899 CEST	443	49881	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:47.166994095 CEST	443	49882	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:47.167599916 CEST	49882	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:47.167629957 CEST	443	49882	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:47.168061972 CEST	49882	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:47.168070078 CEST	443	49882	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:47.183378935 CEST	443	49880	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:47.183450937 CEST	443	49880	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:47.183514118 CEST	49880	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:47.183696985 CEST	49880	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:47.183697939 CEST	49880	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:47.183729887 CEST	443	49880	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:47.183753967 CEST	443	49880	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:47.186131001 CEST	49885	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:47.186204910 CEST	443	49885	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:47.186299086 CEST	49885	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:47.186428070 CEST	49885	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:47.186463118 CEST	443	49885	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:47.211477041 CEST	443	49883	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:47.211939096 CEST	49883	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:47.211958885 CEST	443	49883	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:47.212300062 CEST	49883	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:47.212311983 CEST	443	49883	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:47.230948925 CEST	443	49881	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:47.230978966 CEST	443	49881	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:47.231023073 CEST	443	49881	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:47.231065989 CEST	49881	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:47.231102943 CEST	49881	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:47.231195927 CEST	49881	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:47.231220961 CEST	443	49881	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:47.231236935 CEST	49881	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:47.231245041 CEST	443	49881	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:47.233629942 CEST	49886	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:47.233661890 CEST	443	49886	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:47.233745098 CEST	49886	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:47.233872890 CEST	49886	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:47.233908892 CEST	443	49886	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:47.294502020 CEST	443	49882	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:47.294576883 CEST	443	49882	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:47.294630051 CEST	49882	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:47.294765949 CEST	49882	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:47.294787884 CEST	443	49882	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:47.294802904 CEST	49882	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:47.294810057 CEST	443	49882	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:47.297327995 CEST	49887	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:47.297363043 CEST	443	49887	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:47.297431946 CEST	49887	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:47.297595978 CEST	49887	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:47.297607899 CEST	443	49887	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:47.348440886 CEST	443	49883	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:47.348463058 CEST	443	49883	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:47.348516941 CEST	443	49883	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:47.348582029 CEST	49883	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:47.348582029 CEST	49883	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:47.348716021 CEST	49883	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:47.348764896 CEST	443	49883	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:47.348795891 CEST	49883	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:47.348813057 CEST	443	49883	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:47.351402044 CEST	49888	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:47.351448059 CEST	443	49888	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:47.351519108 CEST	49888	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:47.351634026 CEST	49888	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:47.351649046 CEST	443	49888	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:47.523235083 CEST	443	49884	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:47.524033070 CEST	49884	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:47.524051905 CEST	443	49884	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:47.524471045 CEST	49884	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:47.524475098 CEST	443	49884	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:47.654012918 CEST	443	49884	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:47.654270887 CEST	443	49884	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:47.654339075 CEST	49884	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:47.654405117 CEST	443	49884	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:47.654432058 CEST	49884	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:47.654432058 CEST	49884	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:47.654455900 CEST	443	49884	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:47.654467106 CEST	49884	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:47.654473066 CEST	443	49884	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:47.657069921 CEST	49889	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:47.657175064 CEST	443	49889	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:47.657376051 CEST	49889	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:47.657572985 CEST	49889	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:47.657634020 CEST	443	49889	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:47.931901932 CEST	443	49885	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:47.932383060 CEST	49885	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:47.932447910 CEST	443	49885	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:47.932919979 CEST	49885	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:47.932935953 CEST	443	49885	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:47.962882042 CEST	443	49886	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:47.963196993 CEST	49886	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:47.963217020 CEST	443	49886	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:47.963541031 CEST	49886	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:47.963552952 CEST	443	49886	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.030108929 CEST	443	49887	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.030551910 CEST	49887	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:48.030563116 CEST	443	49887	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.030971050 CEST	49887	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:48.030976057 CEST	443	49887	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.062758923 CEST	443	49885	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.062784910 CEST	443	49885	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.062829018 CEST	443	49885	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.062874079 CEST	49885	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:48.062913895 CEST	49885	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:48.063134909 CEST	49885	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:48.063174009 CEST	443	49885	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.063204050 CEST	49885	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:48.063220024 CEST	443	49885	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.065896034 CEST	49890	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:48.065968037 CEST	443	49890	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.066054106 CEST	49890	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:48.066216946 CEST	49890	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:48.066250086 CEST	443	49890	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.079710007 CEST	443	49888	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.080058098 CEST	49888	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:48.080070019 CEST	443	49888	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.080462933 CEST	49888	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:48.080467939 CEST	443	49888	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.092097998 CEST	443	49886	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.092428923 CEST	443	49886	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.092498064 CEST	49886	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:48.092541933 CEST	49886	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:48.092541933 CEST	49886	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:48.092567921 CEST	443	49886	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.092590094 CEST	443	49886	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.094499111 CEST	49891	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:48.094522953 CEST	443	49891	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.094579935 CEST	49891	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:48.094676971 CEST	49891	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:48.094686985 CEST	443	49891	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.159796953 CEST	443	49887	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.159883022 CEST	443	49887	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.159992933 CEST	49887	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:48.160170078 CEST	49887	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:48.160181999 CEST	443	49887	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.160192966 CEST	49887	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:48.160196066 CEST	443	49887	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.162417889 CEST	49892	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:48.162471056 CEST	443	49892	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.162545919 CEST	49892	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:48.162697077 CEST	49892	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:48.162724972 CEST	443	49892	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.199846029 CEST	49704	80	192.168.2.5	192.229.211.108
Oct 17, 2024 11:21:48.199939013 CEST	49705	80	192.168.2.5	2.23.198.32
Oct 17, 2024 11:21:48.209286928 CEST	80	49704	192.229.211.108	192.168.2.5
Oct 17, 2024 11:21:48.209398031 CEST	49704	80	192.168.2.5	192.229.211.108
Oct 17, 2024 11:21:48.209407091 CEST	80	49705	2.23.198.32	192.168.2.5
Oct 17, 2024 11:21:48.209459066 CEST	49705	80	192.168.2.5	2.23.198.32
Oct 17, 2024 11:21:48.210845947 CEST	443	49888	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.210915089 CEST	443	49888	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.210958958 CEST	49888	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:48.211139917 CEST	49888	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:48.211155891 CEST	443	49888	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.211167097 CEST	49888	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:48.211172104 CEST	443	49888	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.214238882 CEST	49893	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:48.214292049 CEST	443	49893	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.214381933 CEST	49893	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:48.214540958 CEST	49893	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:48.214560032 CEST	443	49893	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.397994995 CEST	443	49889	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.398494959 CEST	49889	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:48.398535013 CEST	443	49889	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.398958921 CEST	49889	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:48.398976088 CEST	443	49889	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.528312922 CEST	443	49889	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.528397083 CEST	443	49889	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.528506994 CEST	49889	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:48.528548956 CEST	443	49889	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.528563023 CEST	443	49889	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.528644085 CEST	49889	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:48.528757095 CEST	49889	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:48.528789997 CEST	443	49889	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.528815985 CEST	49889	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:48.528831005 CEST	443	49889	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.531683922 CEST	49894	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:48.531730890 CEST	443	49894	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.531816959 CEST	49894	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:48.531984091 CEST	49894	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:48.532005072 CEST	443	49894	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.824186087 CEST	443	49890	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.824729919 CEST	49890	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:48.824768066 CEST	443	49890	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.824863911 CEST	443	49891	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.825277090 CEST	49891	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:48.825288057 CEST	443	49891	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.825371027 CEST	49890	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:48.825386047 CEST	443	49890	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.825752974 CEST	49891	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:48.825758934 CEST	443	49891	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.885910034 CEST	443	49892	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.886380911 CEST	49892	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:48.886408091 CEST	443	49892	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.886857033 CEST	49892	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:48.886863947 CEST	443	49892	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.953547001 CEST	443	49891	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.953639030 CEST	443	49891	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.953680038 CEST	443	49891	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.953691959 CEST	49891	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:48.953727961 CEST	49891	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:48.953867912 CEST	49891	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:48.953881025 CEST	443	49891	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.953891993 CEST	49891	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:48.953896999 CEST	443	49891	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.955255032 CEST	443	49893	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.955665112 CEST	49893	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:48.955663919 CEST	443	49890	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.955677032 CEST	443	49893	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.955806971 CEST	443	49890	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.955868959 CEST	49890	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:48.956083059 CEST	49893	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:48.956087112 CEST	443	49893	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.956218004 CEST	49890	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:48.956254959 CEST	443	49890	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.956283092 CEST	49890	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:48.956301928 CEST	443	49890	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.956660986 CEST	49895	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:48.956717014 CEST	443	49895	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.956800938 CEST	49895	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:48.956897020 CEST	49895	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:48.956917048 CEST	443	49895	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.958192110 CEST	49896	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:48.958221912 CEST	443	49896	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:48.958293915 CEST	49896	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:48.958386898 CEST	49896	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:48.958395958 CEST	443	49896	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:49.013803959 CEST	443	49892	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:49.013895035 CEST	443	49892	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:49.013955116 CEST	49892	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:49.014080048 CEST	49892	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:49.014101982 CEST	443	49892	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:49.014132023 CEST	49892	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:49.014147997 CEST	443	49892	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:49.016834021 CEST	49897	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:49.016877890 CEST	443	49897	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:49.016938925 CEST	49897	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:49.017267942 CEST	49897	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:49.017283916 CEST	443	49897	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:49.317914009 CEST	443	49893	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:49.317943096 CEST	443	49893	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:49.318008900 CEST	443	49893	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:49.318067074 CEST	49893	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:49.318094015 CEST	49893	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:49.318269014 CEST	49893	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:49.318284988 CEST	443	49893	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:49.318296909 CEST	49893	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:49.318301916 CEST	443	49893	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:49.320974112 CEST	49898	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:49.321031094 CEST	443	49898	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:49.321105957 CEST	49898	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:49.321239948 CEST	49898	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:49.321258068 CEST	443	49898	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:49.459177017 CEST	443	49894	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:49.459678888 CEST	49894	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:49.459691048 CEST	443	49894	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:49.460151911 CEST	49894	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:49.460156918 CEST	443	49894	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:49.590080976 CEST	443	49894	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:49.590159893 CEST	443	49894	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:49.590210915 CEST	49894	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:49.590519905 CEST	49894	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:49.590533972 CEST	443	49894	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:49.590543985 CEST	49894	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:49.590549946 CEST	443	49894	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:49.593200922 CEST	49899	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:49.593229055 CEST	443	49899	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:49.593298912 CEST	49899	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:49.593467951 CEST	49899	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:49.593482018 CEST	443	49899	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:49.710335970 CEST	443	49895	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:49.710845947 CEST	49895	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:49.710881948 CEST	443	49895	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:49.711325884 CEST	49895	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:49.711339951 CEST	443	49895	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:49.714355946 CEST	443	49896	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:49.714665890 CEST	49896	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:49.714684963 CEST	443	49896	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:49.714956045 CEST	49896	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:49.714961052 CEST	443	49896	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:49.759219885 CEST	443	49897	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:49.759659052 CEST	49897	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:49.759682894 CEST	443	49897	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:49.760086060 CEST	49897	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:49.760092020 CEST	443	49897	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:49.843828917 CEST	443	49895	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:49.843897104 CEST	443	49895	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:49.843949080 CEST	49895	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:49.844228029 CEST	49895	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:49.844255924 CEST	443	49895	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:49.844280958 CEST	49895	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:49.844295979 CEST	443	49895	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:49.845341921 CEST	443	49896	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:49.845499992 CEST	443	49896	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:49.845566034 CEST	49896	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:49.845604897 CEST	49896	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:49.845623016 CEST	443	49896	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:49.845633984 CEST	49896	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:49.845639944 CEST	443	49896	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:49.847650051 CEST	49900	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:49.847695112 CEST	443	49900	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:49.847794056 CEST	49900	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:49.847917080 CEST	49900	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:49.847937107 CEST	443	49900	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:49.848593950 CEST	49901	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:49.848623037 CEST	443	49901	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:49.848685980 CEST	49901	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:49.848843098 CEST	49901	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:49.848855972 CEST	443	49901	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:49.891801119 CEST	443	49897	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:49.891875029 CEST	443	49897	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:49.891932011 CEST	49897	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:49.892050982 CEST	49897	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:49.892067909 CEST	443	49897	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:49.892079115 CEST	49897	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:49.892083883 CEST	443	49897	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:49.894315958 CEST	49902	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:49.894330978 CEST	443	49902	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:49.894406080 CEST	49902	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:49.894541025 CEST	49902	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:49.894550085 CEST	443	49902	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:50.065362930 CEST	443	49898	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:50.065807104 CEST	49898	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:50.065829039 CEST	443	49898	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:50.066267967 CEST	49898	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:50.066273928 CEST	443	49898	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:50.343508959 CEST	443	49898	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:50.343559980 CEST	443	49898	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:50.343617916 CEST	49898	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:50.343827963 CEST	49898	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:50.343846083 CEST	443	49898	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:50.343857050 CEST	49898	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:50.343862057 CEST	443	49898	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:50.344458103 CEST	443	49899	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:50.344862938 CEST	49899	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:50.344880104 CEST	443	49899	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:50.345357895 CEST	49899	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:50.345366955 CEST	443	49899	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:50.346626997 CEST	49903	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:50.346651077 CEST	443	49903	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:50.346859932 CEST	49903	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:50.346859932 CEST	49903	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:50.346888065 CEST	443	49903	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:50.480768919 CEST	443	49899	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:50.480809927 CEST	443	49899	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:50.480865955 CEST	443	49899	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:50.480880976 CEST	49899	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:50.480936050 CEST	49899	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:50.481528997 CEST	49899	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:50.481537104 CEST	443	49899	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:50.481547117 CEST	49899	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:50.481551886 CEST	443	49899	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:50.484364033 CEST	49904	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:50.484381914 CEST	443	49904	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:50.484476089 CEST	49904	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:50.484648943 CEST	49904	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:50.484664917 CEST	443	49904	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:50.588458061 CEST	443	49901	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:50.588938951 CEST	49901	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:50.588965893 CEST	443	49901	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:50.589459896 CEST	49901	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:50.589466095 CEST	443	49901	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:50.636063099 CEST	443	49902	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:50.636661053 CEST	49902	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:50.636673927 CEST	443	49902	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:50.637012959 CEST	49902	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:50.637017012 CEST	443	49902	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:50.646608114 CEST	443	49900	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:50.647089005 CEST	49900	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:50.647099972 CEST	443	49900	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:50.647526026 CEST	49900	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:50.647531033 CEST	443	49900	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:50.717997074 CEST	443	49901	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:50.718061924 CEST	443	49901	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:50.718115091 CEST	49901	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:50.718130112 CEST	443	49901	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:50.718163013 CEST	443	49901	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:50.718214035 CEST	49901	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:50.718369961 CEST	49901	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:50.718389034 CEST	443	49901	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:50.718400002 CEST	49901	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:50.718405008 CEST	443	49901	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:50.721712112 CEST	49905	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:50.721755028 CEST	443	49905	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:50.721818924 CEST	49905	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:50.721941948 CEST	49905	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:50.721956015 CEST	443	49905	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:50.766647100 CEST	443	49902	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:50.766880989 CEST	443	49902	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:50.766948938 CEST	49902	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:50.767039061 CEST	49902	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:50.767054081 CEST	443	49902	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:50.767064095 CEST	49902	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:50.767069101 CEST	443	49902	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:50.769526958 CEST	49906	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:50.769556999 CEST	443	49906	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:50.769781113 CEST	49906	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:50.771636963 CEST	49906	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:50.771651983 CEST	443	49906	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:50.779006004 CEST	443	49900	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:50.779069901 CEST	443	49900	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:50.779174089 CEST	49900	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:50.779196978 CEST	49900	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:50.779210091 CEST	443	49900	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:50.779222965 CEST	49900	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:50.779228926 CEST	443	49900	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:50.781400919 CEST	49907	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:50.781419992 CEST	443	49907	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:50.781486034 CEST	49907	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:50.781760931 CEST	49907	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:50.781774044 CEST	443	49907	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:51.089361906 CEST	443	49903	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:51.118727922 CEST	49903	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:51.118741035 CEST	443	49903	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:51.119074106 CEST	49903	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:51.119076967 CEST	443	49903	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:51.221055984 CEST	443	49904	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:51.226464033 CEST	49904	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:51.226485968 CEST	443	49904	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:51.230256081 CEST	49904	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:51.230263948 CEST	443	49904	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:51.247437000 CEST	443	49903	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:51.247534037 CEST	443	49903	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:51.247632027 CEST	49903	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:51.247658014 CEST	443	49903	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:51.247682095 CEST	443	49903	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:51.247838020 CEST	49903	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:51.285702944 CEST	49903	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:51.285702944 CEST	49903	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:51.285715103 CEST	443	49903	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:51.285723925 CEST	443	49903	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:51.289001942 CEST	49908	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:51.289092064 CEST	443	49908	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:51.289186001 CEST	49908	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:51.289321899 CEST	49908	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:51.289355040 CEST	443	49908	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:51.356410980 CEST	443	49904	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:51.356599092 CEST	443	49904	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:51.356668949 CEST	49904	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:51.357667923 CEST	49904	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:51.357686996 CEST	443	49904	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:51.357700109 CEST	49904	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:51.357707024 CEST	443	49904	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:51.361541033 CEST	49909	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:51.361577034 CEST	443	49909	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:51.361643076 CEST	49909	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:51.362052917 CEST	49909	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:51.362066984 CEST	443	49909	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:51.473563910 CEST	443	49905	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:51.474096060 CEST	49905	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:51.474175930 CEST	443	49905	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:51.474577904 CEST	49905	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:51.474591970 CEST	443	49905	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:51.508141041 CEST	443	49907	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:51.508709908 CEST	49907	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:51.508733034 CEST	443	49907	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:51.509146929 CEST	49907	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:51.509154081 CEST	443	49907	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:51.513206959 CEST	443	49906	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:51.513570070 CEST	49906	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:51.513636112 CEST	443	49906	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:51.513986111 CEST	49906	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:51.514000893 CEST	443	49906	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:51.603935957 CEST	443	49905	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:51.604007006 CEST	443	49905	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:51.604079962 CEST	49905	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:51.604123116 CEST	443	49905	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:51.604156017 CEST	443	49905	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:51.604221106 CEST	49905	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:51.604370117 CEST	49905	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:51.604407072 CEST	443	49905	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:51.604459047 CEST	49905	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:51.604475021 CEST	443	49905	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:51.607321024 CEST	49910	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:51.607355118 CEST	443	49910	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:51.607433081 CEST	49910	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:51.607594967 CEST	49910	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:51.607609987 CEST	443	49910	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:51.636650085 CEST	443	49907	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:51.636677027 CEST	443	49907	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:51.636745930 CEST	443	49907	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:51.636904955 CEST	49907	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:51.637248993 CEST	49907	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:51.637264967 CEST	443	49907	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:51.637279987 CEST	49907	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:51.637288094 CEST	443	49907	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:51.640382051 CEST	49911	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:51.640444040 CEST	443	49911	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:51.640561104 CEST	49911	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:51.640731096 CEST	49911	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:51.640759945 CEST	443	49911	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:51.645052910 CEST	443	49906	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:51.645267963 CEST	443	49906	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:51.645343065 CEST	49906	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:51.645426035 CEST	49906	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:51.645426035 CEST	49906	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:51.645472050 CEST	443	49906	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:51.645503044 CEST	443	49906	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:51.647918940 CEST	49912	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:51.647944927 CEST	443	49912	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:51.648025036 CEST	49912	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:51.648161888 CEST	49912	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:51.648174047 CEST	443	49912	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:52.034934044 CEST	443	49908	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:52.035844088 CEST	49908	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:52.035877943 CEST	443	49908	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:52.036370993 CEST	49908	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:52.036384106 CEST	443	49908	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:52.105247021 CEST	443	49909	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:52.106062889 CEST	49909	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:52.106080055 CEST	443	49909	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:52.106414080 CEST	49909	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:52.106417894 CEST	443	49909	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:52.165445089 CEST	443	49908	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:52.165515900 CEST	443	49908	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:52.165714025 CEST	443	49908	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:52.165709972 CEST	49908	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:52.165771008 CEST	49908	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:52.165905952 CEST	49908	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:52.165905952 CEST	49908	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:52.165942907 CEST	443	49908	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:52.165971994 CEST	443	49908	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:52.168730021 CEST	49913	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:52.168751955 CEST	443	49913	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:52.168844938 CEST	49913	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:52.169038057 CEST	49913	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:52.169050932 CEST	443	49913	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:52.234770060 CEST	443	49909	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:52.234843016 CEST	443	49909	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:52.234946966 CEST	443	49909	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:52.234993935 CEST	49909	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:52.235112906 CEST	49909	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:52.235112906 CEST	49909	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:52.235131979 CEST	49909	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:52.235147953 CEST	443	49909	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:52.237936974 CEST	49914	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:52.237950087 CEST	443	49914	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:52.238200903 CEST	49914	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:52.238200903 CEST	49914	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:52.238219023 CEST	443	49914	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:52.364749908 CEST	443	49910	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:52.365571976 CEST	49910	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:52.365597963 CEST	443	49910	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:52.366050959 CEST	49910	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:52.366055965 CEST	443	49910	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:52.381186008 CEST	443	49911	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:52.381620884 CEST	49911	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:52.381655931 CEST	443	49911	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:52.381885052 CEST	49911	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:52.381897926 CEST	443	49911	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:52.404335976 CEST	443	49912	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:52.404994965 CEST	49912	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:52.405009031 CEST	443	49912	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:52.405328035 CEST	49912	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:52.405332088 CEST	443	49912	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:52.502897024 CEST	443	49910	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:52.503057003 CEST	443	49910	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:52.503115892 CEST	49910	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:52.503179073 CEST	49910	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:52.503200054 CEST	443	49910	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:52.503211021 CEST	49910	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:52.503216028 CEST	443	49910	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:52.505647898 CEST	49915	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:52.505688906 CEST	443	49915	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:52.505774021 CEST	49915	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:52.505903006 CEST	49915	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:52.505917072 CEST	443	49915	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:52.511152029 CEST	443	49911	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:52.511194944 CEST	443	49911	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:52.511245012 CEST	443	49911	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:52.511244059 CEST	49911	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:52.511292934 CEST	49911	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:52.511377096 CEST	49911	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:52.511432886 CEST	443	49911	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:52.511471987 CEST	49911	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:52.511490107 CEST	443	49911	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:52.519948006 CEST	49916	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:52.519985914 CEST	443	49916	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:52.520072937 CEST	49916	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:52.520239115 CEST	49916	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:52.520251989 CEST	443	49916	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:52.535803080 CEST	443	49912	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:52.535916090 CEST	443	49912	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:52.535980940 CEST	49912	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:52.539587975 CEST	49912	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:52.539608002 CEST	443	49912	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:52.539617062 CEST	49912	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:52.539623976 CEST	443	49912	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:52.542057991 CEST	49917	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:52.542074919 CEST	443	49917	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:52.542140961 CEST	49917	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:52.542304039 CEST	49917	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:52.542316914 CEST	443	49917	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:52.927340031 CEST	443	49913	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:52.927911043 CEST	49913	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:52.927933931 CEST	443	49913	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:52.928325891 CEST	49913	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:52.928339005 CEST	443	49913	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:53.008948088 CEST	443	49914	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:53.009511948 CEST	49914	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:53.009525061 CEST	443	49914	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:53.010121107 CEST	49914	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:53.010126114 CEST	443	49914	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:53.064810038 CEST	443	49913	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:53.064882994 CEST	443	49913	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:53.064990044 CEST	49913	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:53.065011978 CEST	443	49913	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:53.065042019 CEST	443	49913	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:53.065113068 CEST	49913	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:53.065309048 CEST	49913	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:53.065323114 CEST	443	49913	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:53.065330982 CEST	49913	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:53.065335989 CEST	443	49913	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:53.068345070 CEST	49918	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:53.068377018 CEST	443	49918	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:53.068447113 CEST	49918	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:53.068650007 CEST	49918	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:53.068662882 CEST	443	49918	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:53.156363964 CEST	443	49914	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:53.156517029 CEST	443	49914	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:53.156591892 CEST	49914	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:53.156734943 CEST	49914	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:53.156734943 CEST	49914	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:53.156744003 CEST	443	49914	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:53.156752110 CEST	443	49914	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:53.159358025 CEST	49919	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:53.159408092 CEST	443	49919	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:53.159476042 CEST	49919	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:53.159605026 CEST	49919	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:53.159617901 CEST	443	49919	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:53.288476944 CEST	443	49915	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:53.289232969 CEST	49915	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:53.289248943 CEST	443	49915	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:53.289625883 CEST	49915	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:53.289630890 CEST	443	49915	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:53.290126085 CEST	443	49916	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:53.290371895 CEST	49916	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:53.290395021 CEST	443	49916	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:53.290713072 CEST	49916	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:53.290719032 CEST	443	49916	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:53.307985067 CEST	443	49917	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:53.308638096 CEST	49917	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:53.308656931 CEST	443	49917	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:53.309182882 CEST	49917	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:53.309189081 CEST	443	49917	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:53.435457945 CEST	443	49915	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:53.435928106 CEST	443	49915	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:53.435981035 CEST	443	49915	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:53.435998917 CEST	49915	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:53.436043024 CEST	49915	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:53.436088085 CEST	49915	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:53.436110020 CEST	443	49915	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:53.436120987 CEST	49915	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:53.436126947 CEST	443	49915	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:53.436470985 CEST	443	49916	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:53.436577082 CEST	443	49916	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:53.436620951 CEST	49916	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:53.436674118 CEST	49916	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:53.436691046 CEST	443	49916	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:53.436706066 CEST	49916	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:53.436712027 CEST	443	49916	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:53.439080000 CEST	49920	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:53.439105034 CEST	443	49920	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:53.439146996 CEST	49921	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:53.439172029 CEST	443	49921	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:53.439192057 CEST	49920	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:53.439233065 CEST	49921	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:53.439368010 CEST	49920	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:53.439387083 CEST	443	49920	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:53.439388037 CEST	49921	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:53.439399004 CEST	443	49921	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:53.459321976 CEST	443	49917	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:53.459371090 CEST	443	49917	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:53.459414005 CEST	49917	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:53.459428072 CEST	443	49917	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:53.459451914 CEST	443	49917	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:53.459492922 CEST	49917	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:53.459549904 CEST	49917	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:53.459562063 CEST	443	49917	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:53.459572077 CEST	49917	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:53.459577084 CEST	443	49917	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:53.462002993 CEST	49922	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:53.462018967 CEST	443	49922	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:53.462075949 CEST	49922	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:53.462239981 CEST	49922	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:53.462249041 CEST	443	49922	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:53.866357088 CEST	443	49918	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:53.920202017 CEST	49918	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:53.964860916 CEST	443	49919	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:54.012167931 CEST	49919	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:54.013904095 CEST	49918	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:54.013923883 CEST	443	49918	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:54.014355898 CEST	49918	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:54.014362097 CEST	443	49918	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:54.015280962 CEST	49919	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:54.015296936 CEST	443	49919	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:54.015721083 CEST	49919	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:54.015728951 CEST	443	49919	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:54.145911932 CEST	443	49918	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:54.146267891 CEST	443	49918	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:54.146322012 CEST	49918	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:54.147994041 CEST	443	49919	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:54.148401022 CEST	443	49919	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:54.148453951 CEST	49919	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:54.148907900 CEST	49918	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:54.148921967 CEST	443	49918	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:54.148931026 CEST	49918	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:54.148936033 CEST	443	49918	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:54.150348902 CEST	49919	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:54.150371075 CEST	443	49919	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:54.150383949 CEST	49919	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:54.150389910 CEST	443	49919	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:54.153626919 CEST	49923	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:54.153662920 CEST	443	49923	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:54.153734922 CEST	49923	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:54.156912088 CEST	49924	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:54.156929016 CEST	443	49924	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:54.157058954 CEST	49924	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:54.157542944 CEST	49923	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:54.157572985 CEST	443	49923	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:54.157897949 CEST	49924	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:54.157908916 CEST	443	49924	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:54.218657017 CEST	443	49920	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:54.219147921 CEST	49920	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:54.219160080 CEST	443	49920	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:54.219629049 CEST	49920	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:54.219635010 CEST	443	49920	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:54.226936102 CEST	443	49921	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:54.227196932 CEST	49921	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:54.227210999 CEST	443	49921	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:54.227510929 CEST	49921	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:54.227515936 CEST	443	49921	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:54.242919922 CEST	443	49922	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:54.243171930 CEST	49922	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:54.243177891 CEST	443	49922	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:54.243499994 CEST	49922	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:54.243504047 CEST	443	49922	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:54.353904009 CEST	443	49920	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:54.353967905 CEST	443	49920	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:54.354139090 CEST	49920	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:54.354406118 CEST	49920	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:54.354406118 CEST	49920	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:54.354427099 CEST	443	49920	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:54.354437113 CEST	443	49920	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:54.357428074 CEST	49925	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:54.357450962 CEST	443	49925	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:54.357521057 CEST	49925	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:54.357649088 CEST	49925	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:54.357660055 CEST	443	49925	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:54.382464886 CEST	443	49922	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:54.382621050 CEST	443	49922	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:54.382726908 CEST	49922	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:54.382878065 CEST	49922	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:54.382895947 CEST	443	49922	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:54.382905960 CEST	49922	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:54.382911921 CEST	443	49922	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:54.385705948 CEST	49926	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:54.385727882 CEST	443	49926	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:54.385807037 CEST	49926	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:54.385958910 CEST	49926	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:54.385970116 CEST	443	49926	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:54.574857950 CEST	443	49921	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:54.574894905 CEST	443	49921	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:54.574960947 CEST	443	49921	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:54.574969053 CEST	49921	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:54.575017929 CEST	49921	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:54.575273037 CEST	49921	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:54.575293064 CEST	443	49921	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:54.575303078 CEST	49921	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:54.575308084 CEST	443	49921	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:54.578206062 CEST	49927	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:54.578244925 CEST	443	49927	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:54.578340054 CEST	49927	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:54.578496933 CEST	49927	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:54.578511000 CEST	443	49927	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:54.900824070 CEST	443	49923	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:54.901485920 CEST	49923	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:54.901506901 CEST	443	49923	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:54.901874065 CEST	49923	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:54.901880026 CEST	443	49923	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:54.921566010 CEST	443	49924	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:54.922019958 CEST	49924	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:54.922058105 CEST	443	49924	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:54.922744989 CEST	49924	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:54.922751904 CEST	443	49924	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:55.032372952 CEST	443	49923	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:55.032433033 CEST	443	49923	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:55.032505035 CEST	49923	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:55.032516003 CEST	443	49923	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:55.032537937 CEST	443	49923	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:55.032593012 CEST	49923	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:55.032813072 CEST	49923	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:55.032824993 CEST	443	49923	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:55.032835007 CEST	49923	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:55.032840967 CEST	443	49923	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:55.035682917 CEST	49928	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:55.035756111 CEST	443	49928	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:55.035852909 CEST	49928	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:55.035979986 CEST	49928	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:55.036027908 CEST	443	49928	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:55.056921005 CEST	443	49924	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:55.057071924 CEST	443	49924	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:55.057143927 CEST	49924	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:55.057271004 CEST	49924	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:55.057291985 CEST	443	49924	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:55.057315111 CEST	49924	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:55.057322979 CEST	443	49924	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:55.060090065 CEST	49929	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:55.060146093 CEST	443	49929	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:55.060247898 CEST	49929	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:55.060369968 CEST	49929	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:55.060389042 CEST	443	49929	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:55.114336014 CEST	443	49925	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:55.114892960 CEST	49925	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:55.114907980 CEST	443	49925	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:55.115505934 CEST	49925	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:55.115511894 CEST	443	49925	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:55.129530907 CEST	443	49926	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:55.130021095 CEST	49926	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:55.130028009 CEST	443	49926	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:55.130316973 CEST	49926	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:55.130322933 CEST	443	49926	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:55.244925976 CEST	443	49925	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:55.244954109 CEST	443	49925	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:55.244995117 CEST	443	49925	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:55.245122910 CEST	49925	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:55.245122910 CEST	49925	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:55.245317936 CEST	49925	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:55.245333910 CEST	443	49925	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:55.245345116 CEST	49925	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:55.245351076 CEST	443	49925	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:55.248261929 CEST	49930	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:55.248297930 CEST	443	49930	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:55.248383045 CEST	49930	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:55.248522043 CEST	49930	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:55.248538971 CEST	443	49930	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:55.256738901 CEST	443	49926	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:55.256900072 CEST	443	49926	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:55.256959915 CEST	49926	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:55.257086039 CEST	49926	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:55.257091045 CEST	443	49926	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:55.257112980 CEST	49926	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:55.257117987 CEST	443	49926	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:55.259445906 CEST	49931	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:55.259506941 CEST	443	49931	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:55.259598970 CEST	49931	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:55.259726048 CEST	49931	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:55.259752989 CEST	443	49931	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:55.343394041 CEST	443	49927	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:55.343914032 CEST	49927	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:55.343930960 CEST	443	49927	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:55.345046043 CEST	49927	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:55.345051050 CEST	443	49927	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:55.482567072 CEST	443	49927	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:55.482831001 CEST	443	49927	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:55.482907057 CEST	49927	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:55.483108997 CEST	49927	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:55.483129025 CEST	443	49927	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:55.483144045 CEST	49927	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:55.483150959 CEST	443	49927	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:55.485989094 CEST	49932	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:55.486028910 CEST	443	49932	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:55.486118078 CEST	49932	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:55.486262083 CEST	49932	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:55.486275911 CEST	443	49932	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:55.805907965 CEST	443	49928	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:55.806632996 CEST	49928	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:55.806695938 CEST	443	49928	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:55.806991100 CEST	49928	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:55.807007074 CEST	443	49928	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:55.817054987 CEST	443	49929	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:55.817384005 CEST	49929	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:55.817409039 CEST	443	49929	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:55.817718029 CEST	49929	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:55.817723989 CEST	443	49929	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:55.941931009 CEST	443	49928	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:55.942002058 CEST	443	49928	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:55.942070961 CEST	49928	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:55.942085028 CEST	443	49928	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:55.942112923 CEST	443	49928	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:55.942162037 CEST	49928	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:55.944940090 CEST	49928	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:55.944955111 CEST	443	49928	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:55.949942112 CEST	49933	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:55.950030088 CEST	443	49933	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:55.950105906 CEST	49933	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:55.953814030 CEST	49933	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:55.953850985 CEST	443	49933	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:55.955753088 CEST	443	49929	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:55.955913067 CEST	443	49929	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:55.955971003 CEST	49929	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:55.956007957 CEST	49929	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:55.956007957 CEST	49929	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:55.956027031 CEST	443	49929	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:55.956037998 CEST	443	49929	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:55.959199905 CEST	49934	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:55.959223986 CEST	443	49934	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:55.959309101 CEST	49934	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:55.959464073 CEST	49934	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:55.959491014 CEST	443	49934	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:56.003712893 CEST	443	49931	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:56.004436970 CEST	49931	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:56.004446030 CEST	443	49931	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:56.004863977 CEST	49931	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:56.004868984 CEST	443	49931	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:56.006957054 CEST	443	49930	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:56.007229090 CEST	49930	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:56.007242918 CEST	443	49930	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:56.007546902 CEST	49930	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:56.007553101 CEST	443	49930	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:56.134227037 CEST	443	49931	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:56.134294033 CEST	443	49931	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:56.134376049 CEST	49931	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:56.134397030 CEST	443	49931	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:56.134418964 CEST	443	49931	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:56.134475946 CEST	49931	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:56.134777069 CEST	49931	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:56.134793043 CEST	443	49931	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:56.134805918 CEST	49931	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:56.134810925 CEST	443	49931	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:56.139502048 CEST	49935	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:56.139543056 CEST	443	49935	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:56.139614105 CEST	49935	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:56.140086889 CEST	49935	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:56.140099049 CEST	443	49935	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:56.140353918 CEST	443	49930	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:56.140496969 CEST	443	49930	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:56.140549898 CEST	49930	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:56.140696049 CEST	49930	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:56.140713930 CEST	443	49930	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:56.140727043 CEST	49930	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:56.140733957 CEST	443	49930	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:56.143790960 CEST	49936	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:56.143811941 CEST	443	49936	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:56.143914938 CEST	49936	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:56.144012928 CEST	49936	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:56.144023895 CEST	443	49936	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:56.236780882 CEST	443	49932	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:56.237209082 CEST	49932	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:56.237222910 CEST	443	49932	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:56.237637043 CEST	49932	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:56.237642050 CEST	443	49932	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:56.370243073 CEST	443	49932	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:56.370316029 CEST	443	49932	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:56.370373011 CEST	49932	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:56.370608091 CEST	49932	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:56.370632887 CEST	443	49932	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:56.370644093 CEST	49932	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:56.370650053 CEST	443	49932	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:56.373626947 CEST	49937	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:56.373666048 CEST	443	49937	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:56.373738050 CEST	49937	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:56.373908043 CEST	49937	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:56.373924017 CEST	443	49937	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:56.745934963 CEST	443	49933	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:56.746428967 CEST	49933	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:56.746499062 CEST	443	49933	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:56.746885061 CEST	443	49934	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:56.747323036 CEST	49933	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:56.747339010 CEST	443	49933	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:56.754252911 CEST	49934	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:56.754272938 CEST	443	49934	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:56.754813910 CEST	49934	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:56.754826069 CEST	443	49934	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:56.881776094 CEST	443	49933	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:56.881839991 CEST	443	49933	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:56.881901026 CEST	49933	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:56.881932974 CEST	443	49933	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:56.881967068 CEST	443	49933	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:56.882034063 CEST	49933	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:56.882242918 CEST	49933	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:56.882277012 CEST	443	49933	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:56.882304907 CEST	49933	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:56.882320881 CEST	443	49933	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:56.885214090 CEST	49939	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:56.885241032 CEST	443	49939	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:56.885313988 CEST	49939	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:56.885433912 CEST	49939	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:56.885445118 CEST	443	49939	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:56.889318943 CEST	443	49934	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:56.889470100 CEST	443	49934	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:56.889534950 CEST	49934	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:56.889601946 CEST	49934	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:56.889619112 CEST	443	49934	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:56.889661074 CEST	49934	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:56.889672995 CEST	443	49934	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:56.891947031 CEST	49940	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:56.891977072 CEST	443	49940	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:56.892040968 CEST	49940	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:56.892136097 CEST	49940	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:56.892148018 CEST	443	49940	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:56.914805889 CEST	443	49936	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:56.915132046 CEST	49936	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:56.915143967 CEST	443	49936	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:56.915534019 CEST	49936	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:56.915539980 CEST	443	49936	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:56.977744102 CEST	443	49935	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:56.978128910 CEST	49935	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:56.978147984 CEST	443	49935	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:56.978699923 CEST	49935	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:56.978707075 CEST	443	49935	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:57.049977064 CEST	443	49936	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:57.050127983 CEST	443	49936	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:57.050188065 CEST	49936	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:57.051496029 CEST	49936	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:57.051506042 CEST	443	49936	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:57.051516056 CEST	49936	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:57.051521063 CEST	443	49936	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:57.055460930 CEST	49941	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:57.055507898 CEST	443	49941	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:57.055663109 CEST	49941	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:57.055896044 CEST	49941	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:57.055911064 CEST	443	49941	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:57.124084949 CEST	443	49935	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:57.124200106 CEST	443	49935	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:57.124262094 CEST	49935	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:57.124371052 CEST	49935	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:57.124387026 CEST	443	49935	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:57.124397993 CEST	49935	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:57.124404907 CEST	443	49935	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:57.127563000 CEST	49942	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:57.127598047 CEST	443	49942	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:57.127727985 CEST	49942	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:57.128027916 CEST	49942	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:57.128046989 CEST	443	49942	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:57.144682884 CEST	443	49937	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:57.145039082 CEST	49937	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:57.145064116 CEST	443	49937	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:57.145411968 CEST	49937	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:57.145417929 CEST	443	49937	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:57.281918049 CEST	443	49937	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:57.281948090 CEST	443	49937	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:57.281987906 CEST	443	49937	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:57.282052040 CEST	49937	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:57.282089949 CEST	49937	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:57.282380104 CEST	49937	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:57.282397032 CEST	443	49937	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:57.282413960 CEST	49937	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:57.282421112 CEST	443	49937	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:57.285742044 CEST	49943	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:57.285782099 CEST	443	49943	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:57.285886049 CEST	49943	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:57.286077976 CEST	49943	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:57.286093950 CEST	443	49943	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:57.651768923 CEST	443	49939	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:57.652688980 CEST	49939	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:57.652712107 CEST	443	49939	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:57.653320074 CEST	49939	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:57.653326035 CEST	443	49939	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:57.658411026 CEST	443	49940	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:57.658817053 CEST	49940	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:57.658829927 CEST	443	49940	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:57.659267902 CEST	49940	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:57.659274101 CEST	443	49940	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:57.783648968 CEST	443	49939	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:57.783843994 CEST	443	49939	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:57.783997059 CEST	49939	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:57.784064054 CEST	49939	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:57.784064054 CEST	49939	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:57.784082890 CEST	443	49939	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:57.784101009 CEST	443	49939	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:57.786859989 CEST	49944	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:57.786957026 CEST	443	49944	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:57.787061930 CEST	49944	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:57.787266970 CEST	49944	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:57.787297964 CEST	443	49944	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:57.789787054 CEST	443	49940	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:57.789824009 CEST	443	49940	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:57.789870977 CEST	443	49940	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:57.789923906 CEST	49940	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:57.789982080 CEST	49940	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:57.789997101 CEST	443	49940	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:57.790009022 CEST	49940	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:57.790015936 CEST	443	49940	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:57.792321920 CEST	49945	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:57.792351007 CEST	443	49945	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:57.792448997 CEST	49945	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:57.792594910 CEST	49945	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:57.792606115 CEST	443	49945	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:57.806886911 CEST	443	49941	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:57.807408094 CEST	49941	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:57.807427883 CEST	443	49941	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:57.807739973 CEST	49941	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:57.807746887 CEST	443	49941	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:57.898950100 CEST	443	49942	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:57.899542093 CEST	49942	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:57.899561882 CEST	443	49942	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:57.900012970 CEST	49942	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:57.900019884 CEST	443	49942	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:57.945039988 CEST	443	49941	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:57.945188999 CEST	443	49941	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:57.945389986 CEST	49941	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:57.945389986 CEST	49941	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:57.945430994 CEST	49941	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:57.945446968 CEST	443	49941	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:57.948329926 CEST	49946	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:57.948360920 CEST	443	49946	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:57.948431969 CEST	49946	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:57.948632002 CEST	49946	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:57.948647976 CEST	443	49946	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:58.033029079 CEST	443	49943	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:58.033525944 CEST	49943	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:58.033562899 CEST	443	49943	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:58.033967018 CEST	49943	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:58.033977032 CEST	443	49943	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:58.038861036 CEST	443	49942	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:58.038925886 CEST	443	49942	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:58.039024115 CEST	443	49942	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:58.039098024 CEST	49942	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:58.039184093 CEST	49942	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:58.039197922 CEST	443	49942	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:58.039211035 CEST	49942	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:58.039217949 CEST	443	49942	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:58.041923046 CEST	49947	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:58.041966915 CEST	443	49947	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:58.042062998 CEST	49947	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:58.042242050 CEST	49947	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:58.042260885 CEST	443	49947	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:58.171036959 CEST	443	49943	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:58.171228886 CEST	443	49943	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:58.171330929 CEST	49943	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:58.177947044 CEST	49943	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:58.177977085 CEST	443	49943	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:58.177989960 CEST	49943	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:58.177998066 CEST	443	49943	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:58.182686090 CEST	49948	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:58.182718992 CEST	443	49948	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:58.182801008 CEST	49948	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:58.183458090 CEST	49948	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:58.183471918 CEST	443	49948	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:58.568274021 CEST	443	49945	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:58.569099903 CEST	49945	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:58.569118977 CEST	443	49945	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:58.569556952 CEST	49945	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:58.569562912 CEST	443	49945	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:58.585262060 CEST	443	49944	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:58.585747004 CEST	49944	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:58.585797071 CEST	443	49944	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:58.585995913 CEST	49944	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:58.586015940 CEST	443	49944	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:58.709146023 CEST	443	49945	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:58.709563971 CEST	443	49945	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:58.709636927 CEST	49945	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:58.709683895 CEST	49945	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:58.709705114 CEST	443	49945	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:58.709718943 CEST	49945	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:58.709727049 CEST	443	49945	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:58.712274075 CEST	49949	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:58.712310076 CEST	443	49949	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:58.712389946 CEST	49949	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:58.712594986 CEST	49949	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:58.712606907 CEST	443	49949	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:58.712848902 CEST	443	49946	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:58.713181019 CEST	49946	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:58.713203907 CEST	443	49946	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:58.713627100 CEST	49946	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:58.713633060 CEST	443	49946	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:58.736478090 CEST	443	49944	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:58.736619949 CEST	443	49944	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:58.736692905 CEST	49944	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:58.736862898 CEST	49944	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:58.736862898 CEST	49944	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:58.736900091 CEST	443	49944	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:58.736923933 CEST	443	49944	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:58.738975048 CEST	49950	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:58.738987923 CEST	443	49950	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:58.739062071 CEST	49950	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:58.739331007 CEST	49950	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:58.739341021 CEST	443	49950	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:58.803855896 CEST	443	49947	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:58.804375887 CEST	49947	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:58.804408073 CEST	443	49947	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:58.804826021 CEST	49947	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:58.804836035 CEST	443	49947	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:58.842040062 CEST	443	49946	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:58.842084885 CEST	443	49946	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:58.842154980 CEST	443	49946	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:58.842181921 CEST	49946	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:58.842216969 CEST	49946	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:58.842408895 CEST	49946	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:58.842426062 CEST	443	49946	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:58.842441082 CEST	49946	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:58.842447042 CEST	443	49946	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:58.845117092 CEST	49951	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:58.845139027 CEST	443	49951	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:58.845201969 CEST	49951	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:58.845614910 CEST	49951	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:58.845629930 CEST	443	49951	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:58.934245110 CEST	443	49947	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:58.934401989 CEST	443	49947	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:58.934465885 CEST	49947	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:58.934556961 CEST	49947	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:58.934596062 CEST	443	49947	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:58.934624910 CEST	49947	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:58.934639931 CEST	443	49947	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:58.937525034 CEST	49952	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:58.937550068 CEST	443	49952	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:58.937613964 CEST	49952	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:58.937767982 CEST	49952	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:58.937789917 CEST	443	49952	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:58.966325998 CEST	443	49948	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:58.966744900 CEST	49948	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:58.966753960 CEST	443	49948	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:58.967246056 CEST	49948	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:58.967251062 CEST	443	49948	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:59.100909948 CEST	443	49948	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:59.101089954 CEST	443	49948	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:59.101159096 CEST	49948	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:59.101244926 CEST	49948	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:59.101258039 CEST	443	49948	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:59.101269007 CEST	49948	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:59.101273060 CEST	443	49948	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:59.103732109 CEST	49953	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:59.103807926 CEST	443	49953	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:59.103899956 CEST	49953	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:59.104044914 CEST	49953	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:59.104063034 CEST	443	49953	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:59.470551014 CEST	443	49949	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:59.471045017 CEST	49949	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:59.471060038 CEST	443	49949	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:59.471514940 CEST	49949	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:59.471518993 CEST	443	49949	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:59.498550892 CEST	443	49950	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:59.500041962 CEST	49950	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:59.500057936 CEST	443	49950	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:59.500513077 CEST	49950	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:59.500523090 CEST	443	49950	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:59.587316990 CEST	443	49951	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:59.587939024 CEST	49951	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:59.587965012 CEST	443	49951	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:59.588391066 CEST	49951	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:59.588398933 CEST	443	49951	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:59.604301929 CEST	443	49949	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:59.604470015 CEST	443	49949	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:59.604639053 CEST	49949	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:59.604670048 CEST	49949	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:59.604686022 CEST	443	49949	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:59.604696035 CEST	49949	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:59.604701042 CEST	443	49949	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:59.607539892 CEST	49954	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:59.607561111 CEST	443	49954	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:59.607625008 CEST	49954	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:59.607760906 CEST	49954	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:59.607772112 CEST	443	49954	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:59.638459921 CEST	443	49950	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:59.638614893 CEST	443	49950	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:59.638710976 CEST	49950	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:59.638760090 CEST	49950	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:59.638765097 CEST	443	49950	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:59.638775110 CEST	49950	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:59.638778925 CEST	443	49950	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:59.640978098 CEST	49955	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:59.641010046 CEST	443	49955	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:59.641099930 CEST	49955	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:59.641235113 CEST	49955	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:59.641252995 CEST	443	49955	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:59.692744017 CEST	443	49952	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:59.693208933 CEST	49952	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:59.693231106 CEST	443	49952	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:59.693629026 CEST	49952	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:59.693635941 CEST	443	49952	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:59.727988005 CEST	443	49951	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:59.728127003 CEST	443	49951	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:59.728216887 CEST	49951	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:59.728241920 CEST	49951	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:59.728254080 CEST	443	49951	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:59.728266954 CEST	49951	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:59.728272915 CEST	443	49951	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:59.730344057 CEST	49956	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:59.730444908 CEST	443	49956	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:59.730516911 CEST	49956	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:59.730633020 CEST	49956	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:59.730663061 CEST	443	49956	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:59.834954977 CEST	443	49952	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:59.835021019 CEST	443	49952	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:59.835241079 CEST	49952	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:59.835308075 CEST	49952	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:59.835325956 CEST	443	49952	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:59.835340023 CEST	49952	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:59.835346937 CEST	443	49952	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:59.837949991 CEST	49957	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:59.837990999 CEST	443	49957	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:59.838118076 CEST	49957	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:59.838237047 CEST	49957	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:59.838252068 CEST	443	49957	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:59.872689962 CEST	443	49953	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:59.873105049 CEST	49953	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:59.873121023 CEST	443	49953	13.107.246.60	192.168.2.5
Oct 17, 2024 11:21:59.873558998 CEST	49953	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:21:59.873564959 CEST	443	49953	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:00.024068117 CEST	443	49953	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:00.024243116 CEST	443	49953	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:00.024311066 CEST	49953	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:00.024535894 CEST	49953	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:00.024563074 CEST	443	49953	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:00.024589062 CEST	49953	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:00.024601936 CEST	443	49953	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:00.027337074 CEST	49958	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:00.027371883 CEST	443	49958	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:00.027520895 CEST	49958	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:00.027646065 CEST	49958	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:00.027659893 CEST	443	49958	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:00.394938946 CEST	443	49954	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:00.395476103 CEST	49954	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:00.395514011 CEST	443	49954	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:00.395905018 CEST	49954	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:00.395911932 CEST	443	49954	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:00.411607981 CEST	443	49955	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:00.411895990 CEST	49955	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:00.411921978 CEST	443	49955	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:00.412230015 CEST	49955	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:00.412237883 CEST	443	49955	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:00.490513086 CEST	443	49956	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:00.491280079 CEST	49956	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:00.491318941 CEST	443	49956	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:00.491895914 CEST	49956	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:00.491913080 CEST	443	49956	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:00.530303955 CEST	443	49954	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:00.530373096 CEST	443	49954	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:00.530445099 CEST	49954	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:00.530491114 CEST	443	49954	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:00.530522108 CEST	443	49954	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:00.530579090 CEST	49954	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:00.530724049 CEST	49954	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:00.530760050 CEST	443	49954	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:00.530785084 CEST	49954	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:00.530807018 CEST	443	49954	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:00.533631086 CEST	49959	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:00.533684015 CEST	443	49959	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:00.533783913 CEST	49959	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:00.533957958 CEST	49959	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:00.533989906 CEST	443	49959	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:00.547924042 CEST	443	49955	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:00.548089981 CEST	443	49955	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:00.548264980 CEST	49955	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:00.548264980 CEST	49955	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:00.548264980 CEST	49955	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:00.550228119 CEST	49960	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:00.550252914 CEST	443	49960	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:00.550331116 CEST	49960	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:00.550467014 CEST	49960	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:00.550477028 CEST	443	49960	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:00.608656883 CEST	443	49957	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:00.609255075 CEST	49957	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:00.609275103 CEST	443	49957	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:00.609711885 CEST	49957	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:00.609718084 CEST	443	49957	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:00.628278017 CEST	443	49956	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:00.628340006 CEST	443	49956	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:00.628412008 CEST	49956	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:00.628464937 CEST	443	49956	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:00.628500938 CEST	443	49956	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:00.628535032 CEST	49956	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:00.628587008 CEST	443	49956	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:00.628626108 CEST	49956	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:00.628626108 CEST	49956	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:00.628649950 CEST	443	49956	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:00.628669977 CEST	443	49956	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:00.631282091 CEST	49961	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:00.631309032 CEST	443	49961	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:00.631400108 CEST	49961	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:00.631562948 CEST	49961	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:00.631578922 CEST	443	49961	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:00.745332956 CEST	443	49957	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:00.745403051 CEST	443	49957	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:00.745461941 CEST	49957	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:00.745644093 CEST	49957	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:00.745662928 CEST	443	49957	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:00.745677948 CEST	49957	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:00.745685101 CEST	443	49957	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:00.748347998 CEST	49962	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:00.748370886 CEST	443	49962	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:00.748526096 CEST	49962	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:00.748689890 CEST	49962	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:00.748702049 CEST	443	49962	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:00.788022041 CEST	443	49958	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:00.788439035 CEST	49958	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:00.788450956 CEST	443	49958	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:00.788888931 CEST	49958	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:00.788896084 CEST	443	49958	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:00.855957985 CEST	49955	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:00.855968952 CEST	443	49955	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:00.926115036 CEST	443	49958	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:00.926136017 CEST	443	49958	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:00.926170111 CEST	443	49958	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:00.926192999 CEST	49958	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:00.926234961 CEST	49958	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:00.926445961 CEST	49958	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:00.926470041 CEST	443	49958	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:00.926481962 CEST	49958	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:00.926489115 CEST	443	49958	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:00.929280043 CEST	49963	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:00.929321051 CEST	443	49963	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:00.929393053 CEST	49963	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:00.929531097 CEST	49963	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:00.929539919 CEST	443	49963	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:01.371560097 CEST	443	49959	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:01.372133017 CEST	49959	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:01.372199059 CEST	443	49959	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:01.372622967 CEST	49959	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:01.372637987 CEST	443	49959	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:01.375262976 CEST	443	49960	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:01.375735998 CEST	49960	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:01.375746012 CEST	443	49960	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:01.376204014 CEST	49960	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:01.376209021 CEST	443	49960	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:01.394546986 CEST	443	49961	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:01.394864082 CEST	49961	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:01.394876003 CEST	443	49961	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:01.395169020 CEST	49961	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:01.395174980 CEST	443	49961	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:01.501977921 CEST	443	49959	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:01.502065897 CEST	443	49959	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:01.502140999 CEST	49959	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:01.502306938 CEST	49959	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:01.502306938 CEST	49959	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:01.502336979 CEST	443	49959	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:01.502377987 CEST	443	49959	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:01.504759073 CEST	49964	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:01.504808903 CEST	443	49964	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:01.504899025 CEST	49964	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:01.505023003 CEST	49964	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:01.505033970 CEST	443	49964	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:01.506753922 CEST	443	49960	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:01.506899118 CEST	443	49960	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:01.506956100 CEST	49960	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:01.506978035 CEST	49960	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:01.506989956 CEST	443	49960	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:01.507000923 CEST	49960	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:01.507005930 CEST	443	49960	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:01.508028030 CEST	443	49962	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:01.508419037 CEST	49962	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:01.508431911 CEST	443	49962	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:01.508776903 CEST	49962	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:01.508781910 CEST	443	49962	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:01.509670973 CEST	49965	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:01.509697914 CEST	443	49965	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:01.509774923 CEST	49965	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:01.509886980 CEST	49965	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:01.509896994 CEST	443	49965	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:01.523164988 CEST	443	49961	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:01.523313046 CEST	443	49961	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:01.523411989 CEST	49961	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:01.523715019 CEST	49961	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:01.523715019 CEST	49961	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:01.523725986 CEST	443	49961	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:01.523735046 CEST	443	49961	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:01.526123047 CEST	49966	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:01.526141882 CEST	443	49966	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:01.526201010 CEST	49966	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:01.526319027 CEST	49966	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:01.526324034 CEST	443	49966	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:01.640316010 CEST	443	49962	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:01.641072989 CEST	443	49962	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:01.641133070 CEST	443	49962	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:01.641153097 CEST	49962	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:01.641207933 CEST	49962	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:01.641326904 CEST	49962	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:01.641326904 CEST	49962	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:01.641340017 CEST	443	49962	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:01.641349077 CEST	443	49962	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:01.644119978 CEST	49967	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:01.644164085 CEST	443	49967	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:01.644268036 CEST	49967	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:01.644454956 CEST	49967	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:01.644474983 CEST	443	49967	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:01.728436947 CEST	443	49963	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:01.728975058 CEST	49963	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:01.728990078 CEST	443	49963	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:01.729437113 CEST	49963	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:01.729445934 CEST	443	49963	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:01.869558096 CEST	443	49963	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:01.869723082 CEST	443	49963	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:01.869777918 CEST	49963	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:01.870389938 CEST	49963	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:01.870407104 CEST	443	49963	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:01.870417118 CEST	49963	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:01.870424032 CEST	443	49963	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:01.874391079 CEST	49968	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:01.874438047 CEST	443	49968	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:01.874558926 CEST	49968	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:01.874640942 CEST	49968	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:01.874650002 CEST	443	49968	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:02.275062084 CEST	443	49965	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:02.275597095 CEST	49965	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:02.275623083 CEST	443	49965	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:02.276031971 CEST	49965	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:02.276038885 CEST	443	49965	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:02.280759096 CEST	443	49964	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:02.281488895 CEST	49964	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:02.281508923 CEST	443	49964	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:02.281879902 CEST	49964	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:02.281886101 CEST	443	49964	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:02.298480988 CEST	443	49966	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:02.298990011 CEST	49966	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:02.299006939 CEST	443	49966	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:02.299434900 CEST	49966	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:02.299438953 CEST	443	49966	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:02.398704052 CEST	443	49967	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:02.399228096 CEST	49967	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:02.399245024 CEST	443	49967	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:02.399576902 CEST	49967	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:02.399580956 CEST	443	49967	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:02.404717922 CEST	443	49965	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:02.404768944 CEST	443	49965	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:02.404822111 CEST	49965	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:02.404838085 CEST	443	49965	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:02.404890060 CEST	443	49965	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:02.404934883 CEST	49965	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:02.407538891 CEST	49965	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:02.407552958 CEST	443	49965	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:02.407567978 CEST	49965	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:02.407572031 CEST	443	49965	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:02.411150932 CEST	49969	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:02.411242008 CEST	443	49969	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:02.411309958 CEST	49969	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:02.411429882 CEST	49969	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:02.411447048 CEST	443	49969	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:02.412806034 CEST	443	49964	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:02.412942886 CEST	443	49964	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:02.412991047 CEST	49964	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:02.413017035 CEST	49964	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:02.413029909 CEST	443	49964	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:02.413041115 CEST	49964	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:02.413045883 CEST	443	49964	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:02.419070005 CEST	49970	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:02.419095993 CEST	443	49970	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:02.419163942 CEST	49970	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:02.419264078 CEST	49970	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:02.419279099 CEST	443	49970	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:02.435024977 CEST	443	49966	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:02.435292959 CEST	443	49966	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:02.435343027 CEST	49966	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:02.435504913 CEST	49966	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:02.435504913 CEST	49966	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:02.435513973 CEST	443	49966	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:02.435522079 CEST	443	49966	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:02.437968969 CEST	49971	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:02.438004971 CEST	443	49971	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:02.438076973 CEST	49971	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:02.438183069 CEST	49971	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:02.438194990 CEST	443	49971	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:02.528356075 CEST	443	49967	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:02.528412104 CEST	443	49967	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:02.528476954 CEST	49967	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:02.528491974 CEST	443	49967	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:02.528548002 CEST	443	49967	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:02.528601885 CEST	49967	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:02.586904049 CEST	49967	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:02.586920023 CEST	443	49967	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:02.586949110 CEST	49967	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:02.586956024 CEST	443	49967	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:02.619453907 CEST	443	49968	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:02.668443918 CEST	49968	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:02.830640078 CEST	49968	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:02.830661058 CEST	443	49968	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:02.831032038 CEST	49968	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:02.831038952 CEST	443	49968	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:02.833271980 CEST	49972	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:02.833364010 CEST	443	49972	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:02.833446980 CEST	49972	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:02.833597898 CEST	49972	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:02.833622932 CEST	443	49972	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:02.963824034 CEST	443	49968	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:02.963882923 CEST	443	49968	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:02.963942051 CEST	49968	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:02.963963032 CEST	443	49968	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:02.964054108 CEST	443	49968	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:02.964106083 CEST	49968	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:02.964206934 CEST	49968	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:02.964221001 CEST	443	49968	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:02.964231014 CEST	49968	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:02.964236021 CEST	443	49968	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:02.967149973 CEST	49973	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:02.967200994 CEST	443	49973	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:02.967267036 CEST	49973	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:02.967509031 CEST	49973	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:02.967528105 CEST	443	49973	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:03.186026096 CEST	443	49970	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:03.186536074 CEST	49970	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:03.186579943 CEST	443	49970	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:03.186964989 CEST	49970	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:03.186975956 CEST	443	49970	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:03.193298101 CEST	443	49969	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:03.193552017 CEST	49969	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:03.193583965 CEST	443	49969	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:03.193873882 CEST	49969	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:03.193885088 CEST	443	49969	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:03.217355013 CEST	443	49971	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:03.217773914 CEST	49971	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:03.217787981 CEST	443	49971	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:03.218183041 CEST	49971	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:03.218188047 CEST	443	49971	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:03.346191883 CEST	443	49970	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:03.346281052 CEST	443	49970	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:03.346417904 CEST	443	49970	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:03.346503019 CEST	49970	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:03.346671104 CEST	49970	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:03.346671104 CEST	49970	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:03.349473000 CEST	49970	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:03.349505901 CEST	443	49970	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:03.349534988 CEST	49974	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:03.349621058 CEST	443	49974	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:03.349716902 CEST	49974	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:03.349865913 CEST	49974	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:03.349886894 CEST	443	49974	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:03.350188017 CEST	443	49969	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:03.350251913 CEST	443	49969	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:03.350303888 CEST	49969	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:03.350330114 CEST	443	49969	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:03.350430965 CEST	49969	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:03.350430965 CEST	49969	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:03.350435019 CEST	443	49969	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:03.350485086 CEST	443	49969	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:03.350488901 CEST	49969	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:03.350507021 CEST	443	49969	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:03.352324963 CEST	49975	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:03.352405071 CEST	443	49975	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:03.352488995 CEST	49975	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:03.352621078 CEST	49975	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:03.352649927 CEST	443	49975	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:03.363821030 CEST	443	49971	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:03.364126921 CEST	443	49971	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:03.364176989 CEST	49971	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:03.364204884 CEST	49971	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:03.364224911 CEST	443	49971	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:03.364227057 CEST	49971	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:03.364233971 CEST	443	49971	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:03.366465092 CEST	49976	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:03.366492033 CEST	443	49976	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:03.366561890 CEST	49976	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:03.366666079 CEST	49976	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:03.366681099 CEST	443	49976	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:03.617316008 CEST	443	49972	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:03.617798090 CEST	49972	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:03.617820978 CEST	443	49972	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:03.618259907 CEST	49972	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:03.618271112 CEST	443	49972	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:03.747355938 CEST	443	49973	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:03.747908115 CEST	49973	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:03.747941017 CEST	443	49973	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:03.748332024 CEST	49973	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:03.748339891 CEST	443	49973	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:03.759681940 CEST	443	49972	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:03.759838104 CEST	443	49972	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:03.759898901 CEST	49972	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:03.759948969 CEST	49972	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:03.759979010 CEST	443	49972	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:03.760006905 CEST	49972	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:03.760020971 CEST	443	49972	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:03.762727022 CEST	49977	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:03.762753010 CEST	443	49977	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:03.762830019 CEST	49977	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:03.763017893 CEST	49977	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:03.763025999 CEST	443	49977	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:03.888911009 CEST	443	49973	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:03.889079094 CEST	443	49973	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:03.889159918 CEST	49973	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:03.889262915 CEST	49973	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:03.889280081 CEST	443	49973	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:03.889302969 CEST	49973	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:03.889309883 CEST	443	49973	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:03.891905069 CEST	49978	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:03.891931057 CEST	443	49978	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:03.892011881 CEST	49978	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:03.892164946 CEST	49978	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:03.892177105 CEST	443	49978	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:04.104289055 CEST	443	49975	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:04.105101109 CEST	49975	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:04.105130911 CEST	443	49975	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:04.105469942 CEST	49975	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:04.105482101 CEST	443	49975	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:04.122718096 CEST	443	49974	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:04.123023033 CEST	49974	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:04.123070955 CEST	443	49974	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:04.123398066 CEST	49974	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:04.123404980 CEST	443	49974	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:04.147061110 CEST	443	49976	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:04.147416115 CEST	49976	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:04.147432089 CEST	443	49976	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:04.147792101 CEST	49976	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:04.147798061 CEST	443	49976	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:04.237447023 CEST	443	49975	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:04.237507105 CEST	443	49975	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:04.237564087 CEST	49975	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:04.237585068 CEST	443	49975	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:04.237637997 CEST	49975	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:04.237654924 CEST	443	49975	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:04.237719059 CEST	49975	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:04.237768888 CEST	49975	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:04.237768888 CEST	49975	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:04.237797976 CEST	443	49975	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:04.237822056 CEST	443	49975	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:04.240427017 CEST	49979	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:04.240458012 CEST	443	49979	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:04.240518093 CEST	49979	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:04.240689993 CEST	49979	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:04.240704060 CEST	443	49979	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:04.257271051 CEST	443	49974	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:04.257425070 CEST	443	49974	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:04.257486105 CEST	49974	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:04.257528067 CEST	49974	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:04.257549047 CEST	443	49974	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:04.257564068 CEST	49974	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:04.257571936 CEST	443	49974	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:04.259881020 CEST	49980	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:04.259910107 CEST	443	49980	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:04.259969950 CEST	49980	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:04.260219097 CEST	49980	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:04.260232925 CEST	443	49980	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:04.281390905 CEST	443	49976	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:04.281441927 CEST	443	49976	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:04.281502008 CEST	49976	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:04.281512976 CEST	443	49976	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:04.281569004 CEST	443	49976	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:04.281615019 CEST	49976	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:04.282124043 CEST	49976	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:04.282135963 CEST	443	49976	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:04.282145023 CEST	49976	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:04.282150030 CEST	443	49976	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:04.286341906 CEST	49981	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:04.286375999 CEST	443	49981	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:04.286438942 CEST	49981	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:04.286612034 CEST	49981	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:04.286623955 CEST	443	49981	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:04.523287058 CEST	443	49977	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:04.526040077 CEST	49977	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:04.526058912 CEST	443	49977	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:04.526488066 CEST	49977	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:04.526493073 CEST	443	49977	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:04.655483961 CEST	443	49978	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:04.656455040 CEST	49978	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:04.656455040 CEST	49978	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:04.656476974 CEST	443	49978	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:04.656486034 CEST	443	49978	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:04.779926062 CEST	443	49977	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:04.779989958 CEST	443	49977	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:04.780040026 CEST	443	49977	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:04.780056953 CEST	49977	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:04.780071974 CEST	443	49977	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:04.780100107 CEST	49977	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:04.780128002 CEST	49977	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:04.782066107 CEST	443	49977	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:04.782140970 CEST	49977	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:04.782164097 CEST	443	49977	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:04.782170057 CEST	49977	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:04.782183886 CEST	49977	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:04.782191992 CEST	443	49977	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:04.782391071 CEST	443	49977	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:04.784605026 CEST	49982	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:04.784634113 CEST	443	49982	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:04.785511971 CEST	49982	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:04.785640955 CEST	49982	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:04.785646915 CEST	443	49982	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:04.789295912 CEST	443	49978	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:04.789352894 CEST	443	49978	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:04.789479971 CEST	443	49978	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:04.789494991 CEST	49978	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:04.789540052 CEST	49978	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:04.789572954 CEST	49978	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:04.789585114 CEST	443	49978	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:04.789594889 CEST	49978	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:04.789599895 CEST	443	49978	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:04.791481018 CEST	49983	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:04.791512012 CEST	443	49983	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:04.791651011 CEST	49983	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:04.791783094 CEST	49983	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:04.791799068 CEST	443	49983	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:05.185081959 CEST	443	49981	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:05.185734987 CEST	49981	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:05.185746908 CEST	443	49981	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:05.186198950 CEST	49981	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:05.186203957 CEST	443	49981	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:05.188715935 CEST	443	49979	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:05.189048052 CEST	49979	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:05.189066887 CEST	443	49979	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:05.189474106 CEST	49979	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:05.189479113 CEST	443	49979	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:05.193672895 CEST	443	49980	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:05.193999052 CEST	49980	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:05.194021940 CEST	443	49980	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:05.194366932 CEST	49980	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:05.194375038 CEST	443	49980	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:05.316512108 CEST	443	49981	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:05.316561937 CEST	443	49981	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:05.316615105 CEST	49981	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:05.316627979 CEST	443	49981	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:05.316643000 CEST	443	49981	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:05.316694975 CEST	49981	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:05.318818092 CEST	49981	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:05.318834066 CEST	443	49981	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:05.318842888 CEST	49981	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:05.318847895 CEST	443	49981	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:05.321316957 CEST	49984	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:05.321352959 CEST	443	49984	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:05.321434021 CEST	49984	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:05.321578979 CEST	49984	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:05.321593046 CEST	443	49984	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:05.332017899 CEST	443	49980	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:05.332078934 CEST	443	49980	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:05.332204103 CEST	443	49980	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:05.332211018 CEST	49980	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:05.332372904 CEST	49980	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:05.332547903 CEST	49980	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:05.332567930 CEST	443	49980	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:05.332581997 CEST	49980	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:05.332588911 CEST	443	49980	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:05.334659100 CEST	49985	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:05.334706068 CEST	443	49985	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:05.334779024 CEST	49985	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:05.334916115 CEST	49985	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:05.334937096 CEST	443	49985	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:05.453911066 CEST	443	49979	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:05.453970909 CEST	443	49979	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:05.454024076 CEST	443	49979	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:05.454139948 CEST	49979	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:05.454139948 CEST	49979	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:05.454166889 CEST	443	49979	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:05.454210997 CEST	49979	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:05.541393042 CEST	443	49982	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:05.542100906 CEST	49982	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:05.542119980 CEST	443	49982	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:05.542479992 CEST	49982	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:05.542485952 CEST	443	49982	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:05.573204041 CEST	443	49979	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:05.573297977 CEST	443	49979	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:05.573306084 CEST	49979	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:05.573331118 CEST	443	49979	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:05.573457956 CEST	443	49979	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:05.573462963 CEST	49979	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:05.573462963 CEST	49979	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:05.573512077 CEST	49979	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:05.573565960 CEST	49979	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:05.573580027 CEST	443	49979	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:05.573590994 CEST	49979	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:05.573596954 CEST	443	49979	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:05.576493025 CEST	49986	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:05.576534033 CEST	443	49986	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:05.576605082 CEST	49986	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:05.576728106 CEST	49986	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:05.576742887 CEST	443	49986	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:05.671701908 CEST	443	49982	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:05.671869993 CEST	443	49982	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:05.671946049 CEST	49982	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:05.672137022 CEST	49982	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:05.672152996 CEST	443	49982	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:05.672168016 CEST	49982	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:05.672174931 CEST	443	49982	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:05.675203085 CEST	49987	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:05.675237894 CEST	443	49987	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:05.675319910 CEST	49987	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:05.675491095 CEST	49987	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:05.675507069 CEST	443	49987	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:05.785232067 CEST	443	49983	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:05.785743952 CEST	49983	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:05.785769939 CEST	443	49983	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:05.786189079 CEST	49983	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:05.786195993 CEST	443	49983	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:05.915456057 CEST	443	49983	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:05.915631056 CEST	443	49983	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:05.915743113 CEST	49983	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:05.915972948 CEST	49983	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:05.915972948 CEST	49983	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:05.915997028 CEST	443	49983	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:05.916009903 CEST	443	49983	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:05.918483973 CEST	49988	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:05.918512106 CEST	443	49988	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:05.918632030 CEST	49988	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:05.918751001 CEST	49988	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:05.918761015 CEST	443	49988	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:06.058406115 CEST	443	49984	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:06.058917999 CEST	49984	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:06.058936119 CEST	443	49984	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:06.059515953 CEST	49984	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:06.059521914 CEST	443	49984	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:06.064475060 CEST	443	49985	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:06.064785004 CEST	49985	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:06.064816952 CEST	443	49985	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:06.065167904 CEST	49985	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:06.065175056 CEST	443	49985	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:06.216825962 CEST	443	49985	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:06.217008114 CEST	443	49985	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:06.217070103 CEST	49985	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:06.217262030 CEST	443	49984	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:06.217304945 CEST	49985	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:06.217304945 CEST	49985	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:06.217324018 CEST	443	49985	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:06.217334986 CEST	443	49985	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:06.217536926 CEST	443	49984	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:06.217590094 CEST	49984	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:06.217804909 CEST	49984	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:06.217814922 CEST	443	49984	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:06.217827082 CEST	49984	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:06.217833042 CEST	443	49984	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:06.220065117 CEST	49989	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:06.220103979 CEST	443	49989	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:06.220134020 CEST	49990	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:06.220143080 CEST	443	49990	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:06.220179081 CEST	49989	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:06.220221043 CEST	49990	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:06.220377922 CEST	49990	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:06.220377922 CEST	49989	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:06.220391989 CEST	443	49990	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:06.220407009 CEST	443	49989	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:06.356098890 CEST	443	49986	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:06.357795000 CEST	49986	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:06.357817888 CEST	443	49986	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:06.358273029 CEST	49986	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:06.358278036 CEST	443	49986	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:06.430414915 CEST	443	49987	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:06.430922985 CEST	49987	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:06.430932999 CEST	443	49987	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:06.431395054 CEST	49987	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:06.431400061 CEST	443	49987	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:06.488631964 CEST	443	49986	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:06.488761902 CEST	443	49986	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:06.488826036 CEST	49986	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:06.488847017 CEST	443	49986	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:06.488879919 CEST	443	49986	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:06.488928080 CEST	49986	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:06.489052057 CEST	49986	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:06.489069939 CEST	443	49986	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:06.489080906 CEST	49986	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:06.489087105 CEST	443	49986	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:06.562942982 CEST	443	49987	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:06.563114882 CEST	443	49987	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:06.563196898 CEST	49987	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:06.563335896 CEST	49987	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:06.563343048 CEST	443	49987	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:06.563352108 CEST	49987	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:06.563358068 CEST	443	49987	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:06.667015076 CEST	443	49988	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:06.667604923 CEST	49988	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:06.667625904 CEST	443	49988	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:06.668195963 CEST	49988	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:06.668201923 CEST	443	49988	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:06.796232939 CEST	443	49988	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:06.796458006 CEST	443	49988	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:06.796535969 CEST	49988	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:06.796689987 CEST	49988	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:06.796689987 CEST	49988	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:06.796710014 CEST	443	49988	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:06.796722889 CEST	443	49988	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:06.956501961 CEST	443	49989	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:06.957179070 CEST	49989	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:06.957207918 CEST	443	49989	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:06.957695007 CEST	443	49990	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:06.957715034 CEST	49989	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:06.957721949 CEST	443	49989	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:06.957967043 CEST	49990	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:06.957974911 CEST	443	49990	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:06.958460093 CEST	49990	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:06.958463907 CEST	443	49990	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:07.087538004 CEST	443	49989	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:07.087619066 CEST	443	49989	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:07.087670088 CEST	49989	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:07.087970018 CEST	49989	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:07.087991953 CEST	443	49989	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:07.088005066 CEST	49989	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:07.088012934 CEST	443	49989	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:07.090648890 CEST	443	49990	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:07.090887070 CEST	443	49990	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:07.090933084 CEST	49990	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:07.090975046 CEST	49990	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:07.090981007 CEST	443	49990	13.107.246.60	192.168.2.5
Oct 17, 2024 11:22:07.090991974 CEST	49990	443	192.168.2.5	13.107.246.60
Oct 17, 2024 11:22:07.090996027 CEST	443	49990	13.107.246.60	192.168.2.5

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 17, 2024 11:21:05.994700909 CEST	1.1.1.1	192.168.2.5	0xf042	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Oct 17, 2024 11:21:05.994700909 CEST	1.1.1.1	192.168.2.5	0xf042	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Oct 17, 2024 11:21:06.795973063 CEST	1.1.1.1	192.168.2.5	0xf4ca	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 17, 2024 11:21:06.795973063 CEST	1.1.1.1	192.168.2.5	0xf4ca	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Oct 17, 2024 11:21:15.722891092 CEST	1.1.1.1	192.168.2.5	0x2456	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 17, 2024 11:21:15.722891092 CEST	1.1.1.1	192.168.2.5	0x2456	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false
Oct 17, 2024 11:22:08.466730118 CEST	1.1.1.1	192.168.2.5	0x1678	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Oct 17, 2024 11:22:08.466730118 CEST	1.1.1.1	192.168.2.5	0x1678	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	05:21:00
Start date:	17/10/2024
Path:	C:\Users\user\Desktop\tsle.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\tsle.exe"
Imagebase:	0x2e0000
File size:	522'280 bytes
MD5 hash:	D5F8FBF6E6B2AE95F9169F81A2DFFBE9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	05:21:02
Start date:	17/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0x860000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000002.00000002.2201301926.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000002.00000002.2203525343.0000000002CD4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	05:21:02
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 308
Imagebase:	0xac0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.4%
Total number of Nodes:	1607
Total number of Limit Nodes:	11

Executed Functions

Function 002E2441 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 176
memorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(0035BD80,000004E4,00000040,?), ref: 002E2558
GetCurrentThreadId.KERNEL32 ref: 002E258F
std::_Throw_Cpp_error.LIBCPMT ref: 002E2610

Part of subcall function 002E3D18: __EH_prolog3_catch.LIBCMT ref: 002E3D1F
Part of subcall function 002E3D18: _strlen.LIBCMT ref: 002E3D37

GetConsoleWindow.KERNEL32 ref: 002E25D6
CreateWindowExW.USER32(00000000,button,AUIshuyxgYUsuya,50000000,00000001,00000002,00000004,00000780,00000000,000000FF,00000000,00000000), ref: 002E25FF

Strings

button, xrefs: 002E25F9
AUIshuyxgYUsuya, xrefs: 002E25F4

Memory Dump Source

Source File: 00000000.00000002.2327396657.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2327325918.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327440148.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000353000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327642561.000000000035B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327726483.000000000035D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327798505.000000000035E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_tsle.jbxd

Yara matches

Similarity

API ID: Window$ConsoleCpp_errorCreateCurrentH_prolog3_catchProtectThreadThrow_Virtual_strlenstd::_
String ID: AUIshuyxgYUsuya$button
API String ID: 3668166268-3204260117
Opcode ID: 5726ae6951e01646e1ae6dbd92027a22afc577753d703e46e2f7437bae6aac0b
Instruction ID: ab0c3f99ec86d447e50c77f4b683641626b7f4cd5200622c15562fa05f34db49
Opcode Fuzzy Hash: 5726ae6951e01646e1ae6dbd92027a22afc577753d703e46e2f7437bae6aac0b
Instruction Fuzzy Hash: 83419E329F4356EAE7297A738C12FEFBA5CEB45710FC00112FA07A71D0D6B485518AE4

Function 002F6993 Relevance: .0, Instructions: 29
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2327396657.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2327325918.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327440148.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000353000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327642561.000000000035B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327726483.000000000035D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327798505.000000000035E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_tsle.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1f26c1fb3edb2be98b81f0233bb303821460483e2fe00c8e709d60a8b28ac8b
Instruction ID: 735a0606ff70d687c944b595bff0bf4ecea1358bdbec075bd0404200dc6b414b
Opcode Fuzzy Hash: c1f26c1fb3edb2be98b81f0233bb303821460483e2fe00c8e709d60a8b28ac8b
Instruction Fuzzy Hash: 93F06531621338DBCB26CB4CC409A69B3ACEB45B91F1140A6F645D7251C3B0DE54CBD0

Function 002F5332 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,6E837F14,?,002F543F,?,?,?,00000000), ref: 002F53F3

Strings

ext-ms-, xrefs: 002F539D
api-ms-, xrefs: 002F5389

Memory Dump Source

Source File: 00000000.00000002.2327396657.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2327325918.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327440148.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000353000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327642561.000000000035B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327726483.000000000035D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327798505.000000000035E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_tsle.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 799d307b5c67212613a6fe4a6d709f981803e2770e5e6dd27293b41a8535f728
Instruction ID: e1c17f94ca5c46b7a9cce0fd6315948b6c61414d231e7b6d7fe9f83364c74d80
Opcode Fuzzy Hash: 799d307b5c67212613a6fe4a6d709f981803e2770e5e6dd27293b41a8535f728
Instruction Fuzzy Hash: D421DB31A12A29A7DB225F289C50A7FBB68AB417E0F150171FB02A71D0D7B0DD10CBD0

Function 002EC7C4 Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(?,?,Function_0000C668,00000000,00000000,?), ref: 002EC80D
GetLastError.KERNEL32(?,002E2580,00000000,00000000,002E4B17,00000000,00000000), ref: 002EC819
__dosmaperr.LIBCMT ref: 002EC820

Memory Dump Source

Source File: 00000000.00000002.2327396657.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2327325918.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327440148.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000353000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327642561.000000000035B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327726483.000000000035D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327798505.000000000035E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_tsle.jbxd

Yara matches

Similarity

API ID: CreateErrorLastThread__dosmaperr
String ID:
API String ID: 2744730728-0
Opcode ID: 39068ceafc1b7616f60b7d0fac3b0a9a3f403468cba054a0a4a22eae611c4cab
Instruction ID: 32c5084e409e08e9846c05057e8a2293cc2b0e3bfbb035375b95ea8d5572bac9
Opcode Fuzzy Hash: 39068ceafc1b7616f60b7d0fac3b0a9a3f403468cba054a0a4a22eae611c4cab
Instruction Fuzzy Hash: 1B01B17256028AAFDF06DFE2DD05AAF7B68EF00360F600169F80196150EB70CE61DF90

Function 002EC668 Relevance: 3.0, APIs: 2, Instructions: 38
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(0030E7B0,0000000C), ref: 002EC67B
ExitThread.KERNEL32 ref: 002EC682

Memory Dump Source

Source File: 00000000.00000002.2327396657.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2327325918.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327440148.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000353000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327642561.000000000035B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327726483.000000000035D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327798505.000000000035E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_tsle.jbxd

Yara matches

Similarity

API ID: ErrorExitLastThread
String ID:
API String ID: 1611280651-0
Opcode ID: adebed64899b49affeb7e437a68e51ad4f5482bc20e635edc6ea444f9bbf99f7
Instruction ID: b196370a4063aff1eda1e4c8e107db3354498bf6b30b6b70ef7450427d8bda65
Opcode Fuzzy Hash: adebed64899b49affeb7e437a68e51ad4f5482bc20e635edc6ea444f9bbf99f7
Instruction Fuzzy Hash: CDF0AF719516459FDB01AFB0C81AB6F7B68EF81750F204559F1019B292CB705921CFA0

Function 002F53FD Relevance: 1.6, APIs: 1, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2327396657.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2327325918.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327440148.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000353000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327642561.000000000035B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327726483.000000000035D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327798505.000000000035E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_tsle.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c588f1d78fbf2a0bfeabefc41e7f59a005ad2c3ed1ef2d1db1ca6302a3de4b3
Instruction ID: f8ca151fa4bd34088fd32d97d4f5a40982510908e69f85323559fad10bdc43f0
Opcode Fuzzy Hash: 8c588f1d78fbf2a0bfeabefc41e7f59a005ad2c3ed1ef2d1db1ca6302a3de4b3
Instruction Fuzzy Hash: 6F01FE336246295BDB16CE2DFC4066A739AABC93A1B548130F701C7154DA70C8918B80

Function 002E4B17 Relevance: 1.5, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 002E4B1C

Part of subcall function 002E6BA1: GetCurrentThreadId.KERNEL32 ref: 002E6BCC

Memory Dump Source

Source File: 00000000.00000002.2327396657.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2327325918.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327440148.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000353000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327642561.000000000035B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327726483.000000000035D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327798505.000000000035E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_tsle.jbxd

Yara matches

Similarity

API ID: CurrentDispatcherExceptionThreadUser
String ID:
API String ID: 1349184736-0
Opcode ID: 5c49cc2fc9178d6d23006b60182ef2e535056fbf47ee83b9b30b3f1fa2a9ca1a
Instruction ID: 19c91967419b5f3d622967381618174f353bd2e18083224581ac5fd1a7cbc110
Opcode Fuzzy Hash: 5c49cc2fc9178d6d23006b60182ef2e535056fbf47ee83b9b30b3f1fa2a9ca1a
Instruction Fuzzy Hash: 0CC08C330AC2215BE984BA20E80AA8A63848F10364F20482BF240F2090CE2118514998

Non-executed Functions

Function 002FF68C Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 002FF870

Strings

1#INF, xrefs: 002FF7C2
1#IND, xrefs: 002FF791
1#QNAN, xrefs: 002FF79F
1#SNAN, xrefs: 002FF798

Memory Dump Source

Source File: 00000000.00000002.2327396657.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2327325918.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327440148.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000353000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327642561.000000000035B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327726483.000000000035D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327798505.000000000035E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_tsle.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 911448be94c1ae0ab29316f57605fb0d2c59c36b5160df6af2a90e185d2b831b
Instruction ID: 29b1d3c3a0a0df25e6f1612e2eab626489fac25f921af0a32c98d919bc9aa973
Opcode Fuzzy Hash: 911448be94c1ae0ab29316f57605fb0d2c59c36b5160df6af2a90e185d2b831b
Instruction Fuzzy Hash: 14D24A71E192298FDB69CE28CD507EAB7B9EF44344F1541EAD84DE7280E774AE818F40

Function 002FE7E7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,002FEB05,00000002,00000000,?,?,?,002FEB05,?,00000000), ref: 002FE880
GetLocaleInfoW.KERNEL32(?,20001004,002FEB05,00000002,00000000,?,?,?,002FEB05,?,00000000), ref: 002FE8A9
GetACP.KERNEL32(?,?,002FEB05,?,00000000), ref: 002FE8BE

Strings

ACP, xrefs: 002FE805
OCP, xrefs: 002FE83B

Memory Dump Source

Source File: 00000000.00000002.2327396657.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2327325918.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327440148.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000353000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327642561.000000000035B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327726483.000000000035D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327798505.000000000035E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_tsle.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: b0915f6f938644599407ac1e86640fadebcc87c615f25e1dec2a5fd7bdc0254e
Instruction ID: b94d26c26ac41bbf43be8884037566986ce0c3d76936610b984b292aba93f7db
Opcode Fuzzy Hash: b0915f6f938644599407ac1e86640fadebcc87c615f25e1dec2a5fd7bdc0254e
Instruction Fuzzy Hash: 2621B232A2110AAADF36AF15C904AB7F3A6EF54BD4B578434EA0AD7170E732DE50C750

Function 002FE9BC Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 002F4BE8: GetLastError.KERNEL32(?,?,002EC68D,0030E7B0,0000000C), ref: 002F4BEC
Part of subcall function 002F4BE8: SetLastError.KERNEL32(00000000), ref: 002F4C8E

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 002FEAC8
IsValidCodePage.KERNEL32(00000000), ref: 002FEB11
IsValidLocale.KERNEL32(?,00000001), ref: 002FEB20
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 002FEB68
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 002FEB87

Memory Dump Source

Source File: 00000000.00000002.2327396657.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2327325918.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327440148.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000353000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327642561.000000000035B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327726483.000000000035D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327798505.000000000035E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_tsle.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 04f8c7859fea6ebd63693e5f82e34b067180bd26e1971df97e0b4d0fcdd4a0b3
Instruction ID: 7e61b8590a3b73c8347902465941183cf3a2a5e7d500dc78c2be8ec8582a9351
Opcode Fuzzy Hash: 04f8c7859fea6ebd63693e5f82e34b067180bd26e1971df97e0b4d0fcdd4a0b3
Instruction Fuzzy Hash: 5C517171A2060EAEDF12EFA5CC45ABEB7B8FF08740F064075E615E7161EBB099108B61

Function 002FE058 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 002F4BE8: GetLastError.KERNEL32(?,?,002EC68D,0030E7B0,0000000C), ref: 002F4BEC
Part of subcall function 002F4BE8: SetLastError.KERNEL32(00000000), ref: 002F4C8E

GetACP.KERNEL32(?,?,?,?,?,?,002F2873,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 002FE119
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,002F2873,?,?,?,00000055,?,-00000050,?,?), ref: 002FE144
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 002FE2A7

Strings

utf8, xrefs: 002FE216

Memory Dump Source

Source File: 00000000.00000002.2327396657.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2327325918.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327440148.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000353000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327642561.000000000035B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327726483.000000000035D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327798505.000000000035E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_tsle.jbxd

Yara matches

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: 4b3a0eb5cb425569ddff145a738af0f87adf8f3c4a83bebb94ec68df09fb1019
Instruction ID: 90d02e8fddb9b8e3a95849fd9356a4d94f7ea9a8d74b9931fc6511702306d58b
Opcode Fuzzy Hash: 4b3a0eb5cb425569ddff145a738af0f87adf8f3c4a83bebb94ec68df09fb1019
Instruction Fuzzy Hash: A571F73162020AAAEF26AF75CC52BB7F39CEF54780F15003AFB05D7191FAB0D9608A51

Function 002F6F8B Relevance: 6.3, APIs: 4, Instructions: 337COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 002F7018

Memory Dump Source

Source File: 00000000.00000002.2327396657.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2327325918.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327440148.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000353000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327642561.000000000035B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327726483.000000000035D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327798505.000000000035E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_tsle.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 73a682c04488d03bb868e28af8cc8ad1dd09ed24c144cbd11a94aa6d5da18c07
Instruction ID: b48c39abd383fcd5c739d009371e6b1f2a7ba3687fe514b0bb7e04f263dff693
Opcode Fuzzy Hash: 73a682c04488d03bb868e28af8cc8ad1dd09ed24c144cbd11a94aa6d5da18c07
Instruction Fuzzy Hash: 49B18C7292824A9FDB11CF68C881BFEFBA5EF55380F14417AEA04AB341C635DD15CBA0

Function 002E812C Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 002E8138
IsDebuggerPresent.KERNEL32 ref: 002E8204
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 002E821D
UnhandledExceptionFilter.KERNEL32(?), ref: 002E8227

Memory Dump Source

Source File: 00000000.00000002.2327396657.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2327325918.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327440148.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000353000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327642561.000000000035B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327726483.000000000035D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327798505.000000000035E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_tsle.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: ebb079dbbc6509a67047ccadea845f13a08d3fa368de84427a1e164d2f388b0d
Instruction ID: 129cbc83179771594d687b6cb228bc0260a6b8b5c3c77c4f75f52cf622d5e36d
Opcode Fuzzy Hash: ebb079dbbc6509a67047ccadea845f13a08d3fa368de84427a1e164d2f388b0d
Instruction Fuzzy Hash: B33127B5C1521D9BDB21DFA5D849BCDBBB8BF08700F5041EAE40CAB250EB709A85CF44

Function 002E1E5D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 187COMMON

Download Yara Rule

APIs

Part of subcall function 002E49D4: __EH_prolog3_catch.LIBCMT ref: 002E49DB

_Deallocate.LIBCONCRT ref: 002E2038
_Deallocate.LIBCONCRT ref: 002E2085

Strings

Current val: %d, xrefs: 002E2011

Memory Dump Source

Source File: 00000000.00000002.2327396657.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2327325918.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327440148.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000353000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327642561.000000000035B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327726483.000000000035D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327798505.000000000035E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_tsle.jbxd

Yara matches

Similarity

API ID: Deallocate$H_prolog3_catch
String ID: Current val: %d
API String ID: 1212816977-1825967858
Opcode ID: 5acde3a159dbf7f2cdbf1735d6544bf42e6b06609ec71456b74960e25820725f
Instruction ID: 3c0531c78cc961883d382ac64bcf7ccc55db60ad840eb0724a1c694feb61ef6f
Opcode Fuzzy Hash: 5acde3a159dbf7f2cdbf1735d6544bf42e6b06609ec71456b74960e25820725f
Instruction Fuzzy Hash: 7161BD7252C3958FC320DF2AD48026BFBE0AFD9714F540A2EF9D893242D735E9148B92

Function 002FE46B Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 002F4BE8: GetLastError.KERNEL32(?,?,002EC68D,0030E7B0,0000000C), ref: 002F4BEC
Part of subcall function 002F4BE8: SetLastError.KERNEL32(00000000), ref: 002F4C8E

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 002FE4BF
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 002FE509
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 002FE5CF

Memory Dump Source

Source File: 00000000.00000002.2327396657.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2327325918.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327440148.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000353000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327642561.000000000035B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327726483.000000000035D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327798505.000000000035E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_tsle.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: df2f91eb626b2f7195d1ef2ce058663d348e9a7a64ca0ca1146f4ee8fa1a6624
Instruction ID: abc8d1ce14f9765aefdfdfc1486f2514f450d3a9e54ce640e6856a31ae8f5572
Opcode Fuzzy Hash: df2f91eb626b2f7195d1ef2ce058663d348e9a7a64ca0ca1146f4ee8fa1a6624
Instruction Fuzzy Hash: 7A61B27152010F9FEF2A9F24CC92BBAB7A8EF24384F114075EA05C61A1E774D961DB50

Function 002EF48F Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 002EF587
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 002EF591
UnhandledExceptionFilter.KERNEL32(-00000327,?,?,?,?,?,00000000), ref: 002EF59E

Memory Dump Source

Source File: 00000000.00000002.2327396657.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2327325918.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327440148.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000353000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327642561.000000000035B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327726483.000000000035D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327798505.000000000035E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_tsle.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 8008cfafde9b72b27f343c680ea38d8857105caf8a1d6880a368318dea397244
Instruction ID: c8b7abf5a465384503a901b03ac4f6d4d642f68f49d2d8d0c7dab50b29b6f087
Opcode Fuzzy Hash: 8008cfafde9b72b27f343c680ea38d8857105caf8a1d6880a368318dea397244
Instruction Fuzzy Hash: 1931E5B595122CABCB61DF25DD8979DBBB8BF08710F9041EAE40CA7290E7709F918F44

Function 002F09C0 Relevance: 3.4, APIs: 2, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2327396657.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2327325918.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327440148.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000353000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327642561.000000000035B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327726483.000000000035D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327798505.000000000035E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_tsle.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a2ed874dd039fb99ba0995024d5b716009da065a725364f659ae0cd17c68c55
Instruction ID: 2db25457ddf993097f266743749c5132aa06b003866b751602663a7424dfe823
Opcode Fuzzy Hash: 3a2ed874dd039fb99ba0995024d5b716009da065a725364f659ae0cd17c68c55
Instruction Fuzzy Hash: 77F13D71E1021A9FDF14CFA8D8C0AADFBB1EF88354F158269E919A7395D730AD11CB90

Function 002FA89F Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,002FA89A,?,?,00000008,?,?,00303F50,00000000), ref: 002FAACC

Memory Dump Source

Source File: 00000000.00000002.2327396657.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2327325918.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327440148.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000353000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327642561.000000000035B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327726483.000000000035D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327798505.000000000035E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_tsle.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 710d76a641c5e54840b133020be1e03ca3211f5a55f3b13a20acad2349202dac
Instruction ID: 008194a9af3183afe7b32ec28763302880d9ca45cffd59c64300e153689e21c3
Opcode Fuzzy Hash: 710d76a641c5e54840b133020be1e03ca3211f5a55f3b13a20acad2349202dac
Instruction Fuzzy Hash: 77B17D71220609CFD715CF28C486B64BBE1FF053A4F258668E99ACF2A1C375E9A1CB41

Function 002E7A95 Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 002E7AAB

Memory Dump Source

Source File: 00000000.00000002.2327396657.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2327325918.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327440148.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000353000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327642561.000000000035B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327726483.000000000035D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327798505.000000000035E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_tsle.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: b60ab54c0032ab4fc7b9735a9e49e135edaf36ef86d0559ac5df56fc4036e730
Instruction ID: 4c60d0200cac96dc9d775182dc16490fc4c0b7da98e986835b6a6b44bd7800ee
Opcode Fuzzy Hash: b60ab54c0032ab4fc7b9735a9e49e135edaf36ef86d0559ac5df56fc4036e730
Instruction Fuzzy Hash: 7CA1ADB5E5460A9FDB1ECF65D8826ADBBF5FB48314F14852AD411E7360C3B89980CFA0

Function 002FB69F Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2327396657.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2327325918.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327440148.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000353000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327642561.000000000035B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327726483.000000000035D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327798505.000000000035E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_tsle.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ad703dd2f0920a499fe1c651469cc11e683fc0d9617ea7a9e7e0d490a93dd35
Instruction ID: 5dd9994f49dfcef9cb883376b44bc0093260425022178533dc460b449a6b2dbe
Opcode Fuzzy Hash: 3ad703dd2f0920a499fe1c651469cc11e683fc0d9617ea7a9e7e0d490a93dd35
Instruction Fuzzy Hash: 5741C1B580521DAEDF21DF69CC89ABAFBBCAF49340F1442E9E519D3201DB319E948F50

Function 002FE6BE Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 002F4BE8: GetLastError.KERNEL32(?,?,002EC68D,0030E7B0,0000000C), ref: 002F4BEC
Part of subcall function 002F4BE8: SetLastError.KERNEL32(00000000), ref: 002F4C8E

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 002FE712

Memory Dump Source

Source File: 00000000.00000002.2327396657.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2327325918.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327440148.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000353000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327642561.000000000035B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327726483.000000000035D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327798505.000000000035E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_tsle.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 05b62d4a44b71db03f84ec53708e2d9e0ca8de602a5e499f6142fefef8020748
Instruction ID: 7deecde96d296538b3b6ed8b831c38b5cd2bb5e3ae17ec6aa0d737eaa5a36d6e
Opcode Fuzzy Hash: 05b62d4a44b71db03f84ec53708e2d9e0ca8de602a5e499f6142fefef8020748
Instruction Fuzzy Hash: 2321B37252520EABEF1ABE25DC52A7AF7ACEF44384F11007AFA01C7151EB74ED208B50

Function 002FE345 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 002F4BE8: GetLastError.KERNEL32(?,?,002EC68D,0030E7B0,0000000C), ref: 002F4BEC
Part of subcall function 002F4BE8: SetLastError.KERNEL32(00000000), ref: 002F4C8E

EnumSystemLocalesW.KERNEL32(002FE46B,00000001,00000000,?,-00000050,?,002FEA9C,00000000,?,?,?,00000055,?), ref: 002FE3B7

Memory Dump Source

Source File: 00000000.00000002.2327396657.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2327325918.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327440148.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000353000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327642561.000000000035B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327726483.000000000035D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327798505.000000000035E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_tsle.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 9a9c0d402293bf478cf2c393b4244077a3c3b61114df8dc95fd191048f3d2538
Instruction ID: 4ccbb22046b47521b4762c732459f6b0128a65f540598af97c7f0fb53d5af2f2
Opcode Fuzzy Hash: 9a9c0d402293bf478cf2c393b4244077a3c3b61114df8dc95fd191048f3d2538
Instruction Fuzzy Hash: D411063A2147099FDF189F39C8956BAF791FB80398B15443DEA4747A50D771A852CB40

Function 002FE8ED Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 002F4BE8: GetLastError.KERNEL32(?,?,002EC68D,0030E7B0,0000000C), ref: 002F4BEC
Part of subcall function 002F4BE8: SetLastError.KERNEL32(00000000), ref: 002F4C8E

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,002FE687,00000000,00000000,?), ref: 002FE919

Memory Dump Source

Source File: 00000000.00000002.2327396657.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2327325918.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327440148.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000353000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327642561.000000000035B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327726483.000000000035D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327798505.000000000035E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_tsle.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: e7bfaa34bdc02ea35149fd4e4a8fa307f88df809009ea2c57fed1a2a825dfde2
Instruction ID: 2c7742ae13f4f58d744e6f107996af63adbf4afec865580097bd621926ddcbb7
Opcode Fuzzy Hash: e7bfaa34bdc02ea35149fd4e4a8fa307f88df809009ea2c57fed1a2a825dfde2
Instruction Fuzzy Hash: 6DF0F93752021B7BDF295B20C8057BBB7A8EB40394F064438EE05A3290DAB0FD11C6A0

Function 002FE3E0 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 002F4BE8: GetLastError.KERNEL32(?,?,002EC68D,0030E7B0,0000000C), ref: 002F4BEC
Part of subcall function 002F4BE8: SetLastError.KERNEL32(00000000), ref: 002F4C8E

EnumSystemLocalesW.KERNEL32(002FE6BE,00000001,?,?,-00000050,?,002FEA60,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 002FE42A

Memory Dump Source

Source File: 00000000.00000002.2327396657.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2327325918.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327440148.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000353000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327642561.000000000035B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327726483.000000000035D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327798505.000000000035E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_tsle.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: d53aeff8afb788b750edb6c2f64a9713fdef7f6afd3f2501207b5428a13d0a47
Instruction ID: 408fd694e38c1bd8952b7ed3b47b724e9ebf9074da368d6fd470e87db31a00f7
Opcode Fuzzy Hash: d53aeff8afb788b750edb6c2f64a9713fdef7f6afd3f2501207b5428a13d0a47
Instruction Fuzzy Hash: 18F0C8362103095FDF155F35D89167AFB95EF81398B06843DFA0547690C6B1AC12DB50

Function 002F5169 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 002EF7DD: EnterCriticalSection.KERNEL32(?,?,002F48C0,?,0030EAA0,00000008,002F4A84,?,?,?), ref: 002EF7EC

EnumSystemLocalesW.KERNEL32(002F515C,00000001,0030EB40,0000000C,002F556E,00000000), ref: 002F51A1

Memory Dump Source

Source File: 00000000.00000002.2327396657.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2327325918.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327440148.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000353000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327642561.000000000035B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327726483.000000000035D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327798505.000000000035E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_tsle.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 2e274cd1cf0939287d506736b91d58544d7b1a85cc47cc165d7cdad2663e7d88
Instruction ID: ea7ffd437369ead04270cfa318e82af949c1422053b2c491cf04fbb8bf8696a1
Opcode Fuzzy Hash: 2e274cd1cf0939287d506736b91d58544d7b1a85cc47cc165d7cdad2663e7d88
Instruction Fuzzy Hash: F7F0A932A10204DFDB05EF98E842B9DB7F0EB0A721F10402AF5019B2E0CBB559108F40

Function 002FE2FA Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 002F4BE8: GetLastError.KERNEL32(?,?,002EC68D,0030E7B0,0000000C), ref: 002F4BEC
Part of subcall function 002F4BE8: SetLastError.KERNEL32(00000000), ref: 002F4C8E

EnumSystemLocalesW.KERNEL32(002FE253,00000001,?,?,?,002FEABE,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 002FE331

Memory Dump Source

Source File: 00000000.00000002.2327396657.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2327325918.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327440148.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000353000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327642561.000000000035B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327726483.000000000035D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327798505.000000000035E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_tsle.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 40cc7842d1fa29bd9590e0a8d4aba0a19d51eb01c8f5dc9f1a67e78af333a2b9
Instruction ID: 8b0c051370eb16c215b1c09e4179328261f3d6ca064ae3857001e68c505f2af5
Opcode Fuzzy Hash: 40cc7842d1fa29bd9590e0a8d4aba0a19d51eb01c8f5dc9f1a67e78af333a2b9
Instruction Fuzzy Hash: 26F05C3A70020957CF059F35C85577AFF54EFC2794B074069EF058B251C2719842CB90

Function 002F5672 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,002F33D9,?,20001004,00000000,00000002,?,?,002F29DB), ref: 002F56A6

Memory Dump Source

Source File: 00000000.00000002.2327396657.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2327325918.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327440148.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000353000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327642561.000000000035B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327726483.000000000035D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327798505.000000000035E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_tsle.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 6886452529b50dd8a4675f465f44de416abf4fc0ecb2d380e25cdbc93a707c15
Instruction ID: fb6a63deb91a6738a861036b2d0f6b6bcc173b363ef96be6790ffdf3e77af048
Opcode Fuzzy Hash: 6886452529b50dd8a4675f465f44de416abf4fc0ecb2d380e25cdbc93a707c15
Instruction Fuzzy Hash: 93E01A32511A2CBBCF162F61EC18AAFBF19AF48790F544021FF15652228B718930AAD4

Function 002E82B9 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000082C5,002E74D7), ref: 002E82BE

Memory Dump Source

Source File: 00000000.00000002.2327396657.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2327325918.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327440148.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000353000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327642561.000000000035B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327726483.000000000035D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327798505.000000000035E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_tsle.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 34a536f84476352bc9f2d2625c378f5d14c4ffd3800bd3054b1f6aba0e2024d7
Instruction ID: ff3cc383b39113d45e002cddfb6dd3b2877a1eff8358e26dba92b7e00685ae0f
Opcode Fuzzy Hash: 34a536f84476352bc9f2d2625c378f5d14c4ffd3800bd3054b1f6aba0e2024d7
Instruction Fuzzy Hash:

Function 002E20A5 Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

Z81xbyuAua, xrefs: 002E21C7

Memory Dump Source

Source File: 00000000.00000002.2327396657.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2327325918.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327440148.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000353000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327642561.000000000035B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327726483.000000000035D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327798505.000000000035E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_tsle.jbxd

Yara matches

Similarity

API ID:
String ID: Z81xbyuAua
API String ID: 0-3121583705
Opcode ID: 7826f1145b52b49b858ee55e116612ba74a13fc9fed7a9cfc8422c477a4d97f4
Instruction ID: fc751310c720c3cdcb050ee4ac2a26369d8a0b3f2e15d1b7b1e002d7e7091ca8
Opcode Fuzzy Hash: 7826f1145b52b49b858ee55e116612ba74a13fc9fed7a9cfc8422c477a4d97f4
Instruction Fuzzy Hash: 38413A76E3016B9BCB0CEEB9C8460AFBB69EB55310B44423ADE15DB3D1E1308B15CAD0

Function 002FEC1E Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 002FEC1E

Memory Dump Source

Source File: 00000000.00000002.2327396657.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2327325918.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327440148.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000353000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327642561.000000000035B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327726483.000000000035D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327798505.000000000035E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_tsle.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 4fef9cae08aac110dfaec7090626af261f8e3db865f56d1957a86e61ea121eda
Instruction ID: e7ba6d0d65a881e6963a69491c27088e77c57eb12ced923c57d9642f9678bda2
Opcode Fuzzy Hash: 4fef9cae08aac110dfaec7090626af261f8e3db865f56d1957a86e61ea121eda
Instruction Fuzzy Hash: D8A012301022008F83118F35591830E359C6500381B0580155400C5030D73040405F42

Function 002FDB09 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2327396657.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2327325918.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327440148.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000353000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327642561.000000000035B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327726483.000000000035D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327798505.000000000035E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_tsle.jbxd

Yara matches

Similarity

API ID: ErrorLastProcess$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 3471368781-0
Opcode ID: 90eb3953aa360f38b88fb6d3bff21c856de95efe8bfba4b98b21eb29eb257511
Instruction ID: 6da6108fee16b904528c2b795a845fec15c47f18c42442c64fafca605a8d30be
Opcode Fuzzy Hash: 90eb3953aa360f38b88fb6d3bff21c856de95efe8bfba4b98b21eb29eb257511
Instruction Fuzzy Hash: C5B1F73652070A8BDB349F25CC92BB7F3AAEF44348F54453DEB43C6580EAB5A951CB10

Function 002EDB6E Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2327396657.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2327325918.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327440148.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000353000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327642561.000000000035B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327726483.000000000035D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327798505.000000000035E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_tsle.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9669c770b5179a9b0742d1eccc6b45a5a5a091216a9141ba9ee75fe05e2c1f6
Instruction ID: 142639344b6f68772be74e4e1abe623a41545c551661eac7fdd59aed0780d9b0
Opcode Fuzzy Hash: e9669c770b5179a9b0742d1eccc6b45a5a5a091216a9141ba9ee75fe05e2c1f6
Instruction Fuzzy Hash: A4B149709B06CB8BCF24CF6AC9556BEB7B5AF05304FA40A1ED452DB291D770AD21CB41

Function 002E2323 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2327396657.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2327325918.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327440148.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000353000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327642561.000000000035B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327726483.000000000035D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327798505.000000000035E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_tsle.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e668fa540c4ba5b8be4a32224531473da99ba0f08917a1d146510994659a646d
Instruction ID: b9ed7d780e9ae2abf9bd8f998f8cbf09971723fce5c93f400e64ec982ae0ad83
Opcode Fuzzy Hash: e668fa540c4ba5b8be4a32224531473da99ba0f08917a1d146510994659a646d
Instruction Fuzzy Hash: E9F0B4706193089BE3089F54D925B9776E8EB88714F40C43EF449872E0DAB498489BD6

Function 002F69D7 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2327396657.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2327325918.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327440148.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000353000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327642561.000000000035B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327726483.000000000035D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327798505.000000000035E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_tsle.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc5a966224f34189880a35b0979aa7db2ecbbceb6724b349430649b89b6c5188
Instruction ID: b534daa61616f7dbc691897f1894f6da1dcc7f075da1081cb6dbe041ead4ed76
Opcode Fuzzy Hash: bc5a966224f34189880a35b0979aa7db2ecbbceb6724b349430649b89b6c5188
Instruction Fuzzy Hash: 0BE04632A21268EBCB14DB98890899AF2ACEB48B81B1140A6F601E3200C270DE10CBD0

Function 002F1E5D Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2327396657.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2327325918.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327440148.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000353000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327642561.000000000035B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327726483.000000000035D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327798505.000000000035E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_tsle.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44ffb9728167105a00b18984cf24fb9be2963a635071aabd26bdeb14ce6e890a
Instruction ID: 972ee95539b25616586c3430403605f61bbbd01c8f261b959ee17c4d9baffd1b
Opcode Fuzzy Hash: 44ffb9728167105a00b18984cf24fb9be2963a635071aabd26bdeb14ce6e890a
Instruction Fuzzy Hash: 24C08C380A090E86DF298D1882713B4B358EB957C2FC004ACCF130B652C62EACA2DB00

Function 0030167D Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00301336: CreateFileW.KERNEL32(?,00000000,?,00301726,?,?,00000000,?,00301726,?,0000000C), ref: 00301353

GetLastError.KERNEL32 ref: 00301791
__dosmaperr.LIBCMT ref: 00301798
GetFileType.KERNEL32(00000000), ref: 003017A4
GetLastError.KERNEL32 ref: 003017AE
__dosmaperr.LIBCMT ref: 003017B7
CloseHandle.KERNEL32(00000000), ref: 003017D7
CloseHandle.KERNEL32(002F9C98), ref: 00301924
GetLastError.KERNEL32 ref: 00301956
__dosmaperr.LIBCMT ref: 0030195D

Strings

H, xrefs: 003018E2

Memory Dump Source

Source File: 00000000.00000002.2327396657.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2327325918.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327440148.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000353000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327642561.000000000035B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327726483.000000000035D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327798505.000000000035E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_tsle.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: f58966de1a32f10e224112fbbfd4068b1b90e83366224e44c9a5c9171fb76d06
Instruction ID: 93f2ec22eb17f21e73c2e5c41cf911bc8de27401ac18dd98c093a215bf9dacd3
Opcode Fuzzy Hash: f58966de1a32f10e224112fbbfd4068b1b90e83366224e44c9a5c9171fb76d06
Instruction Fuzzy Hash: F3A15732A151589FCF1AAF68DCA1BAE7BA4AB07315F18025DF801DF2D1D7319D12CB91

Function 002F8A7A Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 298
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 002F8D0F, 002F8D12
9., xrefs: 002F8DA9

Memory Dump Source

Source File: 00000000.00000002.2327396657.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2327325918.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327440148.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000353000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327642561.000000000035B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327726483.000000000035D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327798505.000000000035E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_tsle.jbxd

Yara matches

Similarity

API ID:
String ID: $9.
API String ID: 0-3141039384
Opcode ID: 6ad056faed016ff9f7031a364fdacef374feedfd9bb6005268d7a5237df8ff48
Instruction ID: cc05801d19597a2ce97dceb4578b3be164e753587ade9f05d41a3858f06884e4
Opcode Fuzzy Hash: 6ad056faed016ff9f7031a364fdacef374feedfd9bb6005268d7a5237df8ff48
Instruction Fuzzy Hash: EEB12770A2024EAFDF15DFA9C840BBEFBB5AF59384F144169E6009B291DB709D21CF61

Function 002E7311 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 19
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 002E7317
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 002E7325
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 002E7336
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 002E7347

Strings

kernel32.dll, xrefs: 002E7312
GetCurrentPackageId, xrefs: 002E731F
GetSystemTimePreciseAsFileTime, xrefs: 002E732B
GetTempPath2W, xrefs: 002E733C

Memory Dump Source

Source File: 00000000.00000002.2327396657.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2327325918.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327440148.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000353000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327642561.000000000035B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327726483.000000000035D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327798505.000000000035E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_tsle.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: GetCurrentPackageId$GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1247241052
Opcode ID: 8b7b0e08b0d51f563ff609b3833b2379b9f66f872a4a6d93f8bc246792a21add
Instruction ID: 453b6e276c8af0c8bb5f5e9f86b6a38d710aa337f2660ea8af17e9a95e30d4bb
Opcode Fuzzy Hash: 8b7b0e08b0d51f563ff609b3833b2379b9f66f872a4a6d93f8bc246792a21add
Instruction Fuzzy Hash: 24E0B636963B20AFD3035B74BC3E99B3AACFA09706B040557F401D22B4D7B448118EE4

Function 002EADC8 Relevance: 12.6, APIs: 3, Strings: 4, Instructions: 303
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

type_info::operator==.LIBVCRUNTIME ref: 002EAEE7
___TypeMatch.LIBVCRUNTIME ref: 002EAFF5
CallUnexpected.LIBVCRUNTIME ref: 002EB162

Strings

Hc0, xrefs: 002EAEDE
csm, xrefs: 002EAE72
csm, xrefs: 002EAF1E
csm, xrefs: 002EAE05

Memory Dump Source

Source File: 00000000.00000002.2327396657.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2327325918.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327440148.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000353000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327642561.000000000035B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327726483.000000000035D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327798505.000000000035E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_tsle.jbxd

Yara matches

Similarity

API ID: CallMatchTypeUnexpectedtype_info::operator==
String ID: Hc0$csm$csm$csm
API String ID: 1206542248-2585881371
Opcode ID: 33aeddd74c7ec57ca54f240200571f2dba1f202aa9913aa7240a224fa0b34ed2
Instruction ID: 4ae9ee61f8270c8485108a532ff71e755207e979787adefedddc32ff117896d1
Opcode Fuzzy Hash: 33aeddd74c7ec57ca54f240200571f2dba1f202aa9913aa7240a224fa0b34ed2
Instruction Fuzzy Hash: 1EB1AF7186028ADFCF16DFA6C9819AFB7B5BF14310F944069F8156B212D331EA61CF92

Function 002E6F53 Relevance: 9.2, APIs: 6, Instructions: 175
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 002E6F9C
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 002E7007
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 002E7024
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 002E7063
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 002E70C2
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 002E70E5

Memory Dump Source

Source File: 00000000.00000002.2327396657.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2327325918.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327440148.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000353000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327642561.000000000035B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327726483.000000000035D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327798505.000000000035E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_tsle.jbxd

Yara matches

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: 9b3c0e6677a79c5f1c58ec193c7af41fbba4ab73549d4435b270d8c3198de732
Instruction ID: e06d118996c0e2e2817af2cea8ce80fc0bf1679b6dffacd15f58c71a7105cf4f
Opcode Fuzzy Hash: 9b3c0e6677a79c5f1c58ec193c7af41fbba4ab73549d4435b270d8c3198de732
Instruction Fuzzy Hash: 3151E272564287AFEF218F66DC48FAF7BA9EF44790F944029F905E6150D7718C20CB90

Function 002E54FA Relevance: 9.1, APIs: 6, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 002E5501
std::_Lockit::_Lockit.LIBCPMT ref: 002E550B
int.LIBCPMT ref: 002E5522

Part of subcall function 002E176A: std::_Lockit::_Lockit.LIBCPMT ref: 002E177B
Part of subcall function 002E176A: std::_Lockit::~_Lockit.LIBCPMT ref: 002E1795

std::_Facet_Register.LIBCPMT ref: 002E555C
std::_Lockit::~_Lockit.LIBCPMT ref: 002E557C
Concurrency::cancel_current_task.LIBCPMT ref: 002E5589

Memory Dump Source

Source File: 00000000.00000002.2327396657.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2327325918.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327440148.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000353000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327642561.000000000035B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327726483.000000000035D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327798505.000000000035E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_tsle.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: 5d5871b9372e5b62c1b2bfce28e316ff8bc72c9c80a91c9de4a0fa71514f8052
Instruction ID: 516a72ed8b6f05fbbec2456c47df11f87a1f968a4652e2cd170634e84fc2e7db
Opcode Fuzzy Hash: 5d5871b9372e5b62c1b2bfce28e316ff8bc72c9c80a91c9de4a0fa71514f8052
Instruction Fuzzy Hash: 1A11DF759707A59FCB11EF66C8057AEB7B9AF40324FA0041AF405A7291DFB09E118FD0

Function 002EAA5A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,002EAA51,002E8FFD,002E8309), ref: 002EAA68
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 002EAA76
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 002EAA8F
SetLastError.KERNEL32(00000000,002EAA51,002E8FFD,002E8309), ref: 002EAAE1

Memory Dump Source

Source File: 00000000.00000002.2327396657.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2327325918.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327440148.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000353000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327642561.000000000035B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327726483.000000000035D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327798505.000000000035E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_tsle.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 4788291e4cade1c504b2a897e442ab275d30d130a5ccb86ae6a84f2b97e88d4d
Instruction ID: 65de2e42f2b08bfe3d9c2e37c9814e3eaab2c93375cdeec7f546d4cb8b223d4a
Opcode Fuzzy Hash: 4788291e4cade1c504b2a897e442ab275d30d130a5ccb86ae6a84f2b97e88d4d
Instruction Fuzzy Hash: 1E0168321BD3432EE61B2A76BE826AB27A8EF05770F70423AF000492E0EF801C64D641

Function 002F1E7F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,6E837F14,?,?,00000000,00304A0E,000000FF,?,002F1E0F,00000002,?,002F1DE3,002EF896), ref: 002F1EB4
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 002F1EC6
FreeLibrary.KERNEL32(00000000,?,?,00000000,00304A0E,000000FF,?,002F1E0F,00000002,?,002F1DE3,002EF896), ref: 002F1EE8

Strings

mscoree.dll, xrefs: 002F1EAD
CorExitProcess, xrefs: 002F1EBE

Memory Dump Source

Source File: 00000000.00000002.2327396657.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2327325918.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327440148.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000353000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327642561.000000000035B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327726483.000000000035D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327798505.000000000035E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_tsle.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 3cb1426ad175411338d6ec0f27ba330b0e1640d98e481dcbae8f37cc3e8853bc
Instruction ID: 6505aceedd5083c00e854cf767cc8423675da981ca156fbbe51e9726c9d0cfa4
Opcode Fuzzy Hash: 3cb1426ad175411338d6ec0f27ba330b0e1640d98e481dcbae8f37cc3e8853bc
Instruction Fuzzy Hash: 5001A235A11619EBCB168F54DC19BFFBBBCFB44B50F000626F811A26D0DBB49900CE90

Function 002E716C Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 002E7180
AcquireSRWLockExclusive.KERNEL32(?), ref: 002E719F
AcquireSRWLockExclusive.KERNEL32(?), ref: 002E71CD
TryAcquireSRWLockExclusive.KERNEL32(?), ref: 002E7228
TryAcquireSRWLockExclusive.KERNEL32(?), ref: 002E723F

Memory Dump Source

Source File: 00000000.00000002.2327396657.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2327325918.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327440148.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000353000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327642561.000000000035B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327726483.000000000035D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327798505.000000000035E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_tsle.jbxd

Yara matches

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: 05b39aa1c3fd694670545c1f60f06f311d84b192742bccaf6ccd6ad9f18436ca
Instruction ID: c599ce5222bf94c36f8346d2f506e0bbf35818df601d41c338dc0560005780f4
Opcode Fuzzy Hash: 05b39aa1c3fd694670545c1f60f06f311d84b192742bccaf6ccd6ad9f18436ca
Instruction Fuzzy Hash: F24160709A8787DBCB20CF66C49196AB3F4FF08350B90496AE956D7640D330E9A5CF50

Function 002E381B Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 002E3827
int.LIBCPMT ref: 002E383A

Part of subcall function 002E176A: std::_Lockit::_Lockit.LIBCPMT ref: 002E177B
Part of subcall function 002E176A: std::_Lockit::~_Lockit.LIBCPMT ref: 002E1795

std::_Facet_Register.LIBCPMT ref: 002E386D
std::_Lockit::~_Lockit.LIBCPMT ref: 002E3883
Concurrency::cancel_current_task.LIBCPMT ref: 002E388E

Memory Dump Source

Source File: 00000000.00000002.2327396657.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2327325918.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327440148.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000353000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327642561.000000000035B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327726483.000000000035D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327798505.000000000035E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_tsle.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 30f4d803a02668f7fbb17f6cd5f9300b30f9d56f952deb04ab8c9caff431e858
Instruction ID: 0d22e3146ca8d2f8081d1ed741ed9819c79412dcd97f8c9ac1e486c9f349a3f7
Opcode Fuzzy Hash: 30f4d803a02668f7fbb17f6cd5f9300b30f9d56f952deb04ab8c9caff431e858
Instruction Fuzzy Hash: AF01F772960254BBCB19EB66DC0599E7768EF40760F91016DF5059B290EB30AF61CBC0

Function 002E3EDB Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 002E3EE7
int.LIBCPMT ref: 002E3EFA

Part of subcall function 002E176A: std::_Lockit::_Lockit.LIBCPMT ref: 002E177B
Part of subcall function 002E176A: std::_Lockit::~_Lockit.LIBCPMT ref: 002E1795

std::_Facet_Register.LIBCPMT ref: 002E3F2D
std::_Lockit::~_Lockit.LIBCPMT ref: 002E3F43
Concurrency::cancel_current_task.LIBCPMT ref: 002E3F4E

Memory Dump Source

Source File: 00000000.00000002.2327396657.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2327325918.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327440148.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000353000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327642561.000000000035B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327726483.000000000035D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327798505.000000000035E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_tsle.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: c7137da80bf506b3395d0e4ea445819618bd808f4b5b8e5f89f7c33827f94f41
Instruction ID: 41f35e52082d0a4e0c7de7a2240f12080441d21ce6538e839389664d2860da1c
Opcode Fuzzy Hash: c7137da80bf506b3395d0e4ea445819618bd808f4b5b8e5f89f7c33827f94f41
Instruction Fuzzy Hash: 2201F732960155ABCB15FB56DC059DDB778EF80B20B910199F9019B295EB30DF61CB90

Function 002E47E1 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 002E47ED
int.LIBCPMT ref: 002E4800

Part of subcall function 002E176A: std::_Lockit::_Lockit.LIBCPMT ref: 002E177B
Part of subcall function 002E176A: std::_Lockit::~_Lockit.LIBCPMT ref: 002E1795

std::_Facet_Register.LIBCPMT ref: 002E4833
std::_Lockit::~_Lockit.LIBCPMT ref: 002E4849
Concurrency::cancel_current_task.LIBCPMT ref: 002E4854

Memory Dump Source

Source File: 00000000.00000002.2327396657.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2327325918.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327440148.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000353000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327642561.000000000035B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327726483.000000000035D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327798505.000000000035E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_tsle.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 79c78937f874948051c0ba7e8236da7c75f4f8049c1b8bcc4e5f86270b3f71ab
Instruction ID: 40f72652b13c679d8806a945e30be1052012d05d8679dc51dd19bc8e77c0438e
Opcode Fuzzy Hash: 79c78937f874948051c0ba7e8236da7c75f4f8049c1b8bcc4e5f86270b3f71ab
Instruction Fuzzy Hash: FE012B32960194ABCB15FF56CC059ED77ACEF80760F900119F415AB291DB309E21CBC0

Function 002E5182 Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 002E5189
std::_Lockit::_Lockit.LIBCPMT ref: 002E5194
std::_Lockit::~_Lockit.LIBCPMT ref: 002E5202

Part of subcall function 002E52E5: std::locale::_Locimp::_Locimp.LIBCPMT ref: 002E52FD

std::locale::_Setgloballocale.LIBCPMT ref: 002E51AF
_Yarn.LIBCPMT ref: 002E51C5

Memory Dump Source

Source File: 00000000.00000002.2327396657.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2327325918.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327440148.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000353000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327642561.000000000035B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327726483.000000000035D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327798505.000000000035E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_tsle.jbxd

Yara matches

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: 5846b12102855c7211872c26705f75daefe0df7050864c67e51469fbc5e4d3b8
Instruction ID: bf375a6a61217920558a981628b36afa56baa46852dbac72f76cdc1f044ff1a9
Opcode Fuzzy Hash: 5846b12102855c7211872c26705f75daefe0df7050864c67e51469fbc5e4d3b8
Instruction Fuzzy Hash: 6F01DF75AA0AA59BCB0AEF22CC5567DBB65FF84308F944009E80257391CF74AE12CFC1

Function 002EBBA2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000011,00000000,00000800,?,002EBB53,00000000,00000001,0035D264,?,?,?,002EBCF6,00000004,InitializeCriticalSectionEx,00306E18,InitializeCriticalSectionEx), ref: 002EBBAF
GetLastError.KERNEL32(?,002EBB53,00000000,00000001,0035D264,?,?,?,002EBCF6,00000004,InitializeCriticalSectionEx,00306E18,InitializeCriticalSectionEx,00000000,?,002EBAAD), ref: 002EBBB9
LoadLibraryExW.KERNEL32(00000011,00000000,00000000,?,00000011,002EA9C3), ref: 002EBBE1

Strings

api-ms-, xrefs: 002EBBC6

Memory Dump Source

Source File: 00000000.00000002.2327396657.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2327325918.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327440148.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000353000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327642561.000000000035B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327726483.000000000035D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327798505.000000000035E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_tsle.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: a35570980f80d2cb39a3ff0cb644e514218b3af77e12a335467d3528aa26fbef
Instruction ID: c0f1c823f4cc62ad78e2e6a05489683d1cfb2a27eaa552ad0b45019952a09aa8
Opcode Fuzzy Hash: a35570980f80d2cb39a3ff0cb644e514218b3af77e12a335467d3528aa26fbef
Instruction Fuzzy Hash: AAE01234295209B7EE221F61DC16B5A7E59AB01B45F500025FE4CA80E5D7A1A82489C4

Function 002F5B3C Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(6E837F14,00000000,00000000,?), ref: 002F5B9F

Part of subcall function 002FB040: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,002FA40B,?,00000000,-00000008), ref: 002FB0EC

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 002F5DFA
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 002F5E42
GetLastError.KERNEL32 ref: 002F5EE5

Memory Dump Source

Source File: 00000000.00000002.2327396657.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2327325918.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327440148.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000353000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327642561.000000000035B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327726483.000000000035D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327798505.000000000035E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_tsle.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: e0f729448433c121d128a0680f4cdb3e13d1d7368f0e376c59fe69e2d809b77b
Instruction ID: 296232929c1b392e1a587fcedf70e583374d79e6e62999b62d94af8116806448
Opcode Fuzzy Hash: e0f729448433c121d128a0680f4cdb3e13d1d7368f0e376c59fe69e2d809b77b
Instruction Fuzzy Hash: 23D17975D106689FCF15CFA8C8809ADFBB8FF09344F18456AEA16EB251E730A952CF50

Function 002EAB71 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 002EAC38
___AdjustPointer.LIBCMT ref: 002EAC5B
___AdjustPointer.LIBCMT ref: 002EACF7

Memory Dump Source

Source File: 00000000.00000002.2327396657.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2327325918.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327440148.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000353000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327642561.000000000035B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327726483.000000000035D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327798505.000000000035E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_tsle.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 77f8808d9fd17000a63e9a6a53643f3f53f60a6cda5d8838c2bef939320c7ae5
Instruction ID: 4103eb177e5930a96b13bc14018aacb16d8c3c4905dedcf40b6165d6845fe67a
Opcode Fuzzy Hash: 77f8808d9fd17000a63e9a6a53643f3f53f60a6cda5d8838c2bef939320c7ae5
Instruction Fuzzy Hash: CE5118726A12879FEB298F12D841BBA77A5FF00310FA4452EE84647690D731FC60DB92

Function 002FB45C Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 002FB040: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,002FA40B,?,00000000,-00000008), ref: 002FB0EC

GetLastError.KERNEL32 ref: 002FB4C0
__dosmaperr.LIBCMT ref: 002FB4C7
GetLastError.KERNEL32(?,?,?,?), ref: 002FB501
__dosmaperr.LIBCMT ref: 002FB508

Memory Dump Source

Source File: 00000000.00000002.2327396657.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2327325918.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327440148.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000353000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327642561.000000000035B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327726483.000000000035D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327798505.000000000035E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_tsle.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 12cf5090c6bdcf5a1c2ce5114b74460a0246c1c1bd9135d6ebc6dc16f030658b
Instruction ID: 3f956a27f1d627c7999f89223ebbb1e31c683859a3486932a244ec0c779945fb
Opcode Fuzzy Hash: 12cf5090c6bdcf5a1c2ce5114b74460a0246c1c1bd9135d6ebc6dc16f030658b
Instruction Fuzzy Hash: 8A21D37162021EAF9B22AF62C99183BF7ACEF043A0B508539FA1597141D774EC208F90

Function 002F1236 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2327396657.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2327325918.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327440148.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000353000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327642561.000000000035B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327726483.000000000035D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327798505.000000000035E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_tsle.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b786a7e8f9cffab32ffd6003287d1a24a2415dd6b54d7d9a82f5046422dedd0
Instruction ID: 52d4b16df73f93b18a090011a6452cb582c094dbe1bb436bcb721c87f337ecbf
Opcode Fuzzy Hash: 4b786a7e8f9cffab32ffd6003287d1a24a2415dd6b54d7d9a82f5046422dedd0
Instruction Fuzzy Hash: 08217C3162026EEFDB10AFA6DC8097AF7A9AF003A4B904535FE15D7550EB70EC308B90

Function 002FC40B Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 002FC413

Part of subcall function 002FB040: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,002FA40B,?,00000000,-00000008), ref: 002FB0EC

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 002FC44B
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 002FC46B

Memory Dump Source

Source File: 00000000.00000002.2327396657.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2327325918.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327440148.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000353000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327642561.000000000035B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327726483.000000000035D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327798505.000000000035E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_tsle.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 4ad5237de5fb7483a77e1dbc32d70968923fa485cf63fd586bdb446123b1755f
Instruction ID: 6329897c8d7792e69d6841bf19896499d72f3bc660d418125c739f714a4aa45a
Opcode Fuzzy Hash: 4ad5237de5fb7483a77e1dbc32d70968923fa485cf63fd586bdb446123b1755f
Instruction Fuzzy Hash: CC1166B1922A1D7FAB122B719D99D7FE96CDE453E97200035F701D1101FA64DD208DB0

Function 00302A71 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,?,00000000,00000000,?,002FF500,00000000,00000001,00000000,?,?,002F5F39,?,00000000,00000000), ref: 00302A88
GetLastError.KERNEL32(?,002FF500,00000000,00000001,00000000,?,?,002F5F39,?,00000000,00000000,?,?,?,002F64F7,00000000), ref: 00302A94

Part of subcall function 00302A5A: CloseHandle.KERNEL32(FFFFFFFE,00302AA4,?,002FF500,00000000,00000001,00000000,?,?,002F5F39,?,00000000,00000000,?,?), ref: 00302A6A

___initconout.LIBCMT ref: 00302AA4

Part of subcall function 00302A1C: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00302A4B,002FF4ED,?,?,002F5F39,?,00000000,00000000,?), ref: 00302A2F

WriteConsoleW.KERNEL32(00000000,?,?,00000000,?,002FF500,00000000,00000001,00000000,?,?,002F5F39,?,00000000,00000000,?), ref: 00302AB9

Memory Dump Source

Source File: 00000000.00000002.2327396657.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2327325918.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327440148.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000353000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327642561.000000000035B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327726483.000000000035D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327798505.000000000035E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_tsle.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: f4f1f0d005feb19ac94589b236098ddea54c87f7ce23f10d7bcabd0cc79fad3e
Instruction ID: c708942ba3f6391c16c9d066e9c7e9375219954e8c3648ac01d7c799b27f040a
Opcode Fuzzy Hash: f4f1f0d005feb19ac94589b236098ddea54c87f7ce23f10d7bcabd0cc79fad3e
Instruction Fuzzy Hash: 45F0AC36642514BBCF232F95DC2899F7F6AEB083A1F158011FE199A162CE7289609BD1

Function 00302F75 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 155fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

SetEndOfFile.KERNEL32(00000000,003015CB,00000000,002F9C98,?,?,?,?,?,00302F63,00000000,002F9C98,003015CB,?,00000000,002F9C98), ref: 003030C7
GetLastError.KERNEL32(?,?,?,?,?,00302F63,00000000,002F9C98,003015CB,?,00000000,002F9C98), ref: 003030D4

Strings

c/0, xrefs: 00302FB3, 00303004, 00303021

Memory Dump Source

Source File: 00000000.00000002.2327396657.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2327325918.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327440148.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000353000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327642561.000000000035B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327726483.000000000035D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327798505.000000000035E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_tsle.jbxd

Yara matches

Similarity

API ID: ErrorFileLast
String ID: c/0
API String ID: 734332943-2165679274
Opcode ID: 9ee584fe8db242cce237ea73a63b93def081deb10d4a26d530a02c1571cfabc6
Instruction ID: 9d1684598c64afd4dd40dadf6d2984f65ab5da1f9a38a573b205733dd4646828
Opcode Fuzzy Hash: 9ee584fe8db242cce237ea73a63b93def081deb10d4a26d530a02c1571cfabc6
Instruction Fuzzy Hash: D5513331903609ABEB268F69CC25BAFBB79EF44320F140118F512A75D1D771EA90CB90

Function 002E3D18 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 002E3D1F
_strlen.LIBCMT ref: 002E3D37

Strings

sAIUOshuygAUIYsA, xrefs: 002E3D32, 002E3DFD

Memory Dump Source

Source File: 00000000.00000002.2327396657.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2327325918.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327440148.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000353000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327642561.000000000035B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327726483.000000000035D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327798505.000000000035E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_tsle.jbxd

Yara matches

Similarity

API ID: H_prolog3_catch_strlen
String ID: sAIUOshuygAUIYsA
API String ID: 3133806014-2251130508
Opcode ID: 91f58baa42472b0f8ced78bfa3adb050715425b1744b13e89ed7c98a17e413a1
Instruction ID: e883285e7f47b918e66274d2e9a03aaa7a462014964a9e234f3321cedee86768
Opcode Fuzzy Hash: 91f58baa42472b0f8ced78bfa3adb050715425b1744b13e89ed7c98a17e413a1
Instruction Fuzzy Hash: B941F531A713858FCB11DF5AC8888AC7BF1BF89726B685256E0249B2E1C7704E62CF50

Function 002EA860 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 002EA89F
__IsNonwritableInCurrentImage.LIBCMT ref: 002EA953

Strings

csm, xrefs: 002EA93D

Memory Dump Source

Source File: 00000000.00000002.2327396657.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2327325918.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327440148.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000353000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327642561.000000000035B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327726483.000000000035D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327798505.000000000035E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_tsle.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: c98364faf17c5292c33a2f99e48bef6899bb602fe3bc6c4f15b88e4866cb2efa
Instruction ID: bc27510c4bd6b7bf5ea56d47f3affcf2edf8c7c65033e4019a4ed11da63e0a29
Opcode Fuzzy Hash: c98364faf17c5292c33a2f99e48bef6899bb602fe3bc6c4f15b88e4866cb2efa
Instruction Fuzzy Hash: 2C412634A202899BCF11DF2AC881AAEBBF4AF05314F558055F8195B392C731AE65CF92

Function 002EB16D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 002EB192

Strings

MOC, xrefs: 002EB1A4
RCC, xrefs: 002EB1AC

Memory Dump Source

Source File: 00000000.00000002.2327396657.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2327325918.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327440148.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000353000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327642561.000000000035B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327726483.000000000035D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327798505.000000000035E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_tsle.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: c26b1dc3993096f564f8efde4be90024e25738ea6ee0928f79c375d02e09cfd7
Instruction ID: 8ffe09490100a5c11129916de0c5fc5cb3c8affc9edc87ea59d688c67d98fc4d
Opcode Fuzzy Hash: c26b1dc3993096f564f8efde4be90024e25738ea6ee0928f79c375d02e09cfd7
Instruction Fuzzy Hash: 3541687194024AAFCF16DF95CD81AEEBBB5BF48300F588059FE08AB211D335A960DF51

Function 002E1695 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 002E169C
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 002E16D4

Part of subcall function 002E5280: _Yarn.LIBCPMT ref: 002E529F
Part of subcall function 002E5280: _Yarn.LIBCPMT ref: 002E52C3

Strings

bad locale name, xrefs: 002E16E2

Memory Dump Source

Source File: 00000000.00000002.2327396657.00000000002E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2327325918.00000000002E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327440148.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000310000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327461592.0000000000353000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327642561.000000000035B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327726483.000000000035D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2327798505.000000000035E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_tsle.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: f95498ff65b16130169fc6ced99326d3c6894ef937cee1b2c7d73dac6f16e978
Instruction ID: ed1c1b6e1c34a5dba84f6bc6703320c4102bc0adf932065301ea2a024ce2ba6b
Opcode Fuzzy Hash: f95498ff65b16130169fc6ced99326d3c6894ef937cee1b2c7d73dac6f16e978
Instruction Fuzzy Hash: 02F01D72555B809E83319F7B8891443FBE4BE297103948A2EE1DEC3A11D734E514CF69

Analysis Process: MSBuild.exePID: 3572, Parent PID: 2748COMMON

Execution Graph

Execution Coverage:	8.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	76
Total number of Limit Nodes:	8

Executed Functions

Function 0101D0A8 Relevance: 6.1, APIs: 4, Instructions: 131
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0101D136
GetCurrentThread.KERNEL32 ref: 0101D173
GetCurrentProcess.KERNEL32 ref: 0101D1B0
GetCurrentThreadId.KERNEL32 ref: 0101D209

Memory Dump Source

Source File: 00000002.00000002.2203069897.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1010000_MSBuild.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 1a03be5a9198889f91d3c8ff7831761fec51606c3ba77c94ce8643ef9b89fe23
Instruction ID: d32e1289dcb2c3d79e36ea29ba8d943a28c9c4d83597bb721268bd28d657bec4
Opcode Fuzzy Hash: 1a03be5a9198889f91d3c8ff7831761fec51606c3ba77c94ce8643ef9b89fe23
Instruction Fuzzy Hash: 035156B0D012499FDB58DFAAE948BDEBFF1EF88304F208459E419A73A0D7345984CB65

Function 0101D0B8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0101D136
GetCurrentThread.KERNEL32 ref: 0101D173
GetCurrentProcess.KERNEL32 ref: 0101D1B0
GetCurrentThreadId.KERNEL32 ref: 0101D209

Memory Dump Source

Source File: 00000002.00000002.2203069897.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1010000_MSBuild.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 1815908a9ef3d3fdcab76ba4a682435a76abc9bcf4c37a816e69f650acf4f32b
Instruction ID: 405714ca29ffb17d334a87334638d36efa3304f80d46572bb77199a5477e6077
Opcode Fuzzy Hash: 1815908a9ef3d3fdcab76ba4a682435a76abc9bcf4c37a816e69f650acf4f32b
Instruction Fuzzy Hash: 1D5166B0D012499FDB18DFAAE948BDEBBF1EF88314F208459E419A73A0D7345984CB65

Function 0101AE30 Relevance: 1.7, APIs: 1, Instructions: 207
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0101B086

Memory Dump Source

Source File: 00000002.00000002.2203069897.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1010000_MSBuild.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: a66447968f0b1e7b5e15d81934a4debce0e8215ae9a4851fe6d3722af342ad12
Instruction ID: 9c99485e0d2143c30eda1e9d5700b6703d5ea6e02f35cac6aea2876065968b0f
Opcode Fuzzy Hash: a66447968f0b1e7b5e15d81934a4debce0e8215ae9a4851fe6d3722af342ad12
Instruction Fuzzy Hash: 728145B0A01B45CFD764DF69D04479ABBF1FF48304F00896EE48A97A45D738E945CB91

Function 01015935 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 010159F1

Memory Dump Source

Source File: 00000002.00000002.2203069897.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1010000_MSBuild.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: e231ffbe951982f19e80a6b88d31e09a769673ccccbacc607e7079292ee49be2
Instruction ID: 62e6766f0fb6766b64087a8ad53013e4c77aed7e5c07b5bf821928b40c6d8557
Opcode Fuzzy Hash: e231ffbe951982f19e80a6b88d31e09a769673ccccbacc607e7079292ee49be2
Instruction Fuzzy Hash: 6E41EFB1D00719CEDB24CFA9C888A8DBBB5FF89304F20805AD408AB255DB756945CF91

Function 05150BFC Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 05154381

Memory Dump Source

Source File: 00000002.00000002.2210858071.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5150000_MSBuild.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 7eda07823590b8e98ddfc318c1c1ec87b591fefffd5bbf9b0c1db54630ef4ee0
Instruction ID: 71afdf00bc8382b019e39fac97d0f10cb35c95b9f3d7ed788bfbe875c84b2cbc
Opcode Fuzzy Hash: 7eda07823590b8e98ddfc318c1c1ec87b591fefffd5bbf9b0c1db54630ef4ee0
Instruction Fuzzy Hash: 4A4117B4900315DFCB54CF99C448EAABBF5FF88324F258559E919AB321D374A885CBA0

Function 01014248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 010159F1

Memory Dump Source

Source File: 00000002.00000002.2203069897.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1010000_MSBuild.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 88c774d2884a3e6848165e42a528648c05bebff52e5c598482f0079df0f1faf3
Instruction ID: 55b85742ff8384a9901bba69f50a9461b4bc86504ac5d3bc251ef6b8635d7cd0
Opcode Fuzzy Hash: 88c774d2884a3e6848165e42a528648c05bebff52e5c598482f0079df0f1faf3
Instruction Fuzzy Hash: D141DFB1D00719CADB24CFAAC888B9DBBF5FF89304F20806AD408AB255DB756945CF91

Function 0101D300 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0101D387

Memory Dump Source

Source File: 00000002.00000002.2203069897.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1010000_MSBuild.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 95d7feadc1341de7dad6b5bbb7710423169459d10b1958b4a1bce7a627837ee6
Instruction ID: 76decb5398166ecc0cf737c018f241c7569c4c65550ea49b138bc80b2dc24167
Opcode Fuzzy Hash: 95d7feadc1341de7dad6b5bbb7710423169459d10b1958b4a1bce7a627837ee6
Instruction Fuzzy Hash: 7821E2B5D002499FDB10CFAAD884ADEFFF8EB48310F14841AE918A3310C378A954CFA1

Function 0101D2F9 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0101D387

Memory Dump Source

Source File: 00000002.00000002.2203069897.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1010000_MSBuild.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: d7db8b09ce65381e753ab00d782db3ca81b763dcb41c367b56fd195a41f318a9
Instruction ID: 69d96de72c7de86ff9929adad913b89d7e6c64a5bd0ab896616f0dd0a926411d
Opcode Fuzzy Hash: d7db8b09ce65381e753ab00d782db3ca81b763dcb41c367b56fd195a41f318a9
Instruction Fuzzy Hash: C021E2B5D002499FDB10CFAAD584ADEBFF5EB48310F14841AE918B7350D378A954CFA1

Function 0101B020 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0101B086

Memory Dump Source

Source File: 00000002.00000002.2203069897.0000000001010000.00000040.00000800.00020000.00000000.sdmp, Offset: 01010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1010000_MSBuild.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 4349bc1f89d2e827bd3f556a5d7b7dca347c0eb57105622523b6e864db9c5cde
Instruction ID: ef9f7d270d64801d2ed9b01c4279acf0f2c75d6051472e0a52e244ddc8c805db
Opcode Fuzzy Hash: 4349bc1f89d2e827bd3f556a5d7b7dca347c0eb57105622523b6e864db9c5cde
Instruction Fuzzy Hash: 1511E0B5C003498FDB20DF9AD444ADEFBF4EB88314F14845AD969B7210C379A645CFA1

Function 00F7D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2202767951.0000000000F7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f7d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf4cff2f077f99244542f7fb711df79c90ce458c9152b17df2f20e7b448c4405
Instruction ID: d43517538579577b079ebc2dfb0b2ae876b9af557ca138a7a61f28e4698fe7fe
Opcode Fuzzy Hash: cf4cff2f077f99244542f7fb711df79c90ce458c9152b17df2f20e7b448c4405
Instruction Fuzzy Hash: C72106B2504204DFDB05DF14D9C0B16BF75FF98324F64C56AD90D0B256C336E856E6A2

Function 00F7D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2202767951.0000000000F7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f7d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94983c5359cbbb158c119765da1d08ab048f97b3b0d7a047a7fcb086034112a0
Instruction ID: 6d42a2444b168c39616eb463b41eed313cc6360e9af3ca31a81f78d6851bd203
Opcode Fuzzy Hash: 94983c5359cbbb158c119765da1d08ab048f97b3b0d7a047a7fcb086034112a0
Instruction Fuzzy Hash: F52106B2904240DFDB05DF14D9C0B26BF75FF98328F68C56AD9090B256C336D816E6A2

Function 00F8D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2202810341.0000000000F8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f8d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbd981385f24d02240a3c078f705c5d9560fd20be4a54124f63c0647d302f41a
Instruction ID: 96a744ab2abc66f6a149be48c49b7358cd8d12a3a8af9fcb7ac32d497090d444
Opcode Fuzzy Hash: dbd981385f24d02240a3c078f705c5d9560fd20be4a54124f63c0647d302f41a
Instruction Fuzzy Hash: 3B21F571904244DFDB14EF14D9C4B56BB65EF84324F34C56DD84A4B28AC336D807DB61

Function 00F8D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2202810341.0000000000F8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f8d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f34a869a303de379d9c9959e40d11f601a96360e4c20394e2a63a5f9d874deb1
Instruction ID: 7eb5cbdf39b6ddd956e6c6768f2dadc3fd34b0e9ea36be0e680f980d9f4c177e
Opcode Fuzzy Hash: f34a869a303de379d9c9959e40d11f601a96360e4c20394e2a63a5f9d874deb1
Instruction Fuzzy Hash: 282183755093808FDB02DF24D594715BF71EF46314F28C5DAD8498B6A7C33A980ADB62

Function 00F7D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2202767951.0000000000F7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f7d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c71a23e6f2891b0ac880f649e89db06405e67f0af756f6891ce480dd6b8289f7
Instruction ID: 93998f7935c4c8635033bd36fcc24b586ed57f1d2e6591d3978902223e636d21
Opcode Fuzzy Hash: c71a23e6f2891b0ac880f649e89db06405e67f0af756f6891ce480dd6b8289f7
Instruction Fuzzy Hash: 42112672804240DFCB06CF00D5C4B16BF71FF94324F24C2AAD8090B656C33AE85ADBA2

Function 00F7D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2202767951.0000000000F7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f7d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c71a23e6f2891b0ac880f649e89db06405e67f0af756f6891ce480dd6b8289f7
Instruction ID: 84a7af149c0ee0ad2deb1a4f615b6767b25743e6a45ab777c30cd1229ca82026
Opcode Fuzzy Hash: c71a23e6f2891b0ac880f649e89db06405e67f0af756f6891ce480dd6b8289f7
Instruction Fuzzy Hash: 9811E976904240CFCB15CF14D5C4B16BF71FF94324F28C6AAD8490B656C336D456DB92

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report tsle.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_tsle.exe_355e8546985d9dcce4d61437496d879d61db39b_08b7ce8b_0885b6fd-cff6-4a46-b8da-29a518c74190\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2FE.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER502.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER522.tmp.xml

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MSBuild.exe.log

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Windows Analysis Report
tsle.exe

Function 002E2441 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 176
memorythreadCOMMON

Function 002F6993 Relevance: .0, Instructions: 29
COMMON

Function 002F5332 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Function 002EC7C4 Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Function 002EC668 Relevance: 3.0, APIs: 2, Instructions: 38
threadCOMMON

Function 002F53FD Relevance: 1.6, APIs: 1, Instructions: 57
COMMONLIBRARYCODE

Function 002E4B17 Relevance: 1.5, APIs: 1, Instructions: 12
COMMON

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre