Edit tour

Windows Analysis Report
RepozetorySetup.exe

Overview

General Information

Sample name:	RepozetorySetup.exe
Analysis ID:	1536511
MD5:	c731ce4e3a8ab780ed4cb4e29cca10fc
SHA1:	f1d5b853b1e74449729ae1080e1857da3da47747
SHA256:	28a5d9eb092fbde1f785336ac2a8a858ad85129ee3c0b6eb6c6fac919dc77878
Tags:	exeuser-KnownStormChaser
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected RedLine Stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE / OLE file has an invalid certificate

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

RepozetorySetup.exe (PID: 7496 cmdline: "C:\Users\user\Desktop\RepozetorySetup.exe" MD5: C731CE4E3A8AB780ED4CB4E29CCA10FC)

MSBuild.exe (PID: 7548 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

WerFault.exe (PID: 7632 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7496 -s 260 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": "185.196.9.26:6302", "Bot Id": "bMi", "Authorization Header": "83a9fa0992810d382a4f96c1ce5d018b"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1436031916.0000000000AAB000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000002.00000002.1477295401.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000002.00000002.1479189708.000000000312F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RepozetorySetup.exe PID: 7496	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 7548	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 7548	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.RepozetorySetup.exe.aab930.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.RepozetorySetup.exe.aab930.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
2.2.MSBuild.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.RepozetorySetup.exe.a90000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Suricata Signatures

ET MALWARE Redline Stealer TCP CnC - Id1Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-18T00:27:29.685072+0200	2043234	1	A Network Trojan was detected	185.196.9.26	6302	192.168.2.9	49740	TCP

ET MALWARE Redline Stealer TCP CnC Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-18T00:27:29.416175+0200	2043231	1	A Network Trojan was detected	192.168.2.9	49740	185.196.9.26	6302	TCP
2024-10-18T00:27:34.736347+0200	2043231	1	A Network Trojan was detected	192.168.2.9	49740	185.196.9.26	6302	TCP
2024-10-18T00:27:36.894844+0200	2043231	1	A Network Trojan was detected	192.168.2.9	49740	185.196.9.26	6302	TCP
2024-10-18T00:27:37.204171+0200	2043231	1	A Network Trojan was detected	192.168.2.9	49740	185.196.9.26	6302	TCP

ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-18T00:27:35.049889+0200	2046056	1	A Network Trojan was detected	185.196.9.26	6302	192.168.2.9	49740	TCP

ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-18T00:27:29.416175+0200	2046045	1	A Network Trojan was detected	192.168.2.9	49740	185.196.9.26	6302	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: RepozetorySetup.exe

Avira: detected

Found malware configuration

Source: 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: RedLine {"C2 url": "185.196.9.26:6302", "Bot Id": "bMi", "Authorization Header": "83a9fa0992810d382a4f96c1ce5d018b"}

Multi AV Scanner detection for submitted file

Source: RepozetorySetup.exe

ReversingLabs: Detection: 47%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: RepozetorySetup.exe

Joe Sandbox ML: detected

Source: RepozetorySetup.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.9:49709 version: TLS 1.2

Source: RepozetorySetup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\RepozetorySetup.exe

Code function: 0_2_00A9A88B FindFirstFileExW,

0_2_00A9A88B

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2043231 - Severity 1 - ET MALWARE Redline Stealer TCP CnC Activity : 192.168.2.9:49740 -> 185.196.9.26:6302
Source: Network traffic	Suricata IDS: 2046045 - Severity 1 - ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) : 192.168.2.9:49740 -> 185.196.9.26:6302
Source: Network traffic	Suricata IDS: 2043234 - Severity 1 - ET MALWARE Redline Stealer TCP CnC - Id1Response : 185.196.9.26:6302 -> 192.168.2.9:49740
Source: Network traffic	Suricata IDS: 2046056 - Severity 1 - ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) : 185.196.9.26:6302 -> 192.168.2.9:49740

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 185.196.9.26:6302

Source: global traffic

TCP traffic: 192.168.2.9:49740 -> 185.196.9.26:6302

Source: Joe Sandbox View

IP Address: 185.196.9.26 185.196.9.26

Source: Joe Sandbox View

ASN Name: SIMPLECARRIERCH SIMPLECARRIERCH

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.11
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.11
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.11
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.198.32
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.198.32
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240
Source: unknown	TCP traffic detected without corresponding DNS query: 93.184.221.240

Source: RepozetorySetup.exe	String found in binary or memory: http://aia.entrust.net/ts1-chain256.cer01
Source: RepozetorySetup.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: RepozetorySetup.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: RepozetorySetup.exe	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: RepozetorySetup.exe	String found in binary or memory: http://crl.entrust.net/ts1ca.crl0
Source: RepozetorySetup.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: RepozetorySetup.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: RepozetorySetup.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: RepozetorySetup.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: RepozetorySetup.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: RepozetorySetup.exe	String found in binary or memory: http://ocsp.entrust.net02
Source: RepozetorySetup.exe	String found in binary or memory: http://ocsp.entrust.net03
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rmX
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1479189708.000000000312F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: MSBuild.exe, 00000002.00000002.1479189708.000000000312F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1479189708.000000000312F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: MSBuild.exe, 00000002.00000002.1479189708.000000000312F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3ResponseD
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: Amcache.hve.5.dr	String found in binary or memory: http://upx.sf.net
Source: RepozetorySetup.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: RepozetorySetup.exe	String found in binary or memory: http://www.entrust.net/rpa03
Source: RepozetorySetup.exe, RepozetorySetup.exe, 00000000.00000002.1436031916.0000000000AAB000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1477295401.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: RepozetorySetup.exe	String found in binary or memory: https://www.entrust.net/rpa0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443

Source: unknown

HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.9:49709 version: TLS 1.2

Source: C:\Users\user\Desktop\RepozetorySetup.exe	Code function: 0_2_00AA28E0	0_2_00AA28E0
Source: C:\Users\user\Desktop\RepozetorySetup.exe	Code function: 0_2_00A99028	0_2_00A99028
Source: C:\Users\user\Desktop\RepozetorySetup.exe	Code function: 0_2_00A9E1A8	0_2_00A9E1A8
Source: C:\Users\user\Desktop\RepozetorySetup.exe	Code function: 0_2_00A91317	0_2_00A91317
Source: C:\Users\user\Desktop\RepozetorySetup.exe	Code function: 0_2_00A924D5	0_2_00A924D5
Source: C:\Users\user\Desktop\RepozetorySetup.exe	Code function: 0_2_00A9DD20	0_2_00A9DD20
Source: C:\Users\user\Desktop\RepozetorySetup.exe	Code function: 0_2_00A95F0E	0_2_00A95F0E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0538DC74	2_2_0538DC74

Source: C:\Users\user\Desktop\RepozetorySetup.exe

Code function: String function: 00A92490 appears 35 times

Source: C:\Users\user\Desktop\RepozetorySetup.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7496 -s 260

Source: RepozetorySetup.exe

Static PE information: invalid certificate

Source: RepozetorySetup.exe	Binary or memory string: OriginalFilename vs RepozetorySetup.exe
Source: RepozetorySetup.exe, 00000000.00000002.1436094996.0000000000AF6000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameLandings.exe8 vs RepozetorySetup.exe

Source: RepozetorySetup.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: RepozetorySetup.exe

Static PE information: Section: .data ZLIB complexity 0.9936242816091954

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/6@0/1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File created: C:\Users\user\AppData\Local\SystemCache

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7496

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\188251a6-dd22-42fe-8dc9-61aded32374a

Jump to behavior

Source: RepozetorySetup.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\RepozetorySetup.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RepozetorySetup.exe

ReversingLabs: Detection: 47%

Source: unknown	Process created: C:\Users\user\Desktop\RepozetorySetup.exe "C:\Users\user\Desktop\RepozetorySetup.exe"
Source: C:\Users\user\Desktop\RepozetorySetup.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\RepozetorySetup.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7496 -s 260
Source: C:\Users\user\Desktop\RepozetorySetup.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior

Source: C:\Users\user\Desktop\RepozetorySetup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: RepozetorySetup.exe

Static file information: File size 1532968 > 1048576

Source: RepozetorySetup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: RepozetorySetup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: RepozetorySetup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: RepozetorySetup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: RepozetorySetup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: RepozetorySetup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: RepozetorySetup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: RepozetorySetup.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: RepozetorySetup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: RepozetorySetup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: RepozetorySetup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: RepozetorySetup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: RepozetorySetup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\RepozetorySetup.exe	Code function: 0_2_00A915F4 push eax; ret		0_2_00A91653
Source: C:\Users\user\Desktop\RepozetorySetup.exe	Code function: 0_2_00AA2FF1 push ecx; ret		0_2_00AA3004

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 2D30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 2E80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 4E80000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 611			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 2099			Jump to behavior

Source: C:\Users\user\Desktop\RepozetorySetup.exe

API coverage: 5.3 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7864	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7868	Thread sleep count: 611 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7868	Thread sleep count: 2099 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7580	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\RepozetorySetup.exe

Code function: 0_2_00A9A88B FindFirstFileExW,

0_2_00A9A88B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: Amcache.hve.5.dr	Binary or memory string: VMware
Source: MSBuild.exe, 00000002.00000002.1481715144.00000000040D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696497155
Source: MSBuild.exe, 00000002.00000002.1481715144.00000000040D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696497155
Source: MSBuild.exe, 00000002.00000002.1481715144.0000000004203000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696497155x
Source: MSBuild.exe, 00000002.00000002.1481715144.0000000004203000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155^
Source: Amcache.hve.5.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: MSBuild.exe, 00000002.00000002.1481715144.0000000004203000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696497155h
Source: MSBuild.exe, 00000002.00000002.1481715144.0000000004203000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696497155d
Source: MSBuild.exe, 00000002.00000002.1481715144.0000000004203000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696497155\|UE
Source: MSBuild.exe, 00000002.00000002.1481715144.0000000004203000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696497155
Source: Amcache.hve.5.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: MSBuild.exe, 00000002.00000002.1481715144.0000000004203000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696497155s
Source: MSBuild.exe, 00000002.00000002.1481715144.0000000004203000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696497155f
Source: MSBuild.exe, 00000002.00000002.1481715144.0000000004203000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696497155x
Source: MSBuild.exe, 00000002.00000002.1481715144.0000000004203000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696497155
Source: MSBuild.exe, 00000002.00000002.1481715144.00000000040D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696497155
Source: MSBuild.exe, 00000002.00000002.1481715144.00000000040D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696497155x
Source: MSBuild.exe, 00000002.00000002.1481715144.00000000040D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696497155p
Source: MSBuild.exe, 00000002.00000002.1481715144.00000000040D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696497155n
Source: MSBuild.exe, 00000002.00000002.1481715144.00000000040D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696497155d
Source: Amcache.hve.5.dr	Binary or memory string: vmci.sys
Source: MSBuild.exe, 00000002.00000002.1481715144.00000000040D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696497155x
Source: MSBuild.exe, 00000002.00000002.1481715144.0000000004203000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696497155z
Source: MSBuild.exe, 00000002.00000002.1481715144.0000000004203000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696497155~
Source: MSBuild.exe, 00000002.00000002.1481715144.0000000004203000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696497155t
Source: MSBuild.exe, 00000002.00000002.1481715144.00000000040D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696497155}
Source: MSBuild.exe, 00000002.00000002.1481715144.0000000004203000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696497155t
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1
Source: MSBuild.exe, 00000002.00000002.1481715144.00000000040D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155^
Source: MSBuild.exe, 00000002.00000002.1481715144.00000000040D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696497155u
Source: MSBuild.exe, 00000002.00000002.1481715144.0000000004203000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696497155}
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.5.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.5.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: MSBuild.exe, 00000002.00000002.1481715144.00000000040D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696497155f
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.5.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: MSBuild.exe, 00000002.00000002.1481715144.0000000004203000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696497155u
Source: MSBuild.exe, 00000002.00000002.1481715144.00000000040D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696497155
Source: MSBuild.exe, 00000002.00000002.1481715144.0000000004203000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696497155
Source: Amcache.hve.5.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.5.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: MSBuild.exe, 00000002.00000002.1481715144.00000000040D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696497155z
Source: MSBuild.exe, 00000002.00000002.1481715144.00000000040D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696497155s
Source: MSBuild.exe, 00000002.00000002.1481715144.0000000004203000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696497155
Source: MSBuild.exe, 00000002.00000002.1481715144.0000000004203000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696497155n
Source: MSBuild.exe, 00000002.00000002.1481715144.00000000040D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696497155~
Source: MSBuild.exe, 00000002.00000002.1481715144.0000000004203000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696497155
Source: Amcache.hve.5.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: MSBuild.exe, 00000002.00000002.1481715144.00000000040D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696497155j
Source: MSBuild.exe, 00000002.00000002.1481715144.00000000040D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696497155t
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.5.dr	Binary or memory string: VMware, Inc.
Source: MSBuild.exe, 00000002.00000002.1481715144.0000000004203000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696497155j
Source: MSBuild.exe, 00000002.00000002.1481715144.0000000004203000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696497155o
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1hbin@
Source: MSBuild.exe, 00000002.00000002.1481715144.0000000004203000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155
Source: Amcache.hve.5.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: MSBuild.exe, 00000002.00000002.1481715144.0000000004203000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696497155p
Source: Amcache.hve.5.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: MSBuild.exe, 00000002.00000002.1481715144.00000000040D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696497155]
Source: MSBuild.exe, 00000002.00000002.1481715144.00000000040D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696497155\|UE
Source: MSBuild.exe, 00000002.00000002.1481715144.00000000040D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696497155o
Source: MSBuild.exe, 00000002.00000002.1481715144.00000000040D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155
Source: Amcache.hve.5.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: MSBuild.exe, 00000002.00000002.1481715144.00000000040D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696497155
Source: MSBuild.exe, 00000002.00000002.1478713638.00000000013EF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: MSBuild.exe, 00000002.00000002.1481715144.00000000040D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696497155h
Source: MSBuild.exe, 00000002.00000002.1481715144.00000000040D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696497155
Source: MSBuild.exe, 00000002.00000002.1481715144.0000000004203000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696497155]
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.5.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: MSBuild.exe, 00000002.00000002.1481715144.00000000040D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696497155
Source: MSBuild.exe, 00000002.00000002.1481715144.00000000040D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696497155
Source: Amcache.hve.5.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: MSBuild.exe, 00000002.00000002.1481715144.00000000040D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696497155
Source: MSBuild.exe, 00000002.00000002.1481715144.0000000004203000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696497155}
Source: Amcache.hve.5.dr	Binary or memory string: VMware-42 27 c7 3b 45 a3 e4 a4-61 bc 19 7c 28 5c 10 19
Source: Amcache.hve.5.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: MSBuild.exe, 00000002.00000002.1481715144.0000000004203000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696497155
Source: MSBuild.exe, 00000002.00000002.1481715144.0000000004203000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696497155
Source: MSBuild.exe, 00000002.00000002.1481715144.00000000040D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696497155t
Source: MSBuild.exe, 00000002.00000002.1481715144.0000000004203000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696497155x
Source: MSBuild.exe, 00000002.00000002.1481715144.0000000004203000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696497155
Source: MSBuild.exe, 00000002.00000002.1481715144.00000000040D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696497155}
Source: MSBuild.exe, 00000002.00000002.1481715144.0000000004203000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696497155
Source: MSBuild.exe, 00000002.00000002.1481715144.00000000040D3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696497155x

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\RepozetorySetup.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\RepozetorySetup.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\RepozetorySetup.exe

Code function: 0_2_00A915F4 LdrInitializeThunk,

0_2_00A915F4

Source: C:\Users\user\Desktop\RepozetorySetup.exe

Code function: 0_2_00A92240 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00A92240

Source: C:\Users\user\Desktop\RepozetorySetup.exe	Code function: 0_2_00A91659 mov edi, dword ptr fs:[00000030h]	0_2_00A91659
Source: C:\Users\user\Desktop\RepozetorySetup.exe	Code function: 0_2_00A9BAA5 mov eax, dword ptr fs:[00000030h]	0_2_00A9BAA5
Source: C:\Users\user\Desktop\RepozetorySetup.exe	Code function: 0_2_00A9771D mov ecx, dword ptr fs:[00000030h]	0_2_00A9771D

Source: C:\Users\user\Desktop\RepozetorySetup.exe

Code function: 0_2_00A9C51B GetProcessHeap,

0_2_00A9C51B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\RepozetorySetup.exe	Code function: 0_2_00A92240 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00A92240
Source: C:\Users\user\Desktop\RepozetorySetup.exe	Code function: 0_2_00A96A44 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00A96A44
Source: C:\Users\user\Desktop\RepozetorySetup.exe	Code function: 0_2_00A923CD SetUnhandledExceptionFilter,	0_2_00A923CD
Source: C:\Users\user\Desktop\RepozetorySetup.exe	Code function: 0_2_00A91D97 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00A91D97

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\RepozetorySetup.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\RepozetorySetup.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\RepozetorySetup.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\RepozetorySetup.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\RepozetorySetup.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 432000	Jump to behavior
Source: C:\Users\user\Desktop\RepozetorySetup.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 450000	Jump to behavior
Source: C:\Users\user\Desktop\RepozetorySetup.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: EF0008	Jump to behavior

Source: C:\Users\user\Desktop\RepozetorySetup.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\RepozetorySetup.exe

Code function: 0_2_00A9212D GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00A9212D

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.5.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: MsMpEng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.RepozetorySetup.exe.aab930.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RepozetorySetup.exe.aab930.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RepozetorySetup.exe.a90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1436031916.0000000000AAB000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1477295401.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RepozetorySetup.exe PID: 7496, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7548, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ElectrumE#
Source: MSBuild.exe, 00000002.00000002.1479189708.000000000312F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: q0C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: MSBuild.exe, 00000002.00000002.1479189708.00000000030F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: cjelfplplebdjjenllpjcblmjkfcffne\|JaxxxLiberty
Source: MSBuild.exe, 00000002.00000002.1479189708.000000000312F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.walletLR
Source: MSBuild.exe, 00000002.00000002.1479189708.000000000312F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum\walletsLR
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ExodusE#
Source: MSBuild.exe, 00000002.00000002.1479189708.000000000312F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: qdC:\Users\user\AppData\Roaming\Binance
Source: MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: EthereumE#
Source: MSBuild.exe, 00000002.00000002.1479189708.000000000312F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: q&%localappdata%\Coinomi\Coinomi\walletsLR
Source: MSBuild.exe, 00000002.00000002.1479189708.000000000312F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: q4C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cookies.sqlite	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1479189708.000000000312F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7548, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.RepozetorySetup.exe.aab930.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RepozetorySetup.exe.aab930.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RepozetorySetup.exe.a90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1436031916.0000000000AAB000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1477295401.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RepozetorySetup.exe PID: 7496, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7548, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	311 Process Injection	1 Masquerading	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	261 Security Software Discovery	Remote Desktop Protocol	3 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	251 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	311 Process Injection	NTDS	251 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Software Packing	DCSync	114 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
RepozetorySetup.exe	47%	ReversingLabs	Win32.Trojan.Generic
RepozetorySetup.exe	100%	Avira	HEUR/AGEN.1305290
RepozetorySetup.exe	100%	Joe Sandbox ML

URLs

Source	Detection	Scanner	Label
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	0%	URL Reputation	safe
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/sc	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	0%	URL Reputation	safe
http://www.entrust.net/rpa03	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/trust	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	0%	URL Reputation	safe
http://crl.entrust.net/2048ca.crl0	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	0%	URL Reputation	safe
https://www.entrust.net/rpa0	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	0%	URL Reputation	safe
http://ocsp.entrust.net03	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	0%	URL Reputation	safe
http://ocsp.entrust.net02	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
185.196.9.26:6302	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id23ResponseD	MSBuild.exe, 00000002.00000002.1479189708.000000000312F000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id12Response	MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/	MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id2Response	MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id21Response	MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id9	MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id8	MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id5	MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id4	MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id7	MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id6	MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id19Response	MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat	MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id15Response	MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id6Response	MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ip.sb/ip	RepozetorySetup.exe, RepozetorySetup.exe, 00000000.00000002.1436031916.0000000000AAB000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1477295401.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/sc	MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id1ResponseD	MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.entrust.net/rpa03	RepozetorySetup.exe	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id9Response	MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id20	MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id21	MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id22	MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id23	MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1479189708.000000000312F000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id24	MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id24Response	MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id1Response	MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust	MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id10	MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id11	MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id12	MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id16Response	MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id13	MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id14	MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id15	MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id16	MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id17	MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id18	MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id5Response	MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://crl.entrust.net/2048ca.crl0	RepozetorySetup.exe	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id19	MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.entrust.net/rpa0	RepozetorySetup.exe	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id10Response	MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id8Response	MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.entrust.net03	RepozetorySetup.exe	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.entrust.net02	RepozetorySetup.exe	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1	MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust	MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id3ResponseD	MSBuild.exe, 00000002.00000002.1479189708.000000000312F000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Entity/Id23Response	MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1479189708.0000000002E81000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/D	MSBuild.exe, 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.196.9.26	unknown	Switzerland		42624	SIMPLECARRIERCH	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1536511
Start date and time:	2024-10-18 00:26:31 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	RepozetorySetup.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/6@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 86% Number of executed functions: 19 Number of non-executed functions: 36
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 40.126.31.73, 40.126.31.69, 20.190.159.4, 20.190.159.0, 20.190.159.68, 20.190.159.64, 20.190.159.73, 20.190.159.75, 13.89.179.12, 52.149.20.212, 20.242.39.171, 20.12.23.50, 13.95.31.18, 20.109.210.53
Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, otelrules.azureedge.net, slscr.update.microsoft.com, otelrules.afd.azureedge.net, www.tm.v4.a.prd.aadg.trafficmanager.net, onedsblobprdcus17.centralus.cloudapp.azure.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, azureedge-t-prod.trafficmanager.net, umwatson.events.data.microsoft.com, www.tm.lg.prod.aadmsa.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: RepozetorySetup.exe

Simulations

Behavior and APIs

Time	Type	Description
18:27:32	API Interceptor	1x Sleep call for process: WerFault.exe modified
18:27:35	API Interceptor	15x Sleep call for process: MSBuild.exe modified

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_RepozetorySetup._dbae9c7c1666e638f7cace34c3620537866cb47_6b7089c6_0bf54268-0f17-418d-853d-4b7cde7816bb\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.660784400631981
Encrypted:	false
SSDEEP:	96:HHh5FyJPs9hfoI7RE6tQXIDcQvc6QcEVcw3cE/j7P+HbHg/5hZAX/d5FMT2SlPkE:v+PD0BU/H7UjhzuiFEZ24IO8aA0
MD5:	755CFFFEA56D1390E86806D370C9E303
SHA1:	1B9419AD5EC09C59ECD23E10EC090DC4C32060E0
SHA-256:	AED263918EB2B27474FFF1D0AA91D440243EE00F6E30A92D9428B1296F6D1EB9
SHA-512:	99A05A284C1644C77405A1F7FF80F69618186E02AB18CC46E393842BEBF6943A3FBDD0527FD4300F362887B0AD5C24B594341BF53DDBAE27438136D3D457025D
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.3.6.7.7.6.4.6.3.3.4.2.6.7.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.3.6.7.7.6.4.7.5.5.3.0.1.0.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.b.f.5.4.2.6.8.-.0.f.1.7.-.4.1.8.d.-.8.5.3.d.-.4.b.7.c.d.e.7.8.1.6.b.b.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.7.5.0.3.1.7.b.-.4.3.b.3.-.4.9.9.b.-.8.3.d.e.-.8.6.d.5.b.c.a.c.5.0.4.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.R.e.p.o.z.e.t.o.r.y.S.e.t.u.p...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.4.8.-.0.0.0.1.-.0.0.1.4.-.7.3.9.6.-.f.2.b.d.e.3.2.0.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.c.8.5.5.0.b.2.b.3.b.f.1.3.5.3.0.4.f.c.a.1.5.3.c.7.9.1.d.e.3.e.f.0.0.0.0.f.f.f.f.!.0.0.0.0.f.1.d.5.b.8.5.3.b.1.e.7.4.4.4.9.7.2.9.a.e.1.0.8.0.e.1.8.5.7.d.a.3.d.a.4.7.7.4.7.!.R.e.p.o.z.e.t.o.r.y.S.e.t.u.p...e.x.e.....T.a.r.g.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4BE1.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Oct 17 22:27:26 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	35402
Entropy (8bit):	1.5708848339842172
Encrypted:	false
SSDEEP:	192:pwuk56UiOHVo0aueCWhpOghz/w+Qnn3EwqS:Dk56U9+bQn3E
MD5:	AE6575D05F59C6A015D179D6598F0B74
SHA1:	89B2E8466797E30A07EDF60C739EF914A97C697B
SHA-256:	5EB27A750F17719646864CC19E34C7BD5D868BF6E498DE72AAD39FBB89531085
SHA-512:	6198947B0EBE462E44D7C65F7C246207D914C61D66E2ECBDC4E078BD7BB4CAEA643B334F688A797C9F9F351E9156A493B567C276D3A48D22B045ED5C497AED98
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .......N..g........................d...........................T.......8...........T.......................................................................................................................eJ..............GenuineIntel............T.......H...M..g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4C30.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8422
Entropy (8bit):	3.6971507576864866
Encrypted:	false
SSDEEP:	192:R6l7wVeJ9v6C6YcDuSU9A6/gmffLpr189bm/9sfAgvm:R6lXJ16C6YZSU97/gmffkm/2fPO
MD5:	09D42C597ADE5FB6F18399B64A84302B
SHA1:	1B081BB68D8C0285198EE50CE0D0AA1B230A8498
SHA-256:	90AC8D2624ECEDC69506B1D43482DCA65D80BBCC3AA2D1B9900FBA83CD46699E
SHA-512:	68F937BA8B90D8EDDFC93FA26BA61AAF803322AFD9112D834065177945FA3DD111597B93FF410EF36D702B02FF5A9D48A6BE5318C32F55047D89BF49570C84F4
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.4.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4E64.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4745
Entropy (8bit):	4.490661855383455
Encrypted:	false
SSDEEP:	48:cvIwWl8zsCJg77aI9NyrWpW8VY6Ym8M4JCbEFh+q8vvbt8l8Td:uIjfQI7fT7VmJeQKDt8l8Td
MD5:	6941AE9CD55C096C1EF6CAA779F133E5
SHA1:	BE18E80C8F713CB92408B8A70CD15C9D1C2791F5
SHA-256:	6DB2F25897C4FD4E109EBF77EA75E7A7B49F424882625C993AAF86075B8A6BFC
SHA-512:	EEF1D6FEEF393FDF1E21FCEFEF7BC913C08FCC5CCBD32F7AEFD797ABCFBFA462EA21ADE35836B32F46E6091C630EDC9C2330CC6C807B599AFD4AED7808B7647D
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="548010" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MSBuild.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3094
Entropy (8bit):	5.33145931749415
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymTqdqlq7qqjqc85VD:Pq5qHwCYqh3qtI6eqzxP0atTqdqlq7qV
MD5:	2A56468A7C0F324A42EA599BF0511FAF
SHA1:	404B343A86EDEDF5B908D7359EB8AA957D1D4333
SHA-256:	6398E0BD46082BBC30008BC72A2BA092E0A1269052153D343AA40F935C59957C
SHA-512:	19B79181C40AA51C7ECEFCD4C9ED42D5BA19EA493AE99654D3A763EA9B21B1ABE5B5739AAC425E461609E1165BCEA749CFB997DE0D35303B4CF2A29BDEF30B17
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.393774681399893
Encrypted:	false
SSDEEP:	6144:Wl4fiJoH0ncNXiUjt10qwG/gaocYGBoaUMMhA2NX4WABlBuNA1OBSqa:W4vFwMYQUMM6VFYS1U
MD5:	ABAA354FD8E4815676572FD2194BAAE4
SHA1:	F342503D75A2B6B50DEAB1921C0960BA1CE3385C
SHA-256:	BBFAC0ACD4E94BEC89675442992B2B600A2041B8AEFE6D41C0A4F7A39681B151
SHA-512:	08559822237004A18A47B2C443E81ED8453C8A3EA2F5FFEFA9639CD076500C349FD9FD45C030CF88389B1684043E55B595677C48414BD27B7F0ED21041002914
Malicious:	false
Reputation:	low
Preview:	regfG...G....\.Z.................... ....`......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.]w.. ...............................................................................................................................................................................................................................................................................................................................................w`.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

GetModuleHandleExW, WriteConsoleW, CreateFileW, HeapReAlloc, CloseHandle, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, HeapSize, RaiseException, RtlUnwind, GetLastError, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, EncodePointer, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, DecodePointer, HeapAlloc, HeapFree, LCMapStringW, GetFileType, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, GetStringTypeW, GetProcessHeap, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, GetFileSizeEx, SetFilePointerEx

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-18T00:27:29.416175+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.9	49740	185.196.9.26	6302	TCP
2024-10-18T00:27:29.416175+0200	2046045	ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	1	192.168.2.9	49740	185.196.9.26	6302	TCP
2024-10-18T00:27:29.685072+0200	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	1	185.196.9.26	6302	192.168.2.9	49740	TCP
2024-10-18T00:27:34.736347+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.9	49740	185.196.9.26	6302	TCP
2024-10-18T00:27:35.049889+0200	2046056	ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)	1	185.196.9.26	6302	192.168.2.9	49740	TCP
2024-10-18T00:27:36.894844+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.9	49740	185.196.9.26	6302	TCP
2024-10-18T00:27:37.204171+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.9	49740	185.196.9.26	6302	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 18, 2024 00:27:19.952218056 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:19.952272892 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:19.952361107 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:19.952646971 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:19.952662945 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:20.697563887 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:20.697695017 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:20.741530895 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:20.741570950 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:20.741931915 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:20.753144979 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:20.799400091 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:20.951411963 CEST	49677	443	192.168.2.9	20.189.173.11
Oct 18, 2024 00:27:20.996437073 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:20.996464968 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:20.996479988 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:20.996598005 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:20.996638060 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:20.996689081 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:21.113945007 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:21.113977909 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:21.114090919 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:21.114120960 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:21.114164114 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:21.231575012 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:21.231600046 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:21.231662035 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:21.231683016 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:21.231719971 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:21.354090929 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:21.354114056 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:21.354271889 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:21.354302883 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:21.354353905 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:21.473068953 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:21.473094940 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:21.473229885 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:21.473264933 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:21.473311901 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:21.590821981 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:21.590848923 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:21.591017008 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:21.591047049 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:21.591093063 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:21.638919115 CEST	49676	443	192.168.2.9	23.206.229.209
Oct 18, 2024 00:27:21.641149998 CEST	49675	443	192.168.2.9	23.206.229.209
Oct 18, 2024 00:27:21.708365917 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:21.708401918 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:21.708532095 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:21.708579063 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:21.708633900 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:21.810003996 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:21.810034037 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:21.810164928 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:21.810203075 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:21.810246944 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:21.827353954 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:21.827393055 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:21.827469110 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:21.827486992 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:21.827526093 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:21.920152903 CEST	49674	443	192.168.2.9	23.206.229.209
Oct 18, 2024 00:27:21.946029902 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:21.946059942 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:21.946193933 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:21.946208954 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:21.946269035 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:22.064614058 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:22.064645052 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:22.064799070 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:22.064824104 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:22.064872026 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:22.167893887 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:22.167926073 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:22.168030977 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:22.168054104 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:22.168097019 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:22.302305937 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:22.302333117 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:22.302392006 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:22.302417994 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:22.302445889 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:22.302465916 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:22.308362007 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:22.308437109 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:22.308461905 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:22.308499098 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:22.309144020 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:22.309164047 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:22.309176922 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:22.309182882 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:22.381036997 CEST	49710	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:22.381089926 CEST	443	49710	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:22.381171942 CEST	49710	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:22.382782936 CEST	49711	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:22.382828951 CEST	443	49711	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:22.382884026 CEST	49711	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:22.383909941 CEST	49712	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:22.383951902 CEST	443	49712	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:22.384016037 CEST	49712	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:22.384179115 CEST	49710	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:22.384200096 CEST	443	49710	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:22.384416103 CEST	49713	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:22.384443045 CEST	443	49713	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:22.384502888 CEST	49713	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:22.384615898 CEST	49713	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:22.384622097 CEST	443	49713	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:22.384634018 CEST	49714	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:22.384639978 CEST	443	49714	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:22.384685040 CEST	49714	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:22.384744883 CEST	49712	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:22.384767056 CEST	443	49712	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:22.384779930 CEST	49711	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:22.384805918 CEST	443	49711	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:22.384835958 CEST	49714	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:22.384840965 CEST	443	49714	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:23.116718054 CEST	443	49714	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:23.117343903 CEST	49714	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:23.117371082 CEST	443	49714	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:23.117809057 CEST	49714	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:23.117816925 CEST	443	49714	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:23.120690107 CEST	443	49712	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:23.120959997 CEST	49712	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:23.120981932 CEST	443	49712	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:23.121295929 CEST	49712	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:23.121303082 CEST	443	49712	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:23.135831118 CEST	443	49710	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:23.136465073 CEST	49710	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:23.136482000 CEST	443	49710	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:23.136919022 CEST	49710	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:23.136926889 CEST	443	49710	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:23.146445990 CEST	443	49713	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:23.147032022 CEST	49713	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:23.147051096 CEST	443	49713	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:23.147562981 CEST	49713	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:23.147569895 CEST	443	49713	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:23.153422117 CEST	443	49711	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:23.155400038 CEST	49711	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:23.155419111 CEST	443	49711	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:23.155775070 CEST	49711	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:23.155780077 CEST	443	49711	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:23.247733116 CEST	443	49714	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:23.247761965 CEST	443	49714	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:23.248024940 CEST	49714	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:23.248047113 CEST	443	49714	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:23.248065948 CEST	443	49714	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:23.248121023 CEST	49714	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:23.248121977 CEST	49714	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:23.248296022 CEST	49714	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:23.248311043 CEST	443	49714	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:23.249104023 CEST	49714	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:23.249114037 CEST	443	49714	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:23.251923084 CEST	49715	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:23.251966000 CEST	443	49715	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:23.252042055 CEST	49715	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:23.252160072 CEST	49715	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:23.252173901 CEST	443	49715	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:23.252687931 CEST	443	49712	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:23.252696991 CEST	443	49712	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:23.252748966 CEST	49712	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:23.252758026 CEST	443	49712	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:23.252826929 CEST	443	49712	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:23.252860069 CEST	49712	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:23.252875090 CEST	443	49712	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:23.252880096 CEST	49712	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:23.252883911 CEST	443	49712	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:23.252902031 CEST	49712	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:23.252906084 CEST	443	49712	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:23.254801035 CEST	49716	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:23.254841089 CEST	443	49716	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:23.255047083 CEST	49716	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:23.255196095 CEST	49716	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:23.255208969 CEST	443	49716	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:23.270606995 CEST	443	49710	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:23.270626068 CEST	443	49710	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:23.270679951 CEST	443	49710	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:23.270719051 CEST	49710	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:23.270876884 CEST	49710	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:23.271009922 CEST	49710	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:23.271009922 CEST	49710	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:23.271027088 CEST	443	49710	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:23.271044016 CEST	443	49710	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:23.273500919 CEST	49717	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:23.273531914 CEST	443	49717	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:23.273705959 CEST	49717	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:23.273705959 CEST	49717	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:23.273729086 CEST	443	49717	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:23.283375025 CEST	443	49713	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:23.283500910 CEST	443	49713	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:23.283623934 CEST	49713	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:23.283623934 CEST	49713	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:23.283945084 CEST	49713	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:23.283963919 CEST	443	49713	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:23.286252975 CEST	49718	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:23.286263943 CEST	443	49718	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:23.286329985 CEST	49718	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:23.286490917 CEST	49718	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:23.286499023 CEST	443	49718	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:23.291635990 CEST	443	49711	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:23.291826963 CEST	443	49711	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:23.291932106 CEST	49711	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:23.291968107 CEST	49711	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:23.291987896 CEST	443	49711	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:23.291999102 CEST	49711	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:23.292006016 CEST	443	49711	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:23.294488907 CEST	49719	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:23.294539928 CEST	443	49719	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:23.294645071 CEST	49719	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:23.294770956 CEST	49719	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:23.294783115 CEST	443	49719	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:23.993494034 CEST	443	49715	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:23.994088888 CEST	49715	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:23.994113922 CEST	443	49715	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:23.994600058 CEST	49715	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:23.994611025 CEST	443	49715	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:24.008138895 CEST	443	49716	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:24.014966965 CEST	443	49718	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:24.026689053 CEST	443	49717	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:24.035953999 CEST	49718	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:24.035973072 CEST	443	49718	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:24.036638975 CEST	49718	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:24.036638975 CEST	49717	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:24.036645889 CEST	443	49718	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:24.036659956 CEST	443	49717	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:24.037050962 CEST	49717	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:24.037055969 CEST	443	49717	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:24.037110090 CEST	49716	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:24.037141085 CEST	443	49716	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:24.037470102 CEST	49716	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:24.037477016 CEST	443	49716	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:24.043337107 CEST	443	49719	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:24.043811083 CEST	49719	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:24.043823004 CEST	443	49719	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:24.044224024 CEST	49719	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:24.044230938 CEST	443	49719	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:24.154391050 CEST	443	49715	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:24.154854059 CEST	443	49715	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:24.154943943 CEST	49715	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:24.155016899 CEST	49715	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:24.155036926 CEST	443	49715	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:24.155050993 CEST	49715	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:24.155056953 CEST	443	49715	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:24.157768965 CEST	49720	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:24.157815933 CEST	443	49720	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:24.157912016 CEST	49720	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:24.158055067 CEST	49720	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:24.158066034 CEST	443	49720	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:24.161586046 CEST	443	49718	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:24.161657095 CEST	443	49718	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:24.161777973 CEST	49718	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:24.161832094 CEST	49718	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:24.161832094 CEST	49718	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:24.161851883 CEST	443	49718	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:24.161861897 CEST	443	49718	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:24.164210081 CEST	49721	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:24.164247990 CEST	443	49721	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:24.164350033 CEST	49721	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:24.164433002 CEST	49721	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:24.164448977 CEST	443	49721	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:24.166893959 CEST	443	49716	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:24.166963100 CEST	443	49716	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:24.167016983 CEST	49716	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:24.167097092 CEST	49716	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:24.167115927 CEST	443	49716	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:24.167128086 CEST	49716	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:24.167135000 CEST	443	49716	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:24.169174910 CEST	49722	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:24.169186115 CEST	443	49722	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:24.169265032 CEST	49722	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:24.169378996 CEST	49722	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:24.169389009 CEST	443	49722	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:24.170559883 CEST	443	49717	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:24.170697927 CEST	443	49717	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:24.170773029 CEST	49717	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:24.170825005 CEST	49717	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:24.170825005 CEST	49717	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:24.170830965 CEST	443	49717	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:24.170836926 CEST	443	49717	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:24.173049927 CEST	49723	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:24.173067093 CEST	443	49723	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:24.173139095 CEST	49723	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:24.173331976 CEST	49723	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:24.173341036 CEST	443	49723	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:24.177936077 CEST	443	49719	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:24.180262089 CEST	443	49719	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:24.180310965 CEST	49719	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:24.180376053 CEST	49719	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:24.180397034 CEST	443	49719	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:24.180408955 CEST	49719	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:24.180417061 CEST	443	49719	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:24.183187962 CEST	49724	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:24.183228016 CEST	443	49724	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:24.183300018 CEST	49724	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:24.183423996 CEST	49724	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:24.183434963 CEST	443	49724	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:24.894180059 CEST	443	49720	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:24.894802094 CEST	49720	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:24.894828081 CEST	443	49720	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:24.895359039 CEST	49720	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:24.895370960 CEST	443	49720	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:24.898118973 CEST	443	49722	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:24.898662090 CEST	49722	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:24.898677111 CEST	443	49722	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:24.899410963 CEST	49722	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:24.899420977 CEST	443	49722	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:24.905745029 CEST	443	49721	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:24.906622887 CEST	49721	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:24.906636000 CEST	443	49721	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:24.907062054 CEST	49721	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:24.907067060 CEST	443	49721	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:24.907392979 CEST	443	49724	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:24.907785892 CEST	49724	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:24.907816887 CEST	443	49724	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:24.908194065 CEST	49724	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:24.908200979 CEST	443	49724	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:24.920052052 CEST	443	49723	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:24.920758963 CEST	49723	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:24.920775890 CEST	443	49723	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:24.921374083 CEST	49723	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:24.921380997 CEST	443	49723	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:25.023765087 CEST	443	49720	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:25.023860931 CEST	443	49720	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:25.024005890 CEST	49720	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:25.024035931 CEST	49720	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:25.024056911 CEST	443	49720	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:25.024070024 CEST	49720	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:25.024080038 CEST	443	49720	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:25.026942968 CEST	49725	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:25.026985884 CEST	443	49725	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:25.027090073 CEST	49725	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:25.027230024 CEST	49725	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:25.027246952 CEST	443	49725	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:25.027940035 CEST	443	49722	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:25.028388977 CEST	443	49722	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:25.028445005 CEST	49722	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:25.028467894 CEST	49722	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:25.028484106 CEST	443	49722	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:25.028496027 CEST	49722	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:25.028510094 CEST	443	49722	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:25.031856060 CEST	49726	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:25.031893969 CEST	443	49726	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:25.031979084 CEST	49726	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:25.032222986 CEST	49726	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:25.032243967 CEST	443	49726	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:25.035427094 CEST	443	49721	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:25.035903931 CEST	443	49721	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:25.035983086 CEST	49721	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:25.036149025 CEST	49721	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:25.036159039 CEST	443	49721	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:25.036170959 CEST	49721	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:25.036181927 CEST	443	49721	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:25.036667109 CEST	443	49724	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:25.036761045 CEST	443	49724	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:25.037158966 CEST	49724	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:25.037244081 CEST	49724	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:25.037266970 CEST	443	49724	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:25.037280083 CEST	49724	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:25.037286043 CEST	443	49724	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:25.039254904 CEST	49727	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:25.039300919 CEST	443	49727	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:25.039372921 CEST	49727	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:25.040189981 CEST	49728	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:25.040208101 CEST	443	49728	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:25.040280104 CEST	49727	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:25.040287018 CEST	49728	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:25.040307999 CEST	443	49727	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:25.040410042 CEST	49728	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:25.040421009 CEST	443	49728	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:25.051554918 CEST	443	49723	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:25.051623106 CEST	443	49723	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:25.051734924 CEST	49723	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:25.051806927 CEST	49723	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:25.051820040 CEST	443	49723	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:25.051831007 CEST	49723	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:25.051836014 CEST	443	49723	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:25.054192066 CEST	49729	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:25.054223061 CEST	443	49729	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:25.054315090 CEST	49729	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:25.054435015 CEST	49729	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:25.054449081 CEST	443	49729	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:25.763839006 CEST	49677	443	192.168.2.9	20.189.173.11
Oct 18, 2024 00:27:25.938544035 CEST	443	49728	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:25.938719988 CEST	443	49726	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:25.938777924 CEST	443	49727	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:25.939133883 CEST	49728	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:25.939143896 CEST	443	49728	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:25.939142942 CEST	443	49725	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:25.939172029 CEST	443	49729	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:25.939623117 CEST	49728	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:25.939627886 CEST	443	49728	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:25.939935923 CEST	49729	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:25.939949036 CEST	443	49729	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:25.940208912 CEST	49729	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:25.940218925 CEST	443	49729	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:25.940397024 CEST	49726	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:25.940428019 CEST	443	49726	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:25.940759897 CEST	49726	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:25.940767050 CEST	443	49726	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:25.940942049 CEST	49727	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:25.940960884 CEST	443	49727	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:25.941283941 CEST	49727	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:25.941294909 CEST	443	49727	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:25.941473007 CEST	49725	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:25.941481113 CEST	443	49725	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:25.941829920 CEST	49725	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:25.941834927 CEST	443	49725	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:26.066067934 CEST	443	49728	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:26.066143036 CEST	443	49728	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:26.066198111 CEST	49728	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:26.066365004 CEST	49728	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:26.066380978 CEST	443	49728	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:26.066392899 CEST	49728	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:26.066397905 CEST	443	49728	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:26.067210913 CEST	443	49729	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:26.068341017 CEST	443	49729	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:26.068438053 CEST	49729	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:26.069574118 CEST	443	49727	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:26.069734097 CEST	443	49727	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:26.069777012 CEST	49727	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:26.070070028 CEST	49730	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:26.070070028 CEST	49729	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:26.070111036 CEST	443	49730	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:26.070113897 CEST	443	49729	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:26.070159912 CEST	49729	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:26.070159912 CEST	49730	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:26.070167065 CEST	443	49729	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:26.071213007 CEST	49727	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:26.071232080 CEST	443	49727	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:26.071244001 CEST	49727	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:26.071250916 CEST	443	49727	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:26.071523905 CEST	49730	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:26.071538925 CEST	443	49730	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:26.072808027 CEST	443	49726	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:26.072992086 CEST	443	49726	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:26.073030949 CEST	49726	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:26.073096991 CEST	49726	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:26.073112011 CEST	443	49726	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:26.073127985 CEST	49726	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:26.073133945 CEST	443	49726	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:26.073760986 CEST	443	49725	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:26.074204922 CEST	443	49725	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:26.074244976 CEST	49725	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:26.074285030 CEST	49725	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:26.074291945 CEST	443	49725	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:26.074301958 CEST	49725	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:26.074305058 CEST	443	49725	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:26.075051069 CEST	49731	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:26.075104952 CEST	443	49731	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:26.075155020 CEST	49731	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:26.075308084 CEST	49731	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:26.075320959 CEST	443	49731	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:26.076581955 CEST	49732	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:26.076611042 CEST	443	49732	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:26.076658964 CEST	49732	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:26.078005075 CEST	49733	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:26.078031063 CEST	443	49733	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:26.078078985 CEST	49733	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:26.078238010 CEST	49733	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:26.078248024 CEST	443	49733	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:26.078629971 CEST	49732	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:26.078645945 CEST	443	49732	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:26.079756021 CEST	49734	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:26.079777002 CEST	443	49734	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:26.079829931 CEST	49734	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:26.079936028 CEST	49734	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:26.079950094 CEST	443	49734	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:26.796750069 CEST	443	49730	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:26.797287941 CEST	49730	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:26.797307014 CEST	443	49730	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:26.797753096 CEST	49730	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:26.797758102 CEST	443	49730	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:26.806299925 CEST	443	49734	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:26.807068110 CEST	49734	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:26.807096958 CEST	443	49734	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:26.807569981 CEST	49734	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:26.807579041 CEST	443	49734	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:26.818264008 CEST	443	49732	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:26.826849937 CEST	49732	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:26.826880932 CEST	443	49732	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:26.827301979 CEST	49732	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:26.827306986 CEST	443	49732	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:26.828423977 CEST	443	49731	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:26.829051971 CEST	49731	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:26.829088926 CEST	443	49731	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:26.829458952 CEST	49731	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:26.829467058 CEST	443	49731	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:26.837452888 CEST	443	49733	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:26.838109970 CEST	49733	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:26.838133097 CEST	443	49733	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:26.839234114 CEST	49733	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:26.839245081 CEST	443	49733	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:26.928894997 CEST	443	49730	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:26.929284096 CEST	443	49730	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:26.929323912 CEST	49730	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:26.930342913 CEST	49730	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:26.930360079 CEST	443	49730	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:26.930372953 CEST	49730	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:26.930378914 CEST	443	49730	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:26.959449053 CEST	443	49732	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:26.959741116 CEST	443	49732	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:26.959789038 CEST	49732	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:26.961353064 CEST	443	49734	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:26.961409092 CEST	443	49734	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:26.961443901 CEST	49734	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:26.966957092 CEST	49673	443	192.168.2.9	204.79.197.203
Oct 18, 2024 00:27:26.970935106 CEST	443	49731	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:26.972280025 CEST	443	49731	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:26.972323895 CEST	49731	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:26.990675926 CEST	443	49733	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:26.990935087 CEST	443	49733	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:26.991539001 CEST	49733	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:27.125705957 CEST	49731	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:27.125741959 CEST	443	49731	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:27.125757933 CEST	49731	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:27.125766039 CEST	443	49731	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:27.133466005 CEST	49733	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:27.133502960 CEST	443	49733	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:27.133512974 CEST	49733	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:27.133521080 CEST	443	49733	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:27.149600983 CEST	49732	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:27.149626017 CEST	443	49732	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:27.149642944 CEST	49732	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:27.149648905 CEST	443	49732	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:27.158173084 CEST	49734	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:27.158173084 CEST	49734	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:27.158194065 CEST	443	49734	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:27.158205032 CEST	443	49734	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:27.221585989 CEST	49735	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:27.221628904 CEST	443	49735	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:27.221704006 CEST	49735	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:27.224313974 CEST	49736	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:27.224364042 CEST	443	49736	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:27.224802017 CEST	49736	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:27.225507975 CEST	49737	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:27.225539923 CEST	443	49737	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:27.225594997 CEST	49737	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:27.225785017 CEST	49735	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:27.225809097 CEST	443	49735	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:27.227081060 CEST	49738	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:27.227089882 CEST	443	49738	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:27.227149010 CEST	49738	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:27.227646112 CEST	49738	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:27.227658987 CEST	443	49738	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:27.227945089 CEST	49739	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:27.227956057 CEST	443	49739	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:27.228001118 CEST	49739	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:27.228143930 CEST	49739	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:27.228149891 CEST	443	49739	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:27.228245020 CEST	49736	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:27.228257895 CEST	443	49736	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:27.228337049 CEST	49737	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:27.228346109 CEST	443	49737	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:28.134490967 CEST	443	49736	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:28.136025906 CEST	443	49739	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:28.138362885 CEST	443	49738	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:28.138542891 CEST	443	49737	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:28.139422894 CEST	443	49735	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:28.147432089 CEST	49735	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:28.147449970 CEST	443	49735	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:28.147892952 CEST	49735	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:28.147900105 CEST	443	49735	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:28.148319960 CEST	49736	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:28.148334026 CEST	443	49736	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:28.148777962 CEST	49736	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:28.148785114 CEST	443	49736	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:28.152282953 CEST	49738	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:28.152304888 CEST	443	49738	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:28.152344942 CEST	49739	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:28.152353048 CEST	443	49739	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:28.152817011 CEST	49739	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:28.152821064 CEST	443	49739	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:28.153059006 CEST	49737	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:28.153072119 CEST	443	49737	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:28.153192043 CEST	49738	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:28.153196096 CEST	443	49738	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:28.153533936 CEST	49737	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:28.153542995 CEST	443	49737	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:28.456234932 CEST	443	49736	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:28.456314087 CEST	443	49739	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:28.456319094 CEST	443	49737	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:28.456343889 CEST	443	49735	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:28.456423998 CEST	443	49739	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:28.456425905 CEST	443	49737	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:28.456438065 CEST	443	49735	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:28.456449032 CEST	443	49736	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:28.456482887 CEST	49739	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:28.456485987 CEST	49737	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:28.456492901 CEST	49735	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:28.456615925 CEST	49736	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:28.457015038 CEST	443	49738	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:28.457081079 CEST	443	49738	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:28.457119942 CEST	49738	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:28.468997002 CEST	49737	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:28.469032049 CEST	443	49737	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:28.469049931 CEST	49737	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:28.469049931 CEST	49738	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:28.469049931 CEST	49738	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:28.469059944 CEST	443	49737	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:28.469068050 CEST	443	49738	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:28.469078064 CEST	443	49738	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:28.469980001 CEST	49736	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:28.469994068 CEST	443	49736	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:28.470511913 CEST	49739	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:28.470518112 CEST	443	49739	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:28.470527887 CEST	49739	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:28.470534086 CEST	443	49739	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:28.471126080 CEST	49735	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:28.471139908 CEST	443	49735	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:28.471151114 CEST	49735	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:28.471155882 CEST	443	49735	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:28.474083900 CEST	49740	6302	192.168.2.9	185.196.9.26
Oct 18, 2024 00:27:28.475481987 CEST	49741	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:28.475518942 CEST	443	49741	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:28.475581884 CEST	49741	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:28.476049900 CEST	49742	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:28.476058006 CEST	443	49742	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:28.476109982 CEST	49742	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:28.477404118 CEST	49743	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:28.477433920 CEST	443	49743	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:28.477485895 CEST	49743	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:28.477566004 CEST	49744	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:28.477606058 CEST	443	49744	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:28.477696896 CEST	49743	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:28.477710962 CEST	443	49743	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:28.477722883 CEST	49744	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:28.477729082 CEST	49741	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:28.477745056 CEST	443	49741	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:28.477880955 CEST	49742	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:28.477893114 CEST	443	49742	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:28.478928089 CEST	6302	49740	185.196.9.26	192.168.2.9
Oct 18, 2024 00:27:28.478981972 CEST	49740	6302	192.168.2.9	185.196.9.26
Oct 18, 2024 00:27:28.479108095 CEST	49745	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:28.479140997 CEST	443	49745	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:28.479190111 CEST	49745	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:28.479300976 CEST	49745	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:28.479314089 CEST	443	49745	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:28.479774952 CEST	49744	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:28.479790926 CEST	443	49744	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:28.489617109 CEST	49740	6302	192.168.2.9	185.196.9.26
Oct 18, 2024 00:27:28.494872093 CEST	6302	49740	185.196.9.26	192.168.2.9
Oct 18, 2024 00:27:29.217745066 CEST	443	49744	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:29.218373060 CEST	49744	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:29.218385935 CEST	443	49744	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:29.218878984 CEST	49744	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:29.218884945 CEST	443	49744	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:29.230485916 CEST	443	49743	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:29.231060028 CEST	49743	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:29.231067896 CEST	443	49743	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:29.231487989 CEST	49743	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:29.231492996 CEST	443	49743	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:29.240091085 CEST	443	49742	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:29.240602970 CEST	49742	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:29.240617990 CEST	443	49742	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:29.241596937 CEST	49742	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:29.241602898 CEST	443	49742	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:29.256767988 CEST	443	49741	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:29.257724047 CEST	49741	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:29.257724047 CEST	49741	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:29.257735968 CEST	443	49741	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:29.257754087 CEST	443	49741	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:29.348773956 CEST	443	49744	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:29.348982096 CEST	443	49744	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:29.349108934 CEST	49744	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:29.349222898 CEST	49744	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:29.349222898 CEST	49744	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:29.349236012 CEST	443	49744	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:29.349244118 CEST	443	49744	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:29.353084087 CEST	49747	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:29.353108883 CEST	443	49747	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:29.353221893 CEST	49747	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:29.353486061 CEST	49747	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:29.353498936 CEST	443	49747	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:29.362895966 CEST	443	49743	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:29.363027096 CEST	443	49743	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:29.363085032 CEST	49743	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:29.363192081 CEST	49743	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:29.363203049 CEST	443	49743	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:29.366530895 CEST	49748	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:29.366559982 CEST	443	49748	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:29.366674900 CEST	49748	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:29.366976976 CEST	49748	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:29.366988897 CEST	443	49748	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:29.373882055 CEST	443	49742	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:29.373935938 CEST	443	49742	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:29.373987913 CEST	49742	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:29.374125004 CEST	49742	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:29.374125004 CEST	49742	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:29.374140978 CEST	443	49742	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:29.374150038 CEST	443	49742	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:29.376733065 CEST	49749	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:29.376758099 CEST	443	49749	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:29.376837969 CEST	49749	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:29.377058983 CEST	6302	49740	185.196.9.26	192.168.2.9
Oct 18, 2024 00:27:29.377080917 CEST	49749	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:29.377088070 CEST	443	49749	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:29.388309956 CEST	443	49741	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:29.389111996 CEST	443	49741	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:29.389184952 CEST	49741	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:29.389307976 CEST	49741	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:29.389317036 CEST	443	49741	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:29.393481016 CEST	49750	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:29.393511057 CEST	443	49750	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:29.393569946 CEST	49750	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:29.393714905 CEST	49750	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:29.393728971 CEST	443	49750	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:29.416174889 CEST	49740	6302	192.168.2.9	185.196.9.26
Oct 18, 2024 00:27:29.421017885 CEST	6302	49740	185.196.9.26	192.168.2.9
Oct 18, 2024 00:27:29.443342924 CEST	443	49745	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:29.443778038 CEST	49745	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:29.443802118 CEST	443	49745	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:29.444587946 CEST	49745	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:29.444592953 CEST	443	49745	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:29.577502012 CEST	443	49745	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:29.577752113 CEST	443	49745	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:29.577801943 CEST	49745	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:29.577858925 CEST	49745	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:29.577881098 CEST	443	49745	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:29.577891111 CEST	49745	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:29.577897072 CEST	443	49745	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:29.582108974 CEST	49751	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:29.582154989 CEST	443	49751	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:29.582222939 CEST	49751	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:29.582566977 CEST	49751	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:29.582582951 CEST	443	49751	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:29.685071945 CEST	6302	49740	185.196.9.26	192.168.2.9
Oct 18, 2024 00:27:29.732590914 CEST	49740	6302	192.168.2.9	185.196.9.26
Oct 18, 2024 00:27:30.105524063 CEST	443	49747	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:30.119138002 CEST	443	49748	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:30.124680996 CEST	443	49749	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:30.154509068 CEST	49747	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:30.155203104 CEST	443	49750	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:30.183130980 CEST	49748	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:30.183442116 CEST	49749	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:30.196372032 CEST	49747	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:30.196383953 CEST	443	49747	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:30.197179079 CEST	49747	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:30.197186947 CEST	443	49747	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:30.216924906 CEST	49750	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:30.269839048 CEST	49748	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:30.269859076 CEST	443	49748	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:30.277156115 CEST	49748	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:30.277173996 CEST	443	49748	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:30.285027027 CEST	49749	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:30.285053015 CEST	443	49749	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:30.292423010 CEST	49749	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:30.292433977 CEST	443	49749	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:30.296490908 CEST	49750	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:30.296498060 CEST	443	49750	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:30.303343058 CEST	443	49751	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:30.303945065 CEST	49750	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:30.303951025 CEST	443	49750	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:30.307996035 CEST	49751	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:30.308023930 CEST	443	49751	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:30.312036991 CEST	49751	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:30.312053919 CEST	443	49751	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:30.406100035 CEST	443	49748	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:30.406187057 CEST	443	49748	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:30.406234980 CEST	49748	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:30.417020082 CEST	443	49747	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:30.417453051 CEST	443	49747	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:30.417504072 CEST	49747	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:30.419842005 CEST	443	49749	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:30.419919014 CEST	443	49749	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:30.419970036 CEST	49749	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:30.434052944 CEST	49748	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:30.434087038 CEST	443	49748	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:30.434113979 CEST	49748	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:30.434122086 CEST	443	49748	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:30.434237003 CEST	443	49750	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:30.434418917 CEST	443	49750	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:30.434489012 CEST	49750	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:30.436477900 CEST	49750	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:30.436491966 CEST	443	49750	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:30.438288927 CEST	443	49751	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:30.438318968 CEST	49747	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:30.438344002 CEST	443	49747	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:30.438361883 CEST	49747	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:30.438374996 CEST	443	49747	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:30.438397884 CEST	49749	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:30.438405991 CEST	443	49749	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:30.438416004 CEST	49749	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:30.438421965 CEST	443	49749	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:30.438622952 CEST	443	49751	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:30.438668966 CEST	49751	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:30.441224098 CEST	49751	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:30.441242933 CEST	443	49751	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:30.441256046 CEST	49751	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:30.441261053 CEST	443	49751	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:30.445496082 CEST	49752	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:30.445522070 CEST	443	49752	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:30.445580006 CEST	49752	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:30.446424961 CEST	49752	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:30.446438074 CEST	443	49752	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:30.448322058 CEST	49753	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:30.448373079 CEST	443	49753	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:30.448434114 CEST	49753	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:30.448556900 CEST	49753	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:30.448575020 CEST	443	49753	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:30.448647976 CEST	49754	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:30.448657990 CEST	443	49754	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:30.448703051 CEST	49754	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:30.449743032 CEST	49755	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:30.449754953 CEST	443	49755	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:30.449809074 CEST	49755	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:30.449886084 CEST	49756	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:30.449925900 CEST	443	49756	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:30.449970961 CEST	49756	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:30.450500965 CEST	49754	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:30.450534105 CEST	443	49754	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:30.450768948 CEST	49755	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:30.450778961 CEST	443	49755	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:30.450886011 CEST	49756	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:30.450901031 CEST	443	49756	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:31.198081017 CEST	443	49752	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:31.198751926 CEST	49752	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:31.198787928 CEST	443	49752	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:31.198884010 CEST	443	49753	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:31.199390888 CEST	49752	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:31.199400902 CEST	443	49752	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:31.199743032 CEST	49753	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:31.199759007 CEST	443	49753	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:31.200138092 CEST	49753	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:31.200145006 CEST	443	49753	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:31.202207088 CEST	443	49755	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:31.202521086 CEST	49755	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:31.202549934 CEST	443	49755	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:31.202893019 CEST	49755	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:31.202903032 CEST	443	49755	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:31.203048944 CEST	443	49756	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:31.203419924 CEST	49756	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:31.203449011 CEST	443	49756	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:31.203788996 CEST	49756	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:31.203794956 CEST	443	49756	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:31.213427067 CEST	443	49754	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:31.213855028 CEST	49754	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:31.213888884 CEST	443	49754	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:31.214297056 CEST	49754	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:31.214309931 CEST	443	49754	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:31.238826036 CEST	49676	443	192.168.2.9	23.206.229.209
Oct 18, 2024 00:27:31.238842964 CEST	49675	443	192.168.2.9	23.206.229.209
Oct 18, 2024 00:27:31.332505941 CEST	443	49752	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:31.332636118 CEST	443	49752	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:31.332695007 CEST	49752	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:31.332843065 CEST	49752	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:31.332863092 CEST	443	49752	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:31.332875967 CEST	49752	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:31.332881927 CEST	443	49752	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:31.333549976 CEST	443	49753	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:31.333756924 CEST	443	49753	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:31.333817959 CEST	49753	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:31.333869934 CEST	49753	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:31.333890915 CEST	443	49753	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:31.333901882 CEST	49753	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:31.333908081 CEST	443	49753	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:31.335478067 CEST	443	49755	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:31.335540056 CEST	443	49755	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:31.335594893 CEST	49755	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:31.335665941 CEST	49758	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:31.335705996 CEST	443	49758	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:31.335762024 CEST	49758	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:31.335803032 CEST	49755	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:31.335803032 CEST	49755	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:31.335813999 CEST	443	49755	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:31.335824966 CEST	443	49755	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:31.336076975 CEST	49759	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:31.336112976 CEST	443	49759	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:31.336163044 CEST	49759	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:31.336213112 CEST	49758	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:31.336229086 CEST	443	49758	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:31.336270094 CEST	443	49756	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:31.336293936 CEST	49759	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:31.336306095 CEST	443	49759	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:31.336489916 CEST	443	49756	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:31.336545944 CEST	49756	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:31.336563110 CEST	49756	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:31.336572886 CEST	443	49756	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:31.338449001 CEST	49760	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:31.338466883 CEST	443	49760	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:31.338527918 CEST	49760	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:31.338629007 CEST	49761	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:31.338644981 CEST	443	49761	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:31.338670015 CEST	49760	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:31.338681936 CEST	443	49760	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:31.338700056 CEST	49761	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:31.338825941 CEST	49761	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:31.338830948 CEST	443	49761	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:31.390744925 CEST	443	49754	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:31.390852928 CEST	443	49754	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:31.390904903 CEST	49754	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:31.391088963 CEST	49754	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:31.391103029 CEST	443	49754	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:31.391118050 CEST	49754	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:31.391124010 CEST	443	49754	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:31.394072056 CEST	49762	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:31.394115925 CEST	443	49762	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:31.394206047 CEST	49762	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:31.394388914 CEST	49762	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:31.394402027 CEST	443	49762	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:31.529479027 CEST	49674	443	192.168.2.9	23.206.229.209
Oct 18, 2024 00:27:32.074886084 CEST	443	49760	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:32.075686932 CEST	49760	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:32.075704098 CEST	443	49760	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:32.076334953 CEST	49760	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:32.076339960 CEST	443	49760	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:32.084902048 CEST	443	49759	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:32.085069895 CEST	443	49758	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:32.085474014 CEST	49758	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:32.085495949 CEST	443	49758	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:32.085525036 CEST	49759	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:32.085535049 CEST	443	49759	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:32.085994005 CEST	49758	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:32.086000919 CEST	443	49758	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:32.086150885 CEST	49759	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:32.086157084 CEST	443	49759	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:32.094398022 CEST	443	49761	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:32.095149040 CEST	49761	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:32.095174074 CEST	443	49761	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:32.095659971 CEST	49761	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:32.095666885 CEST	443	49761	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:32.126764059 CEST	443	49762	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:32.127278090 CEST	49762	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:32.127291918 CEST	443	49762	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:32.127741098 CEST	49762	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:32.127747059 CEST	443	49762	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:32.208059072 CEST	443	49760	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:32.208189964 CEST	443	49760	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:32.208246946 CEST	49760	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:32.208409071 CEST	49760	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:32.208425999 CEST	443	49760	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:32.208453894 CEST	49760	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:32.208458900 CEST	443	49760	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:32.212711096 CEST	49764	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:32.212742090 CEST	443	49764	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:32.212862968 CEST	49764	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:32.213083029 CEST	49764	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:32.213099003 CEST	443	49764	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:32.222902060 CEST	443	49758	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:32.222986937 CEST	443	49758	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:32.223040104 CEST	49758	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:32.230372906 CEST	49758	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:32.230401993 CEST	443	49758	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:32.230415106 CEST	49758	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:32.230422020 CEST	443	49758	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:32.231733084 CEST	443	49761	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:32.231868029 CEST	443	49761	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:32.231936932 CEST	49761	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:32.232052088 CEST	49761	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:32.232060909 CEST	443	49761	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:32.232069016 CEST	49761	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:32.232073069 CEST	443	49761	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:32.234684944 CEST	49765	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:32.234726906 CEST	443	49765	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:32.234788895 CEST	49765	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:32.234971046 CEST	49765	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:32.234987020 CEST	443	49765	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:32.235014915 CEST	49766	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:32.235023022 CEST	443	49766	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:32.235076904 CEST	49766	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:32.235191107 CEST	49766	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:32.235203028 CEST	443	49766	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:32.257811069 CEST	443	49762	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:32.258725882 CEST	443	49762	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:32.258779049 CEST	49762	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:32.258889914 CEST	49762	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:32.258889914 CEST	49762	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:32.258902073 CEST	443	49762	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:32.258910894 CEST	443	49762	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:32.261781931 CEST	49767	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:32.261811018 CEST	443	49767	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:32.261873007 CEST	49767	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:32.262042046 CEST	49767	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:32.262053013 CEST	443	49767	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:32.289180994 CEST	443	49759	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:32.289359093 CEST	443	49759	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:32.289412975 CEST	49759	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:32.289604902 CEST	49759	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:32.289622068 CEST	443	49759	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:32.292838097 CEST	49768	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:32.292872906 CEST	443	49768	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:32.292968035 CEST	49768	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:32.293117046 CEST	49768	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:32.293132067 CEST	443	49768	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:32.937438011 CEST	443	49764	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:32.937872887 CEST	49764	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:32.937887907 CEST	443	49764	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:32.938312054 CEST	49764	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:32.938321114 CEST	443	49764	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:32.993458986 CEST	443	49765	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:32.994029045 CEST	49765	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:32.994055033 CEST	443	49765	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:32.994488955 CEST	49765	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:32.994496107 CEST	443	49765	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:32.997215986 CEST	443	49766	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:32.997530937 CEST	49766	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:32.997544050 CEST	443	49766	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:32.997896910 CEST	49766	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:32.997901917 CEST	443	49766	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:33.013159990 CEST	443	49767	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:33.013705969 CEST	49767	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:33.013721943 CEST	443	49767	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:33.014395952 CEST	49767	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:33.014400959 CEST	443	49767	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:33.047635078 CEST	443	49768	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:33.048113108 CEST	49768	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:33.048126936 CEST	443	49768	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:33.048634052 CEST	49768	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:33.048638105 CEST	443	49768	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:33.069226980 CEST	443	49764	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:33.069540024 CEST	443	49764	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:33.069605112 CEST	49764	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:33.069684982 CEST	49764	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:33.069708109 CEST	443	49764	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:33.069719076 CEST	49764	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:33.069725990 CEST	443	49764	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:33.072696924 CEST	49769	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:33.072734118 CEST	443	49769	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:33.072808981 CEST	49769	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:33.072962046 CEST	49769	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:33.072974920 CEST	443	49769	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:33.125403881 CEST	443	49765	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:33.125560999 CEST	443	49765	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:33.125614882 CEST	49765	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:33.125766039 CEST	49765	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:33.125785112 CEST	443	49765	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:33.125802994 CEST	49765	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:33.125808954 CEST	443	49765	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:33.129589081 CEST	49770	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:33.129604101 CEST	443	49770	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:33.129678965 CEST	49770	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:33.129863024 CEST	49770	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:33.129873991 CEST	443	49770	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:33.130886078 CEST	443	49766	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:33.131160975 CEST	443	49766	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:33.131208897 CEST	49766	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:33.131238937 CEST	49766	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:33.131251097 CEST	443	49766	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:33.131262064 CEST	49766	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:33.131268024 CEST	443	49766	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:33.133693933 CEST	49771	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:33.133727074 CEST	443	49771	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:33.133800983 CEST	49771	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:33.133953094 CEST	49771	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:33.133976936 CEST	443	49771	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:33.148320913 CEST	443	49767	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:33.148399115 CEST	443	49767	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:33.148456097 CEST	49767	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:33.148577929 CEST	49767	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:33.148585081 CEST	443	49767	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:33.148595095 CEST	49767	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:33.148600101 CEST	443	49767	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:33.151650906 CEST	49772	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:33.151669025 CEST	443	49772	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:33.151741028 CEST	49772	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:33.151943922 CEST	49772	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:33.151957035 CEST	443	49772	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:33.185312033 CEST	443	49768	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:33.185455084 CEST	443	49768	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:33.185523987 CEST	49768	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:33.185726881 CEST	49768	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:33.185749054 CEST	443	49768	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:33.185760021 CEST	49768	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:33.185765982 CEST	443	49768	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:33.188760042 CEST	49773	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:33.188795090 CEST	443	49773	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:33.188855886 CEST	49773	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:33.188998938 CEST	49773	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:33.189016104 CEST	443	49773	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:33.433727026 CEST	443	49707	23.206.229.209	192.168.2.9
Oct 18, 2024 00:27:33.434153080 CEST	49707	443	192.168.2.9	23.206.229.209
Oct 18, 2024 00:27:33.812194109 CEST	443	49769	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:33.813561916 CEST	49769	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:33.813574076 CEST	443	49769	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:33.814048052 CEST	49769	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:33.814053059 CEST	443	49769	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:33.872639894 CEST	443	49771	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:33.873675108 CEST	49771	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:33.873688936 CEST	443	49771	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:33.874170065 CEST	49771	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:33.874175072 CEST	443	49771	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:33.882546902 CEST	443	49770	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:33.884637117 CEST	49770	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:33.884665012 CEST	443	49770	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:33.885071993 CEST	49770	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:33.885082006 CEST	443	49770	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:33.892828941 CEST	443	49772	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:33.893474102 CEST	49772	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:33.893488884 CEST	443	49772	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:33.893908024 CEST	49772	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:33.893914938 CEST	443	49772	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:33.925898075 CEST	443	49773	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:33.926337004 CEST	49773	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:33.926366091 CEST	443	49773	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:33.926795006 CEST	49773	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:33.926801920 CEST	443	49773	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:33.945453882 CEST	443	49769	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:33.945631027 CEST	443	49769	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:33.945760965 CEST	49769	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:33.947133064 CEST	49769	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:33.947150946 CEST	443	49769	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:33.947160959 CEST	49769	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:33.947165966 CEST	443	49769	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:33.950328112 CEST	49774	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:33.950370073 CEST	443	49774	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:33.950453997 CEST	49774	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:33.950635910 CEST	49774	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:33.950650930 CEST	443	49774	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.003591061 CEST	443	49771	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.003773928 CEST	443	49771	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.003874063 CEST	49771	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.003905058 CEST	49771	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.003926039 CEST	443	49771	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.003937960 CEST	49771	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.003942966 CEST	443	49771	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.006841898 CEST	49775	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.006876945 CEST	443	49775	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.006993055 CEST	49775	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.007150888 CEST	49775	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.007165909 CEST	443	49775	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.017978907 CEST	443	49770	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.018101931 CEST	443	49770	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.018162966 CEST	49770	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.018301964 CEST	49770	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.018312931 CEST	443	49770	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.021042109 CEST	49776	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.021090984 CEST	443	49776	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.021164894 CEST	49776	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.021348953 CEST	49776	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.021364927 CEST	443	49776	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.026292086 CEST	443	49772	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.026365042 CEST	443	49772	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.026514053 CEST	49772	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.026667118 CEST	49772	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.026688099 CEST	443	49772	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.026698112 CEST	49772	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.026704073 CEST	443	49772	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.029684067 CEST	49777	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.029721975 CEST	443	49777	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.029789925 CEST	49777	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.029951096 CEST	49777	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.029961109 CEST	443	49777	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.058837891 CEST	443	49773	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.059070110 CEST	443	49773	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.059156895 CEST	49773	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.062724113 CEST	49773	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.062741995 CEST	443	49773	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.062760115 CEST	49773	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.062767029 CEST	443	49773	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.069993973 CEST	49778	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.070025921 CEST	443	49778	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.070087910 CEST	49778	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.070235968 CEST	49778	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.070246935 CEST	443	49778	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.691205978 CEST	443	49774	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.691747904 CEST	49774	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.691765070 CEST	443	49774	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.692220926 CEST	49774	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.692225933 CEST	443	49774	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.736346960 CEST	49740	6302	192.168.2.9	185.196.9.26
Oct 18, 2024 00:27:34.742749929 CEST	6302	49740	185.196.9.26	192.168.2.9
Oct 18, 2024 00:27:34.768569946 CEST	443	49775	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.769356012 CEST	443	49776	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.769357920 CEST	49775	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.769376040 CEST	443	49775	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.769771099 CEST	49776	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.769823074 CEST	49775	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.769828081 CEST	443	49775	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.769830942 CEST	443	49776	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.770206928 CEST	49776	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.770215988 CEST	443	49776	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.770502090 CEST	443	49777	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.770920992 CEST	49777	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.770945072 CEST	443	49777	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.771404982 CEST	49777	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.771411896 CEST	443	49777	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.820219994 CEST	443	49778	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.821003914 CEST	49778	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.821027994 CEST	443	49778	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.821383953 CEST	49778	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.821403980 CEST	443	49778	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.824661970 CEST	443	49774	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.825057030 CEST	443	49774	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.825124979 CEST	49774	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.825164080 CEST	49774	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.825164080 CEST	49774	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.825185061 CEST	443	49774	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.825195074 CEST	443	49774	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.827970982 CEST	49779	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.828022957 CEST	443	49779	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.828084946 CEST	49779	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.828208923 CEST	49779	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.828223944 CEST	443	49779	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.903778076 CEST	443	49777	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.903875113 CEST	443	49777	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.903965950 CEST	49777	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.904274940 CEST	49777	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.904274940 CEST	49777	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.904289961 CEST	443	49777	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.904301882 CEST	443	49777	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.904483080 CEST	443	49776	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.904747963 CEST	443	49776	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.904803038 CEST	49776	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.905472040 CEST	49776	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.905472040 CEST	49776	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.905507088 CEST	443	49776	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.905520916 CEST	443	49776	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.906089067 CEST	443	49775	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.906156063 CEST	443	49775	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.906217098 CEST	49775	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.906403065 CEST	49775	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.906403065 CEST	49775	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.906416893 CEST	443	49775	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.906424999 CEST	443	49775	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.908262014 CEST	49780	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.908292055 CEST	443	49780	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.908359051 CEST	49780	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.909100056 CEST	49781	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.909125090 CEST	443	49781	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.909184933 CEST	49781	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.909239054 CEST	49782	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.909245014 CEST	443	49782	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.909288883 CEST	49782	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.909374952 CEST	49780	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.909390926 CEST	443	49780	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.909454107 CEST	49781	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.909465075 CEST	443	49781	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.909524918 CEST	49782	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.909534931 CEST	443	49782	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.957142115 CEST	443	49778	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.957374096 CEST	443	49778	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.957442045 CEST	49778	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.962218046 CEST	49778	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.962218046 CEST	49778	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.962249041 CEST	443	49778	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.962260008 CEST	443	49778	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.965787888 CEST	49783	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.965831995 CEST	443	49783	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:34.965905905 CEST	49783	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.966064930 CEST	49783	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:34.966079950 CEST	443	49783	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:35.049828053 CEST	6302	49740	185.196.9.26	192.168.2.9
Oct 18, 2024 00:27:35.049841881 CEST	6302	49740	185.196.9.26	192.168.2.9
Oct 18, 2024 00:27:35.049853086 CEST	6302	49740	185.196.9.26	192.168.2.9
Oct 18, 2024 00:27:35.049876928 CEST	49740	6302	192.168.2.9	185.196.9.26
Oct 18, 2024 00:27:35.049889088 CEST	6302	49740	185.196.9.26	192.168.2.9
Oct 18, 2024 00:27:35.049900055 CEST	6302	49740	185.196.9.26	192.168.2.9
Oct 18, 2024 00:27:35.049910069 CEST	6302	49740	185.196.9.26	192.168.2.9
Oct 18, 2024 00:27:35.049936056 CEST	49740	6302	192.168.2.9	185.196.9.26
Oct 18, 2024 00:27:35.049956083 CEST	49740	6302	192.168.2.9	185.196.9.26
Oct 18, 2024 00:27:35.373217106 CEST	49677	443	192.168.2.9	20.189.173.11
Oct 18, 2024 00:27:35.563755035 CEST	443	49779	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:35.564213991 CEST	49779	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:35.564237118 CEST	443	49779	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:35.564675093 CEST	49779	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:35.564680099 CEST	443	49779	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:35.645418882 CEST	443	49781	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:35.651505947 CEST	49781	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:35.651527882 CEST	443	49781	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:35.651946068 CEST	49781	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:35.651952028 CEST	443	49781	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:35.663163900 CEST	443	49782	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:35.663629055 CEST	49782	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:35.663645983 CEST	443	49782	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:35.664117098 CEST	49782	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:35.664123058 CEST	443	49782	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:35.665498972 CEST	443	49780	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:35.665797949 CEST	49780	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:35.665826082 CEST	443	49780	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:35.666223049 CEST	49780	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:35.666232109 CEST	443	49780	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:35.699379921 CEST	443	49779	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:35.699491978 CEST	443	49779	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:35.699563980 CEST	49779	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:35.699826956 CEST	49779	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:35.699843884 CEST	443	49779	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:35.699856043 CEST	49779	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:35.699862003 CEST	443	49779	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:35.703015089 CEST	49784	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:35.703057051 CEST	443	49784	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:35.703159094 CEST	49784	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:35.703305960 CEST	49784	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:35.703319073 CEST	443	49784	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:35.734870911 CEST	443	49783	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:35.735344887 CEST	49783	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:35.735362053 CEST	443	49783	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:35.735842943 CEST	49783	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:35.735848904 CEST	443	49783	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:35.780494928 CEST	443	49781	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:35.780714035 CEST	443	49781	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:35.780785084 CEST	49781	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:35.781056881 CEST	49781	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:35.781056881 CEST	49781	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:35.781073093 CEST	443	49781	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:35.781081915 CEST	443	49781	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:35.785285950 CEST	49785	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:35.785326958 CEST	443	49785	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:35.785458088 CEST	49785	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:35.785662889 CEST	49785	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:35.785682917 CEST	443	49785	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:35.800904989 CEST	443	49782	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:35.800971985 CEST	443	49782	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:35.801039934 CEST	49782	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:35.801408052 CEST	49782	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:35.801408052 CEST	49782	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:35.801414013 CEST	443	49782	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:35.801420927 CEST	443	49782	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:35.802148104 CEST	443	49780	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:35.802706957 CEST	443	49780	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:35.802782059 CEST	49780	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:35.804080009 CEST	49780	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:35.804080963 CEST	49786	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:35.804105043 CEST	443	49780	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:35.804117918 CEST	49780	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:35.804124117 CEST	443	49780	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:35.804130077 CEST	443	49786	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:35.804235935 CEST	49786	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:35.805425882 CEST	49786	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:35.805464983 CEST	443	49786	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:35.806369066 CEST	49787	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:35.806396008 CEST	443	49787	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:35.806464911 CEST	49787	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:35.806613922 CEST	49787	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:35.806627035 CEST	443	49787	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:35.871884108 CEST	443	49783	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:35.872148991 CEST	443	49783	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:35.872203112 CEST	49783	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:35.872246027 CEST	49783	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:35.872246027 CEST	49783	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:35.872263908 CEST	443	49783	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:35.872277021 CEST	443	49783	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:35.875713110 CEST	49788	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:35.875742912 CEST	443	49788	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:35.875808001 CEST	49788	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:35.875950098 CEST	49788	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:35.875955105 CEST	443	49788	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:36.419989109 CEST	49740	6302	192.168.2.9	185.196.9.26
Oct 18, 2024 00:27:36.424949884 CEST	6302	49740	185.196.9.26	192.168.2.9
Oct 18, 2024 00:27:36.424969912 CEST	6302	49740	185.196.9.26	192.168.2.9
Oct 18, 2024 00:27:36.424985886 CEST	6302	49740	185.196.9.26	192.168.2.9
Oct 18, 2024 00:27:36.424994946 CEST	6302	49740	185.196.9.26	192.168.2.9
Oct 18, 2024 00:27:36.425020933 CEST	49740	6302	192.168.2.9	185.196.9.26
Oct 18, 2024 00:27:36.425035954 CEST	6302	49740	185.196.9.26	192.168.2.9
Oct 18, 2024 00:27:36.425045013 CEST	6302	49740	185.196.9.26	192.168.2.9
Oct 18, 2024 00:27:36.425081015 CEST	6302	49740	185.196.9.26	192.168.2.9
Oct 18, 2024 00:27:36.425081968 CEST	49740	6302	192.168.2.9	185.196.9.26
Oct 18, 2024 00:27:36.425090075 CEST	6302	49740	185.196.9.26	192.168.2.9
Oct 18, 2024 00:27:36.425107002 CEST	6302	49740	185.196.9.26	192.168.2.9
Oct 18, 2024 00:27:36.425115108 CEST	6302	49740	185.196.9.26	192.168.2.9
Oct 18, 2024 00:27:36.429856062 CEST	6302	49740	185.196.9.26	192.168.2.9
Oct 18, 2024 00:27:36.429945946 CEST	6302	49740	185.196.9.26	192.168.2.9
Oct 18, 2024 00:27:36.429965019 CEST	6302	49740	185.196.9.26	192.168.2.9
Oct 18, 2024 00:27:36.430023909 CEST	6302	49740	185.196.9.26	192.168.2.9
Oct 18, 2024 00:27:36.430033922 CEST	6302	49740	185.196.9.26	192.168.2.9
Oct 18, 2024 00:27:36.430116892 CEST	6302	49740	185.196.9.26	192.168.2.9
Oct 18, 2024 00:27:36.430335999 CEST	6302	49740	185.196.9.26	192.168.2.9
Oct 18, 2024 00:27:36.464325905 CEST	443	49784	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:36.464812040 CEST	49784	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:36.464833021 CEST	443	49784	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:36.465615988 CEST	49784	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:36.465621948 CEST	443	49784	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:36.522721052 CEST	443	49785	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:36.523272991 CEST	49785	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:36.523284912 CEST	443	49785	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:36.523797035 CEST	49785	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:36.523806095 CEST	443	49785	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:36.532506943 CEST	443	49787	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:36.532968998 CEST	49787	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:36.532999039 CEST	443	49787	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:36.533519983 CEST	49787	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:36.533526897 CEST	443	49787	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:36.539887905 CEST	443	49786	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:36.540787935 CEST	49786	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:36.540787935 CEST	49786	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:36.540801048 CEST	443	49786	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:36.540828943 CEST	443	49786	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:36.595541000 CEST	443	49784	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:36.619997978 CEST	443	49784	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:36.620058060 CEST	49784	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:36.620136023 CEST	49784	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:36.620150089 CEST	443	49784	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:36.620177984 CEST	49784	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:36.620183945 CEST	443	49784	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:36.623039961 CEST	49789	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:36.623085022 CEST	443	49789	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:36.623194933 CEST	49789	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:36.623410940 CEST	49789	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:36.623425961 CEST	443	49789	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:36.652468920 CEST	443	49785	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:36.653260946 CEST	443	49785	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:36.653317928 CEST	49785	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:36.653398991 CEST	49785	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:36.653398991 CEST	49785	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:36.653415918 CEST	443	49785	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:36.653424025 CEST	443	49785	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:36.657042027 CEST	49790	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:36.657064915 CEST	443	49790	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:36.657174110 CEST	49790	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:36.657407045 CEST	49790	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:36.657421112 CEST	443	49790	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:36.660964012 CEST	443	49787	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:36.661266088 CEST	443	49787	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:36.661323071 CEST	49787	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:36.661523104 CEST	49787	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:36.661531925 CEST	443	49787	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:36.661546946 CEST	49787	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:36.661551952 CEST	443	49787	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:36.665807009 CEST	49791	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:36.665833950 CEST	443	49791	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:36.665901899 CEST	49791	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:36.666162968 CEST	49791	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:36.666176081 CEST	443	49791	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:36.669423103 CEST	443	49786	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:36.669568062 CEST	443	49786	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:36.669665098 CEST	49786	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:36.669749022 CEST	49786	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:36.669749022 CEST	49786	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:36.669765949 CEST	443	49786	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:36.669775963 CEST	443	49786	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:36.684385061 CEST	49792	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:36.684427023 CEST	443	49792	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:36.684480906 CEST	49792	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:36.684608936 CEST	49792	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:36.684619904 CEST	443	49792	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:36.894027948 CEST	6302	49740	185.196.9.26	192.168.2.9
Oct 18, 2024 00:27:36.894844055 CEST	49740	6302	192.168.2.9	185.196.9.26
Oct 18, 2024 00:27:36.899804115 CEST	6302	49740	185.196.9.26	192.168.2.9
Oct 18, 2024 00:27:37.160550117 CEST	6302	49740	185.196.9.26	192.168.2.9
Oct 18, 2024 00:27:37.201283932 CEST	49740	6302	192.168.2.9	185.196.9.26
Oct 18, 2024 00:27:37.204170942 CEST	49740	6302	192.168.2.9	185.196.9.26
Oct 18, 2024 00:27:37.364626884 CEST	443	49789	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:37.370182037 CEST	49789	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:37.370203018 CEST	443	49789	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:37.370994091 CEST	49789	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:37.371011972 CEST	443	49789	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:37.391238928 CEST	443	49790	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:37.391977072 CEST	49790	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:37.392002106 CEST	443	49790	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:37.392497063 CEST	49790	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:37.392504930 CEST	443	49790	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:37.399189949 CEST	443	49791	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:37.400054932 CEST	49791	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:37.400054932 CEST	49791	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:37.400074005 CEST	443	49791	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:37.400083065 CEST	443	49791	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:37.441230059 CEST	443	49792	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:37.441859961 CEST	49792	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:37.441883087 CEST	443	49792	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:37.442436934 CEST	49792	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:37.442441940 CEST	443	49792	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:37.497747898 CEST	443	49789	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:37.497769117 CEST	443	49789	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:37.497824907 CEST	443	49789	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:37.497853994 CEST	49789	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:37.497957945 CEST	49789	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:37.498261929 CEST	49789	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:37.498280048 CEST	443	49789	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:37.498306036 CEST	49789	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:37.498311996 CEST	443	49789	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:37.501255035 CEST	49793	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:37.501310110 CEST	443	49793	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:37.501597881 CEST	49793	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:37.501597881 CEST	49793	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:37.501633883 CEST	443	49793	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:37.520221949 CEST	443	49790	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:37.520292997 CEST	443	49790	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:37.520375013 CEST	49790	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:37.520684958 CEST	49790	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:37.520684958 CEST	49790	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:37.520701885 CEST	443	49790	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:37.520709991 CEST	443	49790	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:37.523471117 CEST	49794	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:37.523516893 CEST	443	49794	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:37.523772955 CEST	49794	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:37.524610996 CEST	49794	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:37.524627924 CEST	443	49794	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:37.534595013 CEST	443	49791	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:37.534890890 CEST	443	49791	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:37.534998894 CEST	49791	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:37.534998894 CEST	49791	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:37.535031080 CEST	49791	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:37.535046101 CEST	443	49791	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:37.538034916 CEST	49795	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:37.538065910 CEST	443	49795	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:37.538146973 CEST	49795	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:37.538312912 CEST	49795	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:37.538326025 CEST	443	49795	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:37.574366093 CEST	443	49792	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:37.574393988 CEST	443	49792	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:37.574453115 CEST	443	49792	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:37.574485064 CEST	49792	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:37.574768066 CEST	49792	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:37.574768066 CEST	49792	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:37.574947119 CEST	49792	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:37.574965954 CEST	443	49792	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:37.577764034 CEST	49796	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:37.577792883 CEST	443	49796	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:37.578022957 CEST	49796	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:37.578169107 CEST	49796	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:37.578182936 CEST	443	49796	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:37.621665001 CEST	443	49788	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:37.622203112 CEST	49788	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:37.622215033 CEST	443	49788	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:37.622852087 CEST	49788	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:37.622855902 CEST	443	49788	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:37.750547886 CEST	443	49788	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:37.750627041 CEST	443	49788	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:37.750679970 CEST	49788	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:37.750969887 CEST	49788	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:37.750982046 CEST	443	49788	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:37.751066923 CEST	49788	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:37.751075029 CEST	443	49788	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:37.754034042 CEST	49797	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:37.754084110 CEST	443	49797	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:37.754204035 CEST	49797	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:37.754472971 CEST	49797	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:37.754486084 CEST	443	49797	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:38.235727072 CEST	443	49793	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:38.237073898 CEST	49793	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:38.237088919 CEST	443	49793	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:38.237200022 CEST	49793	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:38.237205029 CEST	443	49793	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:38.277287960 CEST	443	49794	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:38.277975082 CEST	49794	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:38.277987003 CEST	443	49794	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:38.278459072 CEST	49794	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:38.278465033 CEST	443	49794	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:38.292043924 CEST	443	49795	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:38.292653084 CEST	49795	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:38.292680979 CEST	443	49795	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:38.293174028 CEST	49795	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:38.293184996 CEST	443	49795	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:38.320211887 CEST	443	49796	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:38.320844889 CEST	49796	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:38.320854902 CEST	443	49796	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:38.321424007 CEST	49796	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:38.321428061 CEST	443	49796	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:38.373727083 CEST	443	49793	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:38.373748064 CEST	443	49793	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:38.373815060 CEST	49793	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:38.373833895 CEST	443	49793	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:38.373859882 CEST	443	49793	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:38.373888016 CEST	49793	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:38.373923063 CEST	49793	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:38.374119997 CEST	49793	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:38.374135971 CEST	443	49793	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:38.374159098 CEST	49793	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:38.374165058 CEST	443	49793	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:38.376813889 CEST	49798	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:38.376851082 CEST	443	49798	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:38.376950979 CEST	49798	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:38.377110958 CEST	49798	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:38.377125978 CEST	443	49798	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:38.409521103 CEST	443	49794	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:38.409579992 CEST	443	49794	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:38.409703970 CEST	443	49794	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:38.409785986 CEST	49794	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:38.423073053 CEST	49794	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:38.423089027 CEST	443	49794	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:38.426162958 CEST	443	49795	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:38.427043915 CEST	443	49795	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:38.427098989 CEST	49795	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:38.427702904 CEST	49799	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:38.427733898 CEST	443	49799	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:38.427824020 CEST	49799	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:38.428389072 CEST	49799	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:38.428399086 CEST	443	49799	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:38.428587914 CEST	49795	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:38.428610086 CEST	443	49795	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:38.428621054 CEST	49795	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:38.428627014 CEST	443	49795	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:38.431334019 CEST	49800	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:38.431376934 CEST	443	49800	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:38.431497097 CEST	49800	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:38.431546926 CEST	49800	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:38.431555986 CEST	443	49800	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:38.476156950 CEST	443	49796	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:38.476247072 CEST	443	49796	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:38.476325989 CEST	49796	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:38.476576090 CEST	49796	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:38.476593971 CEST	443	49796	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:38.476604939 CEST	49796	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:38.476610899 CEST	443	49796	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:38.479768038 CEST	49801	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:38.479783058 CEST	443	49801	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:38.479968071 CEST	49801	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:38.480387926 CEST	49801	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:38.480400085 CEST	443	49801	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:38.517910004 CEST	443	49797	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:38.518454075 CEST	49797	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:38.518471956 CEST	443	49797	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:38.519110918 CEST	49797	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:38.519123077 CEST	443	49797	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:38.655452013 CEST	443	49797	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:38.655947924 CEST	443	49797	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:38.656008959 CEST	49797	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:38.656061888 CEST	49797	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:38.656076908 CEST	443	49797	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:38.656094074 CEST	49797	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:38.656100035 CEST	443	49797	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:38.658834934 CEST	49802	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:38.658864975 CEST	443	49802	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:38.658945084 CEST	49802	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:38.659192085 CEST	49802	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:38.659200907 CEST	443	49802	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:39.125487089 CEST	443	49798	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:39.126008034 CEST	49798	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:39.126022100 CEST	443	49798	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:39.126483917 CEST	49798	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:39.126490116 CEST	443	49798	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:39.193697929 CEST	443	49800	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:39.193994999 CEST	443	49799	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:39.194572926 CEST	49799	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:39.194591045 CEST	443	49799	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:39.194608927 CEST	49800	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:39.194621086 CEST	443	49800	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:39.195070028 CEST	49800	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:39.195075989 CEST	443	49800	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:39.195238113 CEST	49799	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:39.195242882 CEST	443	49799	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:39.232131958 CEST	443	49801	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:39.232634068 CEST	49801	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:39.232664108 CEST	443	49801	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:39.233124018 CEST	49801	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:39.233135939 CEST	443	49801	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:39.259627104 CEST	443	49798	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:39.259721994 CEST	443	49798	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:39.259830952 CEST	49798	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:39.260121107 CEST	49798	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:39.260133982 CEST	443	49798	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:39.260153055 CEST	49798	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:39.260159016 CEST	443	49798	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:39.262811899 CEST	49803	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:39.262846947 CEST	443	49803	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:39.263041973 CEST	49803	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:39.263185978 CEST	49803	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:39.263197899 CEST	443	49803	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:39.328107119 CEST	443	49799	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:39.328290939 CEST	443	49799	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:39.328350067 CEST	49799	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:39.328526020 CEST	49799	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:39.328541994 CEST	443	49799	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:39.328556061 CEST	49799	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:39.328562021 CEST	443	49799	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:39.331316948 CEST	49804	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:39.331357002 CEST	443	49804	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:39.331429958 CEST	49804	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:39.331583977 CEST	49804	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:39.331599951 CEST	443	49804	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:39.334016085 CEST	443	49800	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:39.334198952 CEST	443	49800	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:39.334247112 CEST	49800	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:39.334312916 CEST	49800	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:39.334331989 CEST	443	49800	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:39.334342957 CEST	49800	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:39.334348917 CEST	443	49800	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:39.336545944 CEST	49805	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:39.336601019 CEST	443	49805	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:39.336678028 CEST	49805	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:39.336790085 CEST	49805	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:39.336806059 CEST	443	49805	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:39.365319967 CEST	443	49801	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:39.365390062 CEST	443	49801	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:39.365443945 CEST	49801	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:39.365638971 CEST	49801	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:39.365659952 CEST	443	49801	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:39.365689993 CEST	49801	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:39.365695953 CEST	443	49801	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:39.368283987 CEST	49806	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:39.368309021 CEST	443	49806	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:39.368767023 CEST	49806	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:39.368904114 CEST	49806	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:39.368916035 CEST	443	49806	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:39.400017023 CEST	443	49802	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:39.400496960 CEST	49802	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:39.400512934 CEST	443	49802	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:39.401103973 CEST	49802	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:39.401108980 CEST	443	49802	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:39.533787966 CEST	443	49802	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:39.533868074 CEST	443	49802	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:39.533914089 CEST	49802	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:39.534100056 CEST	49802	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:39.534117937 CEST	443	49802	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:39.534128904 CEST	49802	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:39.534136057 CEST	443	49802	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:39.536870003 CEST	49807	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:39.536909103 CEST	443	49807	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:39.537097931 CEST	49807	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:39.537208080 CEST	49807	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:39.537223101 CEST	443	49807	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:40.017010927 CEST	443	49803	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:40.017652988 CEST	49803	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:40.017667055 CEST	443	49803	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:40.018655062 CEST	49803	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:40.018661976 CEST	443	49803	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:40.080694914 CEST	443	49804	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:40.081500053 CEST	49804	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:40.081516981 CEST	443	49804	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:40.081832886 CEST	49804	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:40.081845045 CEST	443	49804	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:40.089469910 CEST	443	49805	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:40.089881897 CEST	49805	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:40.089905024 CEST	443	49805	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:40.090409040 CEST	49805	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:40.090415001 CEST	443	49805	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:40.114479065 CEST	443	49806	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:40.115036011 CEST	49806	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:40.115053892 CEST	443	49806	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:40.115473986 CEST	49806	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:40.115479946 CEST	443	49806	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:40.149199009 CEST	443	49803	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:40.149346113 CEST	443	49803	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:40.149400949 CEST	49803	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:40.149571896 CEST	49803	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:40.149588108 CEST	443	49803	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:40.149600983 CEST	49803	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:40.149606943 CEST	443	49803	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:40.152498007 CEST	49808	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:40.152529001 CEST	443	49808	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:40.152848959 CEST	49808	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:40.153001070 CEST	49808	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:40.153014898 CEST	443	49808	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:40.212269068 CEST	443	49804	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:40.212356091 CEST	443	49804	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:40.212430954 CEST	49804	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:40.212616920 CEST	49804	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:40.212640047 CEST	443	49804	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:40.212680101 CEST	49804	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:40.212687016 CEST	443	49804	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:40.215569973 CEST	49809	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:40.215595007 CEST	443	49809	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:40.215658903 CEST	49809	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:40.215854883 CEST	49809	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:40.215866089 CEST	443	49809	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:40.227165937 CEST	443	49805	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:40.227194071 CEST	443	49805	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:40.227243900 CEST	443	49805	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:40.227255106 CEST	49805	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:40.227300882 CEST	49805	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:40.227478027 CEST	49805	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:40.227499008 CEST	443	49805	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:40.227514029 CEST	49805	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:40.227519035 CEST	443	49805	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:40.230431080 CEST	49810	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:40.230451107 CEST	443	49810	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:40.230516911 CEST	49810	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:40.230679989 CEST	49810	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:40.230688095 CEST	443	49810	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:40.253473997 CEST	443	49806	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:40.253705978 CEST	443	49806	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:40.253751993 CEST	49806	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:40.253784895 CEST	49806	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:40.253798962 CEST	443	49806	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:40.253810883 CEST	49806	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:40.253815889 CEST	443	49806	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:40.256757021 CEST	49811	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:40.256798983 CEST	443	49811	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:40.256861925 CEST	49811	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:40.257016897 CEST	49811	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:40.257031918 CEST	443	49811	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:40.300595999 CEST	443	49807	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:40.301101923 CEST	49807	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:40.301115036 CEST	443	49807	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:40.301584959 CEST	49807	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:40.301593065 CEST	443	49807	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:40.438041925 CEST	443	49807	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:40.438158035 CEST	443	49807	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:40.438201904 CEST	443	49807	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:40.438209057 CEST	49807	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:40.438272953 CEST	49807	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:40.438568115 CEST	49807	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:40.438568115 CEST	49807	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:40.438591957 CEST	443	49807	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:40.438600063 CEST	443	49807	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:40.441904068 CEST	49812	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:40.441935062 CEST	443	49812	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:40.442013025 CEST	49812	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:40.442290068 CEST	49812	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:40.442302942 CEST	443	49812	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:40.893625975 CEST	443	49808	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:40.894268990 CEST	49808	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:40.894283056 CEST	443	49808	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:40.894800901 CEST	49808	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:40.894805908 CEST	443	49808	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:40.955218077 CEST	443	49809	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:40.955868959 CEST	49809	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:40.955883026 CEST	443	49809	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:40.956412077 CEST	49809	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:40.956415892 CEST	443	49809	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.000335932 CEST	443	49811	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.001002073 CEST	49811	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:41.001017094 CEST	443	49811	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.001507998 CEST	49811	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:41.001512051 CEST	443	49811	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.006983995 CEST	443	49810	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.007406950 CEST	49810	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:41.007427931 CEST	443	49810	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.007854939 CEST	49810	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:41.007859945 CEST	443	49810	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.029138088 CEST	443	49808	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.029400110 CEST	443	49808	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.029474974 CEST	49808	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:41.029510021 CEST	49808	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:41.029510975 CEST	49808	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:41.029524088 CEST	443	49808	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.029536963 CEST	443	49808	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.032687902 CEST	49813	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:41.032732964 CEST	443	49813	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.032850027 CEST	49813	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:41.032954931 CEST	49813	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:41.032970905 CEST	443	49813	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.094141006 CEST	443	49809	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.094285011 CEST	443	49809	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.094444036 CEST	49809	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:41.094489098 CEST	49809	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:41.094502926 CEST	443	49809	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.094515085 CEST	49809	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:41.094521046 CEST	443	49809	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.097379923 CEST	49814	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:41.097403049 CEST	443	49814	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.097496033 CEST	49814	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:41.097649097 CEST	49814	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:41.097660065 CEST	443	49814	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.136259079 CEST	443	49811	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.136440992 CEST	443	49811	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.136487961 CEST	443	49811	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.136567116 CEST	49811	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:41.136625051 CEST	49811	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:41.136636972 CEST	443	49811	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.136646032 CEST	49811	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:41.136651039 CEST	443	49811	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.139774084 CEST	49815	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:41.139818907 CEST	443	49815	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.139920950 CEST	49815	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:41.140062094 CEST	49815	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:41.140105963 CEST	443	49815	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.150136948 CEST	443	49810	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.150229931 CEST	443	49810	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.150331974 CEST	49810	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:41.150532961 CEST	49810	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:41.150542974 CEST	443	49810	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.150552034 CEST	49810	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:41.150556087 CEST	443	49810	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.153083086 CEST	49816	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:41.153105021 CEST	443	49816	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.153182983 CEST	49816	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:41.153384924 CEST	49816	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:41.153399944 CEST	443	49816	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.196764946 CEST	443	49812	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.199580908 CEST	49812	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:41.199603081 CEST	443	49812	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.200086117 CEST	49812	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:41.200090885 CEST	443	49812	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.331609964 CEST	443	49812	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.331837893 CEST	443	49812	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.332051039 CEST	49812	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:41.332102060 CEST	49812	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:41.332102060 CEST	49812	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:41.332127094 CEST	443	49812	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.332149982 CEST	443	49812	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.334825039 CEST	49817	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:41.334860086 CEST	443	49817	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.335053921 CEST	49817	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:41.335222960 CEST	49817	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:41.335237980 CEST	443	49817	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.771080017 CEST	443	49813	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.771543980 CEST	49813	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:41.771565914 CEST	443	49813	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.772011042 CEST	49813	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:41.772016048 CEST	443	49813	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.850294113 CEST	443	49814	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.850774050 CEST	49814	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:41.850783110 CEST	443	49814	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.851226091 CEST	49814	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:41.851229906 CEST	443	49814	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.875005007 CEST	443	49815	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.875541925 CEST	49815	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:41.875550032 CEST	443	49815	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.876138926 CEST	49815	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:41.876142979 CEST	443	49815	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.911299944 CEST	443	49816	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.911782026 CEST	49816	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:41.911803007 CEST	443	49816	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.912266016 CEST	49816	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:41.912271976 CEST	443	49816	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.915584087 CEST	443	49813	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.915683985 CEST	443	49813	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.915749073 CEST	49813	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:41.915944099 CEST	49813	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:41.915975094 CEST	443	49813	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.915977955 CEST	49813	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:41.915985107 CEST	443	49813	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.918776035 CEST	49819	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:41.918811083 CEST	443	49819	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.918890953 CEST	49819	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:41.919049025 CEST	49819	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:41.919059038 CEST	443	49819	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.988966942 CEST	443	49814	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.989077091 CEST	443	49814	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.989166021 CEST	49814	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:41.989351988 CEST	49814	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:41.989371061 CEST	443	49814	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.989384890 CEST	49814	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:41.989389896 CEST	443	49814	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.992384911 CEST	49820	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:41.992428064 CEST	443	49820	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:41.993134975 CEST	49820	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:41.993486881 CEST	49820	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:41.993501902 CEST	443	49820	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.015748978 CEST	443	49815	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.016165972 CEST	443	49815	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.016216040 CEST	443	49815	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.016391039 CEST	49815	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:42.016391039 CEST	49815	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:42.016436100 CEST	49815	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:42.016455889 CEST	443	49815	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.019123077 CEST	49821	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:42.019160986 CEST	443	49821	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.019270897 CEST	49821	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:42.019417048 CEST	49821	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:42.019433975 CEST	443	49821	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.048665047 CEST	443	49816	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.048734903 CEST	443	49816	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.048844099 CEST	49816	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:42.049072027 CEST	49816	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:42.049078941 CEST	443	49816	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.049092054 CEST	49816	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:42.049097061 CEST	443	49816	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.052259922 CEST	49822	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:42.052293062 CEST	443	49822	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.052376986 CEST	49822	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:42.052536964 CEST	49822	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:42.052551031 CEST	443	49822	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.071120977 CEST	443	49817	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.073721886 CEST	49817	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:42.073741913 CEST	443	49817	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.074039936 CEST	49817	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:42.074053049 CEST	443	49817	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.206355095 CEST	443	49817	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.206387043 CEST	443	49817	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.206449986 CEST	443	49817	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.206458092 CEST	49817	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:42.206650972 CEST	49817	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:42.206753969 CEST	49817	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:42.206753969 CEST	49817	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:42.206777096 CEST	443	49817	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.206787109 CEST	443	49817	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.209897995 CEST	49823	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:42.209947109 CEST	443	49823	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.210042953 CEST	49823	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:42.210268974 CEST	49823	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:42.210280895 CEST	443	49823	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.670635939 CEST	443	49819	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.671155930 CEST	49819	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:42.671191931 CEST	443	49819	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.671720982 CEST	49819	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:42.671730042 CEST	443	49819	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.749238014 CEST	443	49820	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.749677896 CEST	49820	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:42.749706030 CEST	443	49820	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.750116110 CEST	49820	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:42.750122070 CEST	443	49820	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.768716097 CEST	443	49821	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.769087076 CEST	49821	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:42.769099951 CEST	443	49821	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.769495010 CEST	49821	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:42.769499063 CEST	443	49821	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.789632082 CEST	443	49822	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.789998055 CEST	49822	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:42.790008068 CEST	443	49822	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.790402889 CEST	49822	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:42.790406942 CEST	443	49822	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.807892084 CEST	443	49819	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.807956934 CEST	443	49819	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.808011055 CEST	49819	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:42.808259010 CEST	49819	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:42.808259010 CEST	49819	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:42.808274984 CEST	443	49819	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.808284044 CEST	443	49819	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.811194897 CEST	49824	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:42.811233997 CEST	443	49824	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.811291933 CEST	49824	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:42.811429024 CEST	49824	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:42.811443090 CEST	443	49824	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.886177063 CEST	443	49820	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.886279106 CEST	443	49820	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.886349916 CEST	49820	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:42.909456968 CEST	443	49821	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.909529924 CEST	443	49821	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.909609079 CEST	49821	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:42.914469004 CEST	49820	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:42.914469004 CEST	49820	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:42.914494038 CEST	443	49820	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.914504051 CEST	443	49820	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.920452118 CEST	49821	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:42.920475006 CEST	443	49821	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.920485973 CEST	49821	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:42.920494080 CEST	443	49821	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.922943115 CEST	443	49822	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.922970057 CEST	443	49822	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.923006058 CEST	49822	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:42.923013926 CEST	443	49822	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.923026085 CEST	443	49822	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.923074961 CEST	49822	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:42.924144030 CEST	49825	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:42.924166918 CEST	443	49825	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.924218893 CEST	49825	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:42.924262047 CEST	49822	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:42.924267054 CEST	443	49822	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.924276114 CEST	49822	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:42.924282074 CEST	443	49822	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.925960064 CEST	49826	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:42.925971031 CEST	443	49826	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.926012993 CEST	49826	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:42.927120924 CEST	49827	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:42.927151918 CEST	443	49827	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.927197933 CEST	49827	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:42.927238941 CEST	49825	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:42.927252054 CEST	443	49825	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.927335978 CEST	49826	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:42.927347898 CEST	443	49826	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.927660942 CEST	49827	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:42.927671909 CEST	443	49827	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.955410004 CEST	443	49823	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.955897093 CEST	49823	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:42.955910921 CEST	443	49823	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:42.956331015 CEST	49823	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:42.956336021 CEST	443	49823	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:43.090384007 CEST	443	49823	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:43.090451956 CEST	443	49823	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:43.090581894 CEST	49823	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:43.090867043 CEST	49823	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:43.090889931 CEST	443	49823	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:43.090903044 CEST	49823	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:43.090909004 CEST	443	49823	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:43.094208956 CEST	49828	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:43.094242096 CEST	443	49828	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:43.094311953 CEST	49828	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:43.094496012 CEST	49828	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:43.094506025 CEST	443	49828	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:43.669116974 CEST	443	49826	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:43.669645071 CEST	49826	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:43.669660091 CEST	443	49826	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:43.670171976 CEST	49826	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:43.670177937 CEST	443	49826	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:43.688286066 CEST	443	49825	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:43.688909054 CEST	49825	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:43.688920975 CEST	443	49825	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:43.689368963 CEST	49825	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:43.689373970 CEST	443	49825	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:43.695796967 CEST	443	49827	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:43.696120977 CEST	49827	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:43.696152925 CEST	443	49827	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:43.696460009 CEST	49827	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:43.696466923 CEST	443	49827	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:43.802436113 CEST	443	49826	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:43.802499056 CEST	443	49826	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:43.802578926 CEST	49826	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:43.802822113 CEST	49826	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:43.802849054 CEST	443	49826	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:43.802860975 CEST	49826	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:43.802866936 CEST	443	49826	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:43.806049109 CEST	49829	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:43.806082964 CEST	443	49829	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:43.806170940 CEST	49829	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:43.806509972 CEST	49829	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:43.806524038 CEST	443	49829	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:43.820404053 CEST	443	49828	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:43.820830107 CEST	49828	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:43.820854902 CEST	443	49828	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:43.821268082 CEST	49828	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:43.821276903 CEST	443	49828	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:43.826786995 CEST	443	49825	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:43.826814890 CEST	443	49825	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:43.826858044 CEST	443	49825	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:43.826927900 CEST	49825	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:43.827002048 CEST	49825	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:43.827002048 CEST	49825	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:43.827016115 CEST	443	49825	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:43.827024937 CEST	443	49825	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:43.829605103 CEST	49830	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:43.829634905 CEST	443	49830	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:43.829751015 CEST	49830	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:43.829926014 CEST	49830	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:43.829945087 CEST	443	49830	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:43.836344957 CEST	443	49827	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:43.836431026 CEST	443	49827	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:43.836560011 CEST	49827	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:43.836560011 CEST	49827	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:43.836594105 CEST	49827	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:43.836608887 CEST	443	49827	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:43.838706017 CEST	49831	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:43.838747025 CEST	443	49831	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:43.838816881 CEST	49831	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:43.838949919 CEST	49831	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:43.838963985 CEST	443	49831	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:43.953444958 CEST	443	49828	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:43.953506947 CEST	443	49828	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:43.953774929 CEST	49828	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:43.953835964 CEST	49828	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:43.953856945 CEST	443	49828	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:43.953869104 CEST	49828	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:43.953876019 CEST	443	49828	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:43.956687927 CEST	49832	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:43.956715107 CEST	443	49832	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:43.956799984 CEST	49832	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:43.956959009 CEST	49832	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:43.956971884 CEST	443	49832	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:44.041754007 CEST	443	49824	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:44.044991970 CEST	49824	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:44.045015097 CEST	443	49824	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:44.045535088 CEST	49824	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:44.045540094 CEST	443	49824	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:44.177284956 CEST	443	49824	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:44.177462101 CEST	443	49824	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:44.177546024 CEST	49824	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:44.177618027 CEST	49824	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:44.177618027 CEST	49824	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:44.177643061 CEST	443	49824	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:44.177648067 CEST	443	49824	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:44.180644035 CEST	49833	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:44.180692911 CEST	443	49833	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:44.180775881 CEST	49833	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:44.180968046 CEST	49833	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:44.180980921 CEST	443	49833	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:44.556461096 CEST	443	49829	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:44.557172060 CEST	49829	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:44.557198048 CEST	443	49829	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:44.557657003 CEST	49829	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:44.557671070 CEST	443	49829	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:44.577274084 CEST	443	49830	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:44.595343113 CEST	443	49831	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:44.604093075 CEST	49830	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:44.604110003 CEST	443	49830	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:44.604604959 CEST	49830	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:44.604618073 CEST	443	49830	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:44.605144978 CEST	49831	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:44.605170965 CEST	443	49831	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:44.605634928 CEST	49831	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:44.605643034 CEST	443	49831	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:44.690980911 CEST	443	49829	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:44.691046953 CEST	443	49829	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:44.691134930 CEST	49829	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:44.691404104 CEST	49829	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:44.691404104 CEST	49829	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:44.691442966 CEST	443	49829	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:44.691447973 CEST	443	49829	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:44.694497108 CEST	49834	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:44.694535971 CEST	443	49834	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:44.694670916 CEST	49834	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:44.694842100 CEST	49834	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:44.694852114 CEST	443	49834	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:44.701950073 CEST	443	49832	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:44.702526093 CEST	49832	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:44.702548027 CEST	443	49832	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:44.703147888 CEST	49832	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:44.703154087 CEST	443	49832	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:44.739557981 CEST	443	49830	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:44.739588976 CEST	443	49830	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:44.739645958 CEST	443	49830	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:44.739681005 CEST	49830	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:44.739720106 CEST	49830	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:44.740015984 CEST	49830	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:44.740015984 CEST	49830	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:44.740034103 CEST	443	49830	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:44.740046024 CEST	443	49830	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:44.742533922 CEST	443	49831	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:44.742604017 CEST	443	49831	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:44.742697954 CEST	49831	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:44.742861986 CEST	49831	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:44.742878914 CEST	443	49831	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:44.742894888 CEST	49831	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:44.742899895 CEST	443	49831	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:44.743143082 CEST	49835	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:44.743205070 CEST	443	49835	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:44.743282080 CEST	49835	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:44.743427038 CEST	49835	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:44.743447065 CEST	443	49835	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:44.745198965 CEST	49836	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:44.745227098 CEST	443	49836	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:44.745295048 CEST	49836	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:44.745435953 CEST	49836	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:44.745449066 CEST	443	49836	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:44.836976051 CEST	443	49832	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:44.837040901 CEST	443	49832	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:44.837115049 CEST	49832	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:44.837342024 CEST	49832	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:44.837349892 CEST	443	49832	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:44.837363005 CEST	49832	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:44.837369919 CEST	443	49832	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:44.839965105 CEST	49837	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:44.839993000 CEST	443	49837	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:44.840055943 CEST	49837	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:44.840193987 CEST	49837	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:44.840204954 CEST	443	49837	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:44.946707010 CEST	443	49833	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:44.947314978 CEST	49833	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:44.947348118 CEST	443	49833	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:44.947948933 CEST	49833	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:44.947953939 CEST	443	49833	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:45.081612110 CEST	443	49833	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:45.081752062 CEST	443	49833	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:45.081825972 CEST	49833	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:45.082041025 CEST	49833	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:45.082050085 CEST	443	49833	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:45.082061052 CEST	49833	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:45.082066059 CEST	443	49833	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:45.084532976 CEST	49838	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:45.084553003 CEST	443	49838	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:45.084619045 CEST	49838	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:45.084739923 CEST	49838	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:45.084752083 CEST	443	49838	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:45.452490091 CEST	443	49834	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:45.453761101 CEST	49834	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:45.453793049 CEST	443	49834	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:45.455121040 CEST	49834	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:45.455126047 CEST	443	49834	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:45.477406979 CEST	443	49835	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:45.478796959 CEST	49835	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:45.478840113 CEST	443	49835	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:45.479706049 CEST	49835	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:45.479713917 CEST	443	49835	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:45.481333017 CEST	443	49836	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:45.481769085 CEST	49836	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:45.481787920 CEST	443	49836	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:45.484379053 CEST	49836	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:45.484389067 CEST	443	49836	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:45.578986883 CEST	443	49837	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:45.585180998 CEST	49837	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:45.585207939 CEST	443	49837	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:45.586077929 CEST	49837	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:45.586086035 CEST	443	49837	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:45.591825008 CEST	443	49834	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:45.591850996 CEST	443	49834	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:45.591906071 CEST	443	49834	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:45.591905117 CEST	49834	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:45.591958046 CEST	49834	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:45.592185020 CEST	49834	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:45.592206955 CEST	443	49834	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:45.592219114 CEST	49834	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:45.592225075 CEST	443	49834	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:45.595922947 CEST	49839	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:45.595957041 CEST	443	49839	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:45.596019983 CEST	49839	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:45.596242905 CEST	49839	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:45.596257925 CEST	443	49839	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:45.617542982 CEST	443	49835	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:45.617607117 CEST	443	49835	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:45.617679119 CEST	49835	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:45.618190050 CEST	49835	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:45.618211031 CEST	443	49835	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:45.618222952 CEST	49835	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:45.618231058 CEST	443	49835	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:45.621056080 CEST	443	49836	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:45.621120930 CEST	443	49836	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:45.621166945 CEST	49836	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:45.621174097 CEST	443	49836	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:45.621217012 CEST	49836	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:45.621356010 CEST	49836	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:45.621371031 CEST	443	49836	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:45.621387005 CEST	49836	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:45.621392965 CEST	443	49836	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:45.647267103 CEST	49840	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:45.647310972 CEST	443	49840	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:45.647413969 CEST	49840	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:45.647950888 CEST	49840	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:45.647964954 CEST	443	49840	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:45.648813963 CEST	49841	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:45.648866892 CEST	443	49841	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:45.648919106 CEST	49841	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:45.649173975 CEST	49841	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:45.649185896 CEST	443	49841	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:45.713452101 CEST	443	49837	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:45.713527918 CEST	443	49837	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:45.713584900 CEST	49837	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:45.713732958 CEST	49837	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:45.713752031 CEST	443	49837	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:45.713762045 CEST	49837	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:45.713767052 CEST	443	49837	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:45.716572046 CEST	49842	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:45.716623068 CEST	443	49842	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:45.716674089 CEST	49842	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:45.716933012 CEST	49842	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:45.716952085 CEST	443	49842	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:45.847562075 CEST	443	49838	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:45.848129034 CEST	49838	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:45.848146915 CEST	443	49838	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:45.848583937 CEST	49838	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:45.848592043 CEST	443	49838	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:45.984730005 CEST	443	49838	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:45.984760046 CEST	443	49838	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:45.984806061 CEST	443	49838	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:45.984863043 CEST	49838	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:45.984863043 CEST	49838	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:45.985115051 CEST	49838	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:45.985115051 CEST	49838	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:45.985135078 CEST	443	49838	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:45.985145092 CEST	443	49838	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:45.988188028 CEST	49843	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:45.988233089 CEST	443	49843	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:45.988903999 CEST	49843	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:45.989038944 CEST	49843	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:45.989067078 CEST	443	49843	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:46.360723019 CEST	443	49839	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:46.361963034 CEST	49839	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:46.361982107 CEST	443	49839	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:46.362440109 CEST	49839	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:46.362445116 CEST	443	49839	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:46.375861883 CEST	443	49841	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:46.376317024 CEST	49841	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:46.376332998 CEST	443	49841	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:46.376760006 CEST	49841	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:46.376765966 CEST	443	49841	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:46.404886007 CEST	443	49840	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:46.405438900 CEST	49840	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:46.405457020 CEST	443	49840	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:46.405816078 CEST	49840	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:46.405822039 CEST	443	49840	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:46.452861071 CEST	443	49842	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:46.453419924 CEST	49842	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:46.453439951 CEST	443	49842	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:46.453881025 CEST	49842	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:46.453886986 CEST	443	49842	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:46.497155905 CEST	443	49839	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:46.497302055 CEST	443	49839	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:46.497402906 CEST	49839	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:46.497591019 CEST	49839	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:46.497603893 CEST	443	49839	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:46.497615099 CEST	49839	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:46.497620106 CEST	443	49839	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:46.500355959 CEST	49844	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:46.500384092 CEST	443	49844	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:46.500508070 CEST	49844	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:46.500739098 CEST	49844	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:46.500756025 CEST	443	49844	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:46.507498980 CEST	443	49841	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:46.507586002 CEST	443	49841	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:46.507678986 CEST	49841	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:46.507791996 CEST	49841	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:46.507812977 CEST	443	49841	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:46.507818937 CEST	49841	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:46.507824898 CEST	443	49841	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:46.510446072 CEST	49845	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:46.510479927 CEST	443	49845	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:46.510693073 CEST	49845	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:46.510694027 CEST	49845	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:46.510726929 CEST	443	49845	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:46.542398930 CEST	443	49840	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:46.542428970 CEST	443	49840	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:46.542469978 CEST	443	49840	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:46.542525053 CEST	49840	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:46.542577028 CEST	49840	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:46.542844057 CEST	49840	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:46.542844057 CEST	49840	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:46.542865992 CEST	443	49840	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:46.542876005 CEST	443	49840	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:46.546036959 CEST	49846	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:46.546062946 CEST	443	49846	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:46.546204090 CEST	49846	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:46.546567917 CEST	49846	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:46.546578884 CEST	443	49846	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:46.586424112 CEST	443	49842	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:46.586452961 CEST	443	49842	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:46.586503983 CEST	443	49842	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:46.586550951 CEST	49842	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:46.586592913 CEST	49842	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:46.586836100 CEST	49842	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:46.586848021 CEST	443	49842	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:46.586857080 CEST	49842	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:46.586860895 CEST	443	49842	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:46.589971066 CEST	49847	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:46.590013981 CEST	443	49847	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:46.590183020 CEST	49847	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:46.590329885 CEST	49847	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:46.590348005 CEST	443	49847	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:46.712260008 CEST	443	49843	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:46.713820934 CEST	49843	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:46.713845968 CEST	443	49843	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:46.714092970 CEST	49843	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:46.714099884 CEST	443	49843	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:46.842880011 CEST	443	49843	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:46.842961073 CEST	443	49843	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:46.843050957 CEST	49843	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:46.843336105 CEST	49843	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:46.843336105 CEST	49843	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:46.843353033 CEST	443	49843	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:46.843364954 CEST	443	49843	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:46.846295118 CEST	49848	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:46.846326113 CEST	443	49848	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:46.846417904 CEST	49848	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:46.846591949 CEST	49848	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:46.846607924 CEST	443	49848	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:47.251632929 CEST	443	49845	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:47.252300024 CEST	49845	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:47.252321005 CEST	443	49845	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:47.252753973 CEST	49845	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:47.252758980 CEST	443	49845	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:47.264700890 CEST	443	49844	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:47.265398979 CEST	49844	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:47.265414000 CEST	443	49844	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:47.265943050 CEST	49844	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:47.265949965 CEST	443	49844	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:47.309309006 CEST	443	49846	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:47.309972048 CEST	49846	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:47.309986115 CEST	443	49846	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:47.310399055 CEST	49846	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:47.310403109 CEST	443	49846	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:47.446238041 CEST	443	49847	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:47.446891069 CEST	49847	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:47.446909904 CEST	443	49847	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:47.447411060 CEST	49847	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:47.447422028 CEST	443	49847	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:47.451273918 CEST	443	49845	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:47.451349974 CEST	443	49845	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:47.451406002 CEST	49845	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:47.451591969 CEST	49845	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:47.451611996 CEST	443	49845	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:47.451626062 CEST	49845	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:47.451632023 CEST	443	49845	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:47.452429056 CEST	443	49844	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:47.452532053 CEST	443	49844	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:47.452578068 CEST	49844	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:47.452682018 CEST	49844	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:47.452701092 CEST	443	49844	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:47.452713013 CEST	49844	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:47.452718973 CEST	443	49844	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:47.454380035 CEST	49849	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:47.454406023 CEST	443	49849	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:47.454500914 CEST	49849	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:47.454677105 CEST	49849	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:47.454677105 CEST	49850	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:47.454693079 CEST	443	49849	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:47.454703093 CEST	443	49850	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:47.454756975 CEST	49850	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:47.454937935 CEST	49850	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:47.454953909 CEST	443	49850	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:47.455513954 CEST	443	49846	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:47.455539942 CEST	443	49846	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:47.455581903 CEST	443	49846	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:47.455585957 CEST	49846	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:47.455622911 CEST	49846	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:47.455775023 CEST	49846	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:47.455784082 CEST	443	49846	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:47.455800056 CEST	49846	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:47.455804110 CEST	443	49846	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:47.457977057 CEST	49851	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:47.458009005 CEST	443	49851	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:47.458092928 CEST	49851	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:47.458228111 CEST	49851	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:47.458240032 CEST	443	49851	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:47.587697983 CEST	443	49847	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:47.587765932 CEST	443	49847	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:47.587848902 CEST	49847	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:47.588099003 CEST	49847	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:47.588119984 CEST	443	49847	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:47.588133097 CEST	49847	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:47.588145971 CEST	443	49847	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:47.591176987 CEST	49852	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:47.591233969 CEST	443	49852	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:47.591339111 CEST	49852	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:47.591519117 CEST	49852	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:47.591530085 CEST	443	49852	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:47.700711012 CEST	443	49848	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:47.701934099 CEST	49848	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:47.701950073 CEST	443	49848	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:47.702399015 CEST	49848	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:47.702404022 CEST	443	49848	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:47.836543083 CEST	443	49848	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:47.837415934 CEST	443	49848	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:47.837476015 CEST	443	49848	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:47.837481022 CEST	49848	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:47.837524891 CEST	49848	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:47.837569952 CEST	49848	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:47.837591887 CEST	443	49848	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:47.837603092 CEST	49848	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:47.837608099 CEST	443	49848	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:47.840321064 CEST	49853	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:47.840369940 CEST	443	49853	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:47.840476036 CEST	49853	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:47.840589046 CEST	49853	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:47.840600967 CEST	443	49853	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:48.186471939 CEST	443	49850	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:48.190644979 CEST	49850	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:48.190665960 CEST	443	49850	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:48.191123009 CEST	49850	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:48.191129923 CEST	443	49850	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:48.203984976 CEST	443	49851	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:48.209959030 CEST	49851	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:48.209969997 CEST	443	49851	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:48.210520029 CEST	49851	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:48.210524082 CEST	443	49851	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:48.216510057 CEST	443	49849	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:48.217660904 CEST	49849	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:48.217674017 CEST	443	49849	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:48.218126059 CEST	49849	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:48.218132019 CEST	443	49849	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:48.318490982 CEST	443	49850	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:48.320054054 CEST	443	49850	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:48.320108891 CEST	49850	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:48.320234060 CEST	49850	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:48.320234060 CEST	49850	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:48.320247889 CEST	443	49850	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:48.320256948 CEST	443	49850	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:48.323443890 CEST	49854	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:48.323486090 CEST	443	49854	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:48.323589087 CEST	49854	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:48.323759079 CEST	49854	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:48.323766947 CEST	443	49854	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:48.337728024 CEST	443	49851	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:48.337796926 CEST	443	49851	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:48.337842941 CEST	49851	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:48.337995052 CEST	49851	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:48.338011980 CEST	443	49851	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:48.338025093 CEST	49851	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:48.338031054 CEST	443	49851	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:48.340918064 CEST	49855	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:48.340980053 CEST	443	49855	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:48.341089010 CEST	49855	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:48.341254950 CEST	49855	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:48.341270924 CEST	443	49855	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:48.355811119 CEST	443	49849	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:48.355879068 CEST	443	49849	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:48.355941057 CEST	49849	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:48.356125116 CEST	49849	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:48.356137991 CEST	443	49849	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:48.356144905 CEST	49849	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:48.356149912 CEST	443	49849	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:48.359523058 CEST	49856	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:48.359555006 CEST	443	49856	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:48.359622002 CEST	49856	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:48.359787941 CEST	49856	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:48.359798908 CEST	443	49856	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:48.361556053 CEST	443	49852	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:48.361972094 CEST	49852	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:48.362015009 CEST	443	49852	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:48.362483025 CEST	49852	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:48.362490892 CEST	443	49852	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:48.499088049 CEST	443	49852	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:48.499392033 CEST	443	49852	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:48.499448061 CEST	443	49852	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:48.499607086 CEST	49852	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:48.499608040 CEST	49852	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:48.499608040 CEST	49852	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:48.502159119 CEST	49857	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:48.502194881 CEST	443	49857	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:48.502280951 CEST	49857	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:48.502299070 CEST	49852	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:48.502334118 CEST	443	49852	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:48.502454042 CEST	49857	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:48.502460957 CEST	443	49857	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:48.567055941 CEST	443	49853	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:48.567764044 CEST	49853	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:48.567785025 CEST	443	49853	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:48.568126917 CEST	49853	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:48.568136930 CEST	443	49853	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:48.697860003 CEST	443	49853	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:48.697936058 CEST	443	49853	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:48.698163986 CEST	49853	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:48.698239088 CEST	49853	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:48.698257923 CEST	443	49853	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:48.698270082 CEST	49853	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:48.698276043 CEST	443	49853	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:48.701128006 CEST	49858	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:48.701179981 CEST	443	49858	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:48.701277971 CEST	49858	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:48.701708078 CEST	49858	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:48.701723099 CEST	443	49858	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:49.088459969 CEST	443	49854	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:49.089066029 CEST	49854	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:49.089097977 CEST	443	49854	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:49.089517117 CEST	49854	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:49.089531898 CEST	443	49854	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:49.115756035 CEST	443	49855	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:49.116455078 CEST	49855	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:49.116468906 CEST	443	49855	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:49.117077112 CEST	49855	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:49.117082119 CEST	443	49855	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:49.118963957 CEST	443	49856	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:49.119415998 CEST	49856	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:49.119424105 CEST	443	49856	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:49.119960070 CEST	49856	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:49.119965076 CEST	443	49856	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:49.223423004 CEST	443	49854	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:49.223495960 CEST	443	49854	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:49.223628998 CEST	443	49854	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:49.223638058 CEST	49854	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:49.223758936 CEST	49854	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:49.223994970 CEST	49854	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:49.224021912 CEST	443	49854	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:49.224040031 CEST	49854	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:49.224049091 CEST	443	49854	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:49.227263927 CEST	49859	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:49.227300882 CEST	443	49859	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:49.227401972 CEST	49859	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:49.227581024 CEST	49859	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:49.227593899 CEST	443	49859	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:49.256181955 CEST	443	49855	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:49.256249905 CEST	443	49855	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:49.256308079 CEST	49855	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:49.256490946 CEST	49855	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:49.256510973 CEST	443	49855	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:49.256525993 CEST	49855	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:49.256531954 CEST	443	49855	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:49.259094954 CEST	49860	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:49.259121895 CEST	443	49860	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:49.259206057 CEST	49860	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:49.259365082 CEST	49860	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:49.259382010 CEST	443	49860	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:49.261290073 CEST	443	49856	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:49.261365891 CEST	443	49856	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:49.261413097 CEST	49856	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:49.261485100 CEST	49856	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:49.261493921 CEST	443	49856	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:49.261504889 CEST	49856	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:49.261509895 CEST	443	49856	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:49.262356043 CEST	443	49857	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:49.262769938 CEST	49857	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:49.262780905 CEST	443	49857	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:49.263206005 CEST	49857	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:49.263210058 CEST	443	49857	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:49.263634920 CEST	49861	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:49.263678074 CEST	443	49861	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:49.263772964 CEST	49861	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:49.263926029 CEST	49861	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:49.263940096 CEST	443	49861	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:49.403011084 CEST	443	49857	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:49.403098106 CEST	443	49857	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:49.403147936 CEST	49857	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:49.403326988 CEST	49857	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:49.403342009 CEST	443	49857	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:49.403352976 CEST	49857	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:49.403357983 CEST	443	49857	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:49.408052921 CEST	49862	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:49.408107042 CEST	443	49862	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:49.408174992 CEST	49862	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:49.408332109 CEST	49862	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:49.408351898 CEST	443	49862	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:49.455948114 CEST	443	49858	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:49.456665993 CEST	49858	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:49.456685066 CEST	443	49858	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:49.457237959 CEST	49858	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:49.457242966 CEST	443	49858	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:49.590414047 CEST	443	49858	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:49.590972900 CEST	443	49858	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:49.591048956 CEST	49858	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:49.591125011 CEST	49858	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:49.591137886 CEST	443	49858	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:49.591150045 CEST	49858	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:49.591155052 CEST	443	49858	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:49.594002008 CEST	49863	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:49.594037056 CEST	443	49863	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:49.594111919 CEST	49863	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:49.594257116 CEST	49863	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:49.594274998 CEST	443	49863	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:49.963793993 CEST	443	49859	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:49.964209080 CEST	49859	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:49.964227915 CEST	443	49859	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:49.964636087 CEST	49859	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:49.964641094 CEST	443	49859	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:49.996732950 CEST	443	49860	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:49.996980906 CEST	443	49861	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:49.997229099 CEST	49860	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:49.997246981 CEST	443	49860	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:49.997273922 CEST	49861	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:49.997293949 CEST	443	49861	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:49.997752905 CEST	49861	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:49.997757912 CEST	443	49861	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:49.997961044 CEST	49860	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:49.997966051 CEST	443	49860	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:50.107175112 CEST	443	49859	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:50.107321978 CEST	443	49859	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:50.107430935 CEST	49859	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:50.107695103 CEST	49859	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:50.107716084 CEST	443	49859	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:50.107729912 CEST	49859	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:50.107736111 CEST	443	49859	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:50.110774994 CEST	49864	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:50.110811949 CEST	443	49864	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:50.110908031 CEST	49864	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:50.111083984 CEST	49864	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:50.111098051 CEST	443	49864	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:50.131977081 CEST	443	49860	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:50.132230043 CEST	443	49860	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:50.132304907 CEST	49860	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:50.132361889 CEST	49860	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:50.132361889 CEST	49860	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:50.132380962 CEST	443	49860	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:50.132394075 CEST	443	49860	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:50.133904934 CEST	443	49861	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:50.134054899 CEST	443	49861	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:50.134116888 CEST	49861	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:50.134161949 CEST	49861	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:50.134177923 CEST	443	49861	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:50.134187937 CEST	49861	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:50.134193897 CEST	443	49861	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:50.135202885 CEST	49865	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:50.135246992 CEST	443	49865	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:50.135317087 CEST	49865	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:50.135457039 CEST	49865	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:50.135469913 CEST	443	49865	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:50.136281013 CEST	49866	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:50.136312008 CEST	443	49866	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:50.136379004 CEST	49866	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:50.136528015 CEST	49866	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:50.136544943 CEST	443	49866	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:50.144695044 CEST	443	49862	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:50.145090103 CEST	49862	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:50.145103931 CEST	443	49862	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:50.145530939 CEST	49862	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:50.145535946 CEST	443	49862	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:50.285187960 CEST	443	49862	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:50.285219908 CEST	443	49862	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:50.285284996 CEST	49862	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:50.285286903 CEST	443	49862	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:50.285351038 CEST	49862	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:50.285548925 CEST	49862	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:50.285558939 CEST	443	49862	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:50.285567045 CEST	49862	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:50.285571098 CEST	443	49862	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:50.288140059 CEST	49867	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:50.288173914 CEST	443	49867	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:50.288290977 CEST	49867	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:50.288353920 CEST	49867	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:50.288361073 CEST	443	49867	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:50.365272045 CEST	443	49863	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:50.366107941 CEST	49863	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:50.366125107 CEST	443	49863	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:50.366883993 CEST	49863	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:50.366889954 CEST	443	49863	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:50.498558044 CEST	443	49863	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:50.498704910 CEST	443	49863	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:50.498817921 CEST	49863	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:50.589288950 CEST	49863	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:50.589288950 CEST	49863	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:50.589306116 CEST	443	49863	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:50.589324951 CEST	443	49863	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:50.647244930 CEST	49868	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:50.647283077 CEST	443	49868	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:50.647351027 CEST	49868	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:50.662390947 CEST	49868	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:50.662408113 CEST	443	49868	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:50.878566980 CEST	443	49864	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:50.880800009 CEST	443	49866	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:50.883553028 CEST	49864	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:50.883569002 CEST	443	49864	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:50.883999109 CEST	49864	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:50.884005070 CEST	443	49864	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:50.884300947 CEST	49866	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:50.884330988 CEST	443	49866	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:50.884673119 CEST	49866	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:50.884682894 CEST	443	49866	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:50.891469002 CEST	443	49865	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:50.891846895 CEST	49865	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:50.891875029 CEST	443	49865	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:50.892244101 CEST	49865	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:50.892251968 CEST	443	49865	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.013998985 CEST	443	49866	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.014027119 CEST	443	49866	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.014062881 CEST	443	49864	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.014092922 CEST	443	49866	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.014107943 CEST	49866	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.014152050 CEST	49866	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.014225006 CEST	443	49864	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.014343023 CEST	49864	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.014390945 CEST	49866	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.014413118 CEST	443	49866	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.014425993 CEST	49866	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.014427900 CEST	49864	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.014431953 CEST	443	49866	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.014442921 CEST	443	49864	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.014461040 CEST	49864	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.014466047 CEST	443	49864	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.017469883 CEST	49869	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.017513990 CEST	443	49869	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.017525911 CEST	49870	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.017533064 CEST	443	49870	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.017581940 CEST	49869	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.017611980 CEST	49870	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.017731905 CEST	49870	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.017744064 CEST	443	49870	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.017775059 CEST	49869	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.017787933 CEST	443	49869	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.020994902 CEST	443	49867	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.021398067 CEST	49867	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.021409988 CEST	443	49867	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.021738052 CEST	49867	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.021744013 CEST	443	49867	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.026902914 CEST	443	49865	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.026962042 CEST	443	49865	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.027018070 CEST	49865	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.027124882 CEST	49865	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.027132034 CEST	443	49865	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.027141094 CEST	49865	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.027147055 CEST	443	49865	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.029206991 CEST	49871	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.029237032 CEST	443	49871	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.029357910 CEST	49871	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.029550076 CEST	49871	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.029570103 CEST	443	49871	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.155339956 CEST	443	49867	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.155390024 CEST	443	49867	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.155495882 CEST	49867	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.155518055 CEST	443	49867	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.155656099 CEST	443	49867	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.155702114 CEST	49867	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.155702114 CEST	49867	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.155728102 CEST	443	49867	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.155740976 CEST	49867	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.155746937 CEST	443	49867	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.158616066 CEST	49872	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.158649921 CEST	443	49872	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.158732891 CEST	49872	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.158879042 CEST	49872	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.158891916 CEST	443	49872	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.401355982 CEST	443	49868	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.402074099 CEST	49868	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.402100086 CEST	443	49868	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.402509928 CEST	49868	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.402517080 CEST	443	49868	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.535901070 CEST	443	49868	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.536050081 CEST	443	49868	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.536101103 CEST	443	49868	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.536153078 CEST	49868	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.536153078 CEST	49868	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.536256075 CEST	49868	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.536256075 CEST	49868	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.536276102 CEST	443	49868	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.536286116 CEST	443	49868	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.538939953 CEST	49873	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.538995028 CEST	443	49873	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.539112091 CEST	49873	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.539252996 CEST	49873	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.539268017 CEST	443	49873	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.758347034 CEST	443	49869	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.758938074 CEST	49869	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.758965015 CEST	443	49869	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.759377003 CEST	49869	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.759392023 CEST	443	49869	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.762191057 CEST	443	49871	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.762552023 CEST	49871	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.762573957 CEST	443	49871	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.762985945 CEST	49871	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.762991905 CEST	443	49871	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.771750927 CEST	443	49870	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.772180080 CEST	49870	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.772188902 CEST	443	49870	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.772614956 CEST	49870	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.772619963 CEST	443	49870	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.891866922 CEST	443	49869	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.891947985 CEST	443	49869	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.892002106 CEST	49869	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.892191887 CEST	49869	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.892213106 CEST	443	49869	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.892225981 CEST	49869	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.892235041 CEST	443	49869	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.894989967 CEST	49874	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.895034075 CEST	443	49874	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.895374060 CEST	49874	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.895374060 CEST	49874	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.895414114 CEST	443	49874	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.895680904 CEST	443	49871	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.895742893 CEST	443	49871	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.895802975 CEST	49871	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.895932913 CEST	49871	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.895956993 CEST	443	49871	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.896215916 CEST	49871	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.896225929 CEST	443	49871	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.897953033 CEST	49875	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.897984028 CEST	443	49875	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.898051977 CEST	49875	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.898178101 CEST	49875	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.898190022 CEST	443	49875	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.907294989 CEST	443	49872	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.907742977 CEST	49872	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.907753944 CEST	443	49872	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.908185959 CEST	49872	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.908190966 CEST	443	49872	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.908915043 CEST	443	49870	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.908971071 CEST	443	49870	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.909014940 CEST	49870	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.909018993 CEST	443	49870	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.909056902 CEST	49870	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.909123898 CEST	49870	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.909131050 CEST	443	49870	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.909142017 CEST	49870	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.909147024 CEST	443	49870	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.911454916 CEST	49876	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.911493063 CEST	443	49876	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:51.911747932 CEST	49876	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.911886930 CEST	49876	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:51.911899090 CEST	443	49876	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:52.043275118 CEST	443	49872	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:52.043304920 CEST	443	49872	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:52.043344021 CEST	49872	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:52.043359995 CEST	443	49872	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:52.043380022 CEST	443	49872	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:52.043436050 CEST	49872	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:52.043555021 CEST	49872	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:52.043570995 CEST	443	49872	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:52.043580055 CEST	49872	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:52.043585062 CEST	443	49872	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:52.046659946 CEST	49877	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:52.046690941 CEST	443	49877	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:52.046775103 CEST	49877	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:52.046911001 CEST	49877	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:52.046925068 CEST	443	49877	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:52.295691967 CEST	443	49873	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:52.296313047 CEST	49873	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:52.296339035 CEST	443	49873	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:52.296799898 CEST	49873	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:52.296813011 CEST	443	49873	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:52.435842991 CEST	443	49873	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:52.435873032 CEST	443	49873	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:52.435930014 CEST	443	49873	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:52.435997963 CEST	49873	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:52.436333895 CEST	49873	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:52.436333895 CEST	49873	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:52.436358929 CEST	443	49873	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:52.436372042 CEST	443	49873	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:52.439435959 CEST	49878	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:52.439471006 CEST	443	49878	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:52.439565897 CEST	49878	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:52.439740896 CEST	49878	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:52.439754963 CEST	443	49878	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:52.622183084 CEST	443	49874	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:52.623279095 CEST	49874	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:52.623311996 CEST	443	49874	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:52.623831034 CEST	49874	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:52.623841047 CEST	443	49874	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:52.637378931 CEST	443	49875	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:52.637945890 CEST	49875	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:52.637975931 CEST	443	49875	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:52.638392925 CEST	49875	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:52.638397932 CEST	443	49875	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:52.665786028 CEST	443	49876	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:52.666408062 CEST	49876	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:52.666423082 CEST	443	49876	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:52.666898012 CEST	49876	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:52.666903973 CEST	443	49876	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:52.755682945 CEST	443	49874	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:52.756191969 CEST	443	49874	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:52.756242990 CEST	443	49874	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:52.756337881 CEST	49874	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:52.756337881 CEST	49874	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:52.756397963 CEST	49874	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:52.756419897 CEST	443	49874	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:52.756445885 CEST	49874	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:52.756452084 CEST	443	49874	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:52.759546995 CEST	49879	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:52.759583950 CEST	443	49879	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:52.759680986 CEST	49879	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:52.759860992 CEST	49879	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:52.759872913 CEST	443	49879	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:52.771672964 CEST	443	49875	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:52.771747112 CEST	443	49875	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:52.771832943 CEST	49875	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:52.772031069 CEST	49875	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:52.772047997 CEST	443	49875	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:52.772075891 CEST	49875	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:52.772082090 CEST	443	49875	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:52.774699926 CEST	49880	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:52.774743080 CEST	443	49880	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:52.774835110 CEST	49880	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:52.775028944 CEST	49880	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:52.775043964 CEST	443	49880	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:52.789088011 CEST	443	49877	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:52.789592981 CEST	49877	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:52.789623976 CEST	443	49877	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:52.790085077 CEST	49877	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:52.790090084 CEST	443	49877	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:52.801605940 CEST	443	49876	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:52.802109003 CEST	443	49876	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:52.802203894 CEST	49876	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:52.802242041 CEST	49876	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:52.802259922 CEST	443	49876	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:52.802269936 CEST	49876	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:52.802275896 CEST	443	49876	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:52.805214882 CEST	49881	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:52.805263042 CEST	443	49881	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:52.805349112 CEST	49881	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:52.805557013 CEST	49881	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:52.805571079 CEST	443	49881	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:52.923307896 CEST	443	49877	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:52.923428059 CEST	443	49877	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:52.923500061 CEST	49877	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:52.923656940 CEST	49877	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:52.923680067 CEST	443	49877	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:52.923686981 CEST	49877	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:52.923691988 CEST	443	49877	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:52.927185059 CEST	49882	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:52.927225113 CEST	443	49882	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:52.927295923 CEST	49882	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:52.927458048 CEST	49882	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:52.927474976 CEST	443	49882	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:53.347217083 CEST	443	49878	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:53.394604921 CEST	49878	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:53.394921064 CEST	49878	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:53.394932032 CEST	443	49878	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:53.395361900 CEST	49878	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:53.395368099 CEST	443	49878	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:53.496639013 CEST	443	49879	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:53.502496958 CEST	49879	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:53.502530098 CEST	443	49879	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:53.505789995 CEST	49879	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:53.505805016 CEST	443	49879	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:53.528167963 CEST	443	49878	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:53.528223991 CEST	443	49878	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:53.528276920 CEST	49878	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:53.528281927 CEST	443	49878	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:53.528387070 CEST	49878	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:53.528820038 CEST	49878	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:53.528837919 CEST	443	49878	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:53.528850079 CEST	49878	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:53.528856039 CEST	443	49878	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:53.529784918 CEST	443	49881	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:53.531529903 CEST	49881	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:53.531548977 CEST	443	49881	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:53.532032013 CEST	49881	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:53.532037020 CEST	443	49881	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:53.536060095 CEST	443	49880	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:53.538254976 CEST	49880	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:53.538271904 CEST	443	49880	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:53.538938999 CEST	49880	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:53.538944960 CEST	443	49880	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:53.540447950 CEST	49883	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:53.540476084 CEST	443	49883	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:53.540616989 CEST	49883	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:53.540750980 CEST	49883	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:53.540764093 CEST	443	49883	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:53.632339001 CEST	443	49879	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:53.632457972 CEST	443	49879	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:53.632559061 CEST	49879	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:53.632803917 CEST	49879	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:53.632824898 CEST	443	49879	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:53.632831097 CEST	49879	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:53.632836103 CEST	443	49879	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:53.635934114 CEST	49884	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:53.635974884 CEST	443	49884	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:53.636085033 CEST	49884	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:53.636276960 CEST	49884	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:53.636290073 CEST	443	49884	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:53.654769897 CEST	443	49882	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:53.655370951 CEST	49882	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:53.655392885 CEST	443	49882	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:53.655829906 CEST	49882	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:53.655836105 CEST	443	49882	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:53.660643101 CEST	443	49881	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:53.660765886 CEST	443	49881	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:53.660864115 CEST	49881	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:53.660955906 CEST	49881	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:53.660974026 CEST	443	49881	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:53.661010027 CEST	49881	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:53.661015987 CEST	443	49881	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:53.663918972 CEST	49885	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:53.663958073 CEST	443	49885	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:53.664273977 CEST	49885	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:53.664273977 CEST	49885	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:53.664307117 CEST	443	49885	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:53.678018093 CEST	443	49880	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:53.678215027 CEST	443	49880	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:53.678272009 CEST	443	49880	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:53.678421021 CEST	49880	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:53.678421021 CEST	49880	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:53.678421021 CEST	49880	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:53.678633928 CEST	49880	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:53.678654909 CEST	443	49880	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:53.681363106 CEST	49886	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:53.681407928 CEST	443	49886	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:53.681476116 CEST	49886	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:53.681668043 CEST	49886	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:53.681679964 CEST	443	49886	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:53.786740065 CEST	443	49882	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:53.786773920 CEST	443	49882	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:53.786832094 CEST	443	49882	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:53.786890030 CEST	49882	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:53.786941051 CEST	49882	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:53.787302017 CEST	49882	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:53.787302017 CEST	49882	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:53.787322998 CEST	443	49882	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:53.787333012 CEST	443	49882	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:53.790365934 CEST	49887	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:53.790415049 CEST	443	49887	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:53.790618896 CEST	49887	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:53.790705919 CEST	49887	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:53.790720940 CEST	443	49887	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:54.286248922 CEST	443	49883	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:54.293797970 CEST	49883	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:54.293807983 CEST	443	49883	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:54.294262886 CEST	49883	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:54.294266939 CEST	443	49883	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:54.385636091 CEST	443	49884	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:54.386226892 CEST	49884	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:54.386256933 CEST	443	49884	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:54.386696100 CEST	49884	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:54.386701107 CEST	443	49884	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:54.400928020 CEST	443	49885	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:54.401411057 CEST	49885	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:54.401422977 CEST	443	49885	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:54.401911020 CEST	49885	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:54.401916027 CEST	443	49885	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:54.408154964 CEST	443	49886	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:54.408842087 CEST	49886	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:54.408849001 CEST	443	49886	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:54.409245968 CEST	49886	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:54.409257889 CEST	443	49886	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:54.421962976 CEST	443	49883	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:54.425017118 CEST	443	49883	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:54.425088882 CEST	49883	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:54.425131083 CEST	49883	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:54.425131083 CEST	49883	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:54.425148010 CEST	443	49883	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:54.425158024 CEST	443	49883	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:54.428028107 CEST	49888	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:54.428057909 CEST	443	49888	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:54.428117990 CEST	49888	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:54.428282022 CEST	49888	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:54.428291082 CEST	443	49888	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:54.521418095 CEST	443	49884	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:54.521501064 CEST	443	49884	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:54.521550894 CEST	49884	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:54.521760941 CEST	49884	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:54.521770000 CEST	443	49884	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:54.521781921 CEST	49884	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:54.521786928 CEST	443	49884	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:54.524985075 CEST	49889	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:54.525017023 CEST	443	49889	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:54.525125980 CEST	49889	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:54.525763035 CEST	49889	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:54.525770903 CEST	443	49889	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:54.533868074 CEST	443	49885	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:54.534050941 CEST	443	49885	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:54.534152985 CEST	49885	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:54.534152985 CEST	49885	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:54.534380913 CEST	49885	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:54.534389019 CEST	443	49885	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:54.536535978 CEST	49890	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:54.536545038 CEST	443	49890	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:54.536766052 CEST	49890	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:54.536766052 CEST	49890	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:54.536778927 CEST	443	49890	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:54.542119980 CEST	443	49886	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:54.542188883 CEST	443	49886	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:54.542275906 CEST	49886	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:54.542360067 CEST	49886	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:54.542360067 CEST	49886	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:54.542365074 CEST	443	49886	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:54.542373896 CEST	443	49886	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:54.542408943 CEST	443	49887	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:54.542768955 CEST	49887	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:54.542783022 CEST	443	49887	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:54.543353081 CEST	49887	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:54.543359041 CEST	443	49887	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:54.544562101 CEST	49891	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:54.544576883 CEST	443	49891	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:54.544634104 CEST	49891	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:54.544779062 CEST	49891	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:54.544787884 CEST	443	49891	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:54.681448936 CEST	443	49887	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:54.681519032 CEST	443	49887	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:54.681565046 CEST	49887	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:54.681727886 CEST	49887	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:54.681740046 CEST	443	49887	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:54.681755066 CEST	49887	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:54.681761980 CEST	443	49887	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:54.684457064 CEST	49892	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:54.684484959 CEST	443	49892	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:54.684544086 CEST	49892	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:54.684649944 CEST	49892	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:54.684663057 CEST	443	49892	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:55.162487984 CEST	443	49888	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:55.163574934 CEST	49888	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:55.163574934 CEST	49888	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:55.163608074 CEST	443	49888	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:55.163630962 CEST	443	49888	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:55.279723883 CEST	443	49891	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:55.282525063 CEST	49891	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:55.282552958 CEST	443	49891	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:55.283004999 CEST	49891	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:55.283010960 CEST	443	49891	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:55.291158915 CEST	443	49890	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:55.291678905 CEST	49890	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:55.291696072 CEST	443	49890	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:55.292252064 CEST	49890	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:55.292259932 CEST	443	49890	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:55.293379068 CEST	443	49889	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:55.293941975 CEST	49889	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:55.293955088 CEST	443	49889	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:55.294110060 CEST	49889	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:55.294114113 CEST	443	49889	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:55.295141935 CEST	443	49888	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:55.295469999 CEST	443	49888	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:55.295514107 CEST	443	49888	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:55.295537949 CEST	49888	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:55.295563936 CEST	49888	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:55.296478987 CEST	49888	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:55.296495914 CEST	443	49888	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:55.296508074 CEST	49888	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:55.296514988 CEST	443	49888	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:55.299895048 CEST	49893	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:55.299921036 CEST	443	49893	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:55.299998045 CEST	49893	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:55.300129890 CEST	49893	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:55.300138950 CEST	443	49893	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:55.423269987 CEST	443	49892	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:55.424046993 CEST	49892	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:55.424069881 CEST	443	49892	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:55.424487114 CEST	49892	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:55.424494028 CEST	443	49892	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:55.425463915 CEST	443	49890	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:55.425493956 CEST	443	49890	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:55.425539970 CEST	49890	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:55.425544977 CEST	443	49890	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:55.425656080 CEST	49890	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:55.425972939 CEST	49890	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:55.425972939 CEST	49890	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:55.425991058 CEST	443	49890	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:55.426000118 CEST	443	49890	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:55.428738117 CEST	49894	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:55.428777933 CEST	443	49894	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:55.428858995 CEST	49894	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:55.429023981 CEST	49894	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:55.429037094 CEST	443	49894	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:55.429272890 CEST	443	49889	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:55.429580927 CEST	443	49889	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:55.429651022 CEST	49889	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:55.429681063 CEST	49889	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:55.429681063 CEST	49889	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:55.429692984 CEST	443	49889	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:55.429701090 CEST	443	49889	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:55.431919098 CEST	49895	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:55.431955099 CEST	443	49895	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:55.432029009 CEST	49895	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:55.432171106 CEST	49895	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:55.432187080 CEST	443	49895	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:55.456391096 CEST	443	49891	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:55.456496954 CEST	443	49891	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:55.456561089 CEST	49891	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:55.456691027 CEST	49891	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:55.456708908 CEST	443	49891	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:55.456720114 CEST	49891	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:55.456727028 CEST	443	49891	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:55.459101915 CEST	49896	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:55.459147930 CEST	443	49896	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:55.459214926 CEST	49896	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:55.459332943 CEST	49896	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:55.459350109 CEST	443	49896	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:55.559968948 CEST	443	49892	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:55.560043097 CEST	443	49892	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:55.560097933 CEST	443	49892	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:55.560127974 CEST	49892	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:55.560313940 CEST	49892	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:55.560395956 CEST	49892	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:55.560395956 CEST	49892	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:55.560414076 CEST	443	49892	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:55.560422897 CEST	443	49892	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:55.563365936 CEST	49897	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:55.563405991 CEST	443	49897	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:55.563498974 CEST	49897	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:55.563662052 CEST	49897	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:55.563702106 CEST	443	49897	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:56.240612984 CEST	443	49893	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:56.241144896 CEST	49893	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:56.241173029 CEST	443	49893	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:56.241722107 CEST	49893	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:56.241728067 CEST	443	49893	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:56.367033958 CEST	443	49894	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:56.367080927 CEST	443	49897	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:56.367615938 CEST	49897	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:56.367630959 CEST	443	49897	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:56.367960930 CEST	49894	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:56.367989063 CEST	443	49894	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:56.368097067 CEST	49897	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:56.368103027 CEST	443	49897	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:56.368885040 CEST	49894	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:56.368894100 CEST	443	49894	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:56.370414019 CEST	443	49896	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:56.370879889 CEST	49896	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:56.370901108 CEST	443	49896	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:56.371331930 CEST	49896	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:56.371336937 CEST	443	49896	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:56.372854948 CEST	443	49895	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:56.373032093 CEST	443	49893	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:56.373096943 CEST	443	49893	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:56.373276949 CEST	49895	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:56.373294115 CEST	443	49895	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:56.373307943 CEST	49893	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:56.373378038 CEST	49893	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:56.373378038 CEST	49893	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:56.373393059 CEST	443	49893	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:56.373403072 CEST	443	49893	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:56.373820066 CEST	49895	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:56.373825073 CEST	443	49895	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:56.376806974 CEST	49898	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:56.376821041 CEST	443	49898	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:56.376880884 CEST	49898	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:56.377075911 CEST	49898	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:56.377084970 CEST	443	49898	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:56.498789072 CEST	443	49897	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:56.498809099 CEST	443	49897	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:56.498867989 CEST	49897	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:56.498881102 CEST	443	49897	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:56.498894930 CEST	443	49897	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:56.498940945 CEST	49897	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:56.499128103 CEST	49897	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:56.499145985 CEST	443	49897	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:56.499155998 CEST	49897	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:56.499161959 CEST	443	49897	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:56.500333071 CEST	443	49894	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:56.500361919 CEST	443	49894	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:56.500416994 CEST	443	49894	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:56.500416994 CEST	49894	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:56.500485897 CEST	49894	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:56.500541925 CEST	49894	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:56.500541925 CEST	49894	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:56.500560045 CEST	443	49894	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:56.500569105 CEST	443	49894	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:56.501972914 CEST	49899	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:56.502012968 CEST	443	49899	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:56.502075911 CEST	49899	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:56.502252102 CEST	49899	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:56.502264977 CEST	443	49899	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:56.502554893 CEST	49900	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:56.502587080 CEST	443	49900	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:56.502652884 CEST	49900	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:56.502738953 CEST	49900	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:56.502746105 CEST	443	49900	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:56.505855083 CEST	443	49896	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:56.505878925 CEST	443	49896	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:56.505928040 CEST	49896	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:56.505935907 CEST	443	49896	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:56.505974054 CEST	49896	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:56.506087065 CEST	49896	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:56.506097078 CEST	443	49896	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:56.506109953 CEST	49896	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:56.506114006 CEST	443	49896	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:56.506732941 CEST	443	49895	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:56.507227898 CEST	443	49895	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:56.507287025 CEST	49895	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:56.507342100 CEST	49895	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:56.507348061 CEST	443	49895	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:56.507417917 CEST	49895	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:56.507422924 CEST	443	49895	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:56.508096933 CEST	49901	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:56.508131981 CEST	443	49901	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:56.508193016 CEST	49901	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:56.508347988 CEST	49901	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:56.508362055 CEST	443	49901	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:56.509239912 CEST	49902	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:56.509248972 CEST	443	49902	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:56.509325027 CEST	49902	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:56.509429932 CEST	49902	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:56.509440899 CEST	443	49902	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:57.117604971 CEST	443	49898	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:57.118204117 CEST	49898	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:57.118227005 CEST	443	49898	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:57.118695974 CEST	49898	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:57.118701935 CEST	443	49898	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:57.234339952 CEST	443	49901	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:57.234980106 CEST	49901	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:57.235018015 CEST	443	49901	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:57.235440016 CEST	49901	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:57.235447884 CEST	443	49901	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:57.235693932 CEST	443	49902	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:57.235946894 CEST	49902	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:57.235955000 CEST	443	49902	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:57.236299992 CEST	49902	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:57.236304998 CEST	443	49902	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:57.236531973 CEST	443	49899	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:57.236763000 CEST	49899	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:57.236789942 CEST	443	49899	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:57.237102032 CEST	49899	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:57.237108946 CEST	443	49899	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:57.247119904 CEST	443	49900	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:57.247469902 CEST	49900	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:57.247494936 CEST	443	49900	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:57.247824907 CEST	49900	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:57.247831106 CEST	443	49900	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:57.249186993 CEST	443	49898	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:57.249347925 CEST	443	49898	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:57.249392986 CEST	49898	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:57.249399900 CEST	443	49898	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:57.249445915 CEST	49898	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:57.249489069 CEST	49898	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:57.249511957 CEST	443	49898	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:57.249524117 CEST	49898	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:57.249530077 CEST	443	49898	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:57.252394915 CEST	49903	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:57.252428055 CEST	443	49903	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:57.252502918 CEST	49903	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:57.252619982 CEST	49903	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:57.252631903 CEST	443	49903	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:57.367358923 CEST	443	49901	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:57.367449045 CEST	443	49901	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:57.367511988 CEST	49901	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:57.367762089 CEST	443	49902	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:57.367784977 CEST	443	49902	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:57.367832899 CEST	49901	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:57.367832899 CEST	49901	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:57.367841959 CEST	443	49902	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:57.367856026 CEST	443	49901	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:57.367872000 CEST	443	49901	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:57.367882967 CEST	49902	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:57.367882967 CEST	49902	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:57.368020058 CEST	49902	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:57.368026018 CEST	443	49902	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:57.368036985 CEST	49902	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:57.368041992 CEST	443	49902	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:57.369224072 CEST	443	49899	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:57.369291067 CEST	443	49899	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:57.369335890 CEST	49899	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:57.369611025 CEST	49899	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:57.369631052 CEST	443	49899	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:57.369643927 CEST	49899	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:57.369649887 CEST	443	49899	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:57.371718884 CEST	49904	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:57.371752977 CEST	443	49904	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:57.371920109 CEST	49904	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:57.372143984 CEST	49905	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:57.372190952 CEST	443	49905	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:57.372239113 CEST	49905	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:57.372286081 CEST	49904	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:57.372304916 CEST	443	49904	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:57.372562885 CEST	49906	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:57.372579098 CEST	443	49906	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:57.372615099 CEST	49905	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:57.372632980 CEST	443	49905	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:57.372639894 CEST	49906	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:57.372762918 CEST	49906	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:57.372777939 CEST	443	49906	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:57.384845972 CEST	443	49900	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:57.385045052 CEST	443	49900	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:57.385088921 CEST	49900	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:57.385094881 CEST	443	49900	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:57.385133028 CEST	49900	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:57.385477066 CEST	49900	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:57.385484934 CEST	443	49900	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:57.385495901 CEST	49900	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:57.385499954 CEST	443	49900	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:57.389866114 CEST	49907	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:57.389902115 CEST	443	49907	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:57.389964104 CEST	49907	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:57.390091896 CEST	49907	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:57.390100002 CEST	443	49907	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:57.988881111 CEST	443	49903	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:57.989439011 CEST	49903	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:57.989466906 CEST	443	49903	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:57.989939928 CEST	49903	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:57.989945889 CEST	443	49903	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:58.098366022 CEST	443	49905	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:58.098891973 CEST	49905	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:58.098912001 CEST	443	49905	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:58.099417925 CEST	49905	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:58.099423885 CEST	443	49905	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:58.113220930 CEST	443	49904	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:58.113677025 CEST	49904	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:58.113692045 CEST	443	49904	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:58.114171028 CEST	49904	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:58.114176035 CEST	443	49904	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:58.115477085 CEST	443	49907	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:58.115860939 CEST	49907	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:58.115869999 CEST	443	49907	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:58.116255999 CEST	49907	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:58.116260052 CEST	443	49907	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:58.117832899 CEST	443	49906	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:58.118258953 CEST	49906	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:58.118266106 CEST	443	49906	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:58.118752003 CEST	49906	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:58.118756056 CEST	443	49906	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:58.122390032 CEST	443	49903	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:58.122616053 CEST	443	49903	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:58.122711897 CEST	49903	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:58.122769117 CEST	49903	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:58.122769117 CEST	49903	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:58.122800112 CEST	443	49903	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:58.122806072 CEST	443	49903	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:58.125536919 CEST	49908	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:58.125576973 CEST	443	49908	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:58.125842094 CEST	49908	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:58.125842094 CEST	49908	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:58.125870943 CEST	443	49908	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:58.230838060 CEST	443	49905	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:58.230906963 CEST	443	49905	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:58.231013060 CEST	49905	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:58.231311083 CEST	49905	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:58.231328964 CEST	443	49905	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:58.231348991 CEST	49905	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:58.231354952 CEST	443	49905	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:58.234778881 CEST	49909	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:58.234823942 CEST	443	49909	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:58.234920025 CEST	49909	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:58.235183954 CEST	49909	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:58.235198021 CEST	443	49909	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:58.246479988 CEST	443	49907	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:58.246591091 CEST	443	49907	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:58.246650934 CEST	49907	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:58.246870041 CEST	49907	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:58.246887922 CEST	443	49907	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:58.246896029 CEST	49907	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:58.246902943 CEST	443	49907	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:58.247073889 CEST	443	49904	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:58.247102022 CEST	443	49904	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:58.247143030 CEST	49904	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:58.247153044 CEST	443	49904	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:58.247164965 CEST	443	49904	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:58.247211933 CEST	49904	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:58.247328997 CEST	49904	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:58.247334957 CEST	443	49904	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:58.247344017 CEST	49904	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:58.247348070 CEST	443	49904	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:58.249838114 CEST	49910	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:58.249881983 CEST	443	49910	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:58.249995947 CEST	49910	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:58.250034094 CEST	49911	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:58.250068903 CEST	443	49911	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:58.250128031 CEST	49910	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:58.250135899 CEST	443	49910	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:58.250181913 CEST	49911	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:58.250336885 CEST	49911	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:58.250349045 CEST	443	49911	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:58.250524044 CEST	443	49906	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:58.250552893 CEST	443	49906	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:58.250598907 CEST	443	49906	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:58.250597954 CEST	49906	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:58.250643969 CEST	49906	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:58.250782967 CEST	49906	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:58.250802994 CEST	443	49906	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:58.250813961 CEST	49906	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:58.250818968 CEST	443	49906	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:58.253007889 CEST	49912	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:58.253046989 CEST	443	49912	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:58.253169060 CEST	49912	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:58.253531933 CEST	49912	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:58.253545046 CEST	443	49912	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:58.874424934 CEST	443	49908	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:58.875096083 CEST	49908	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:58.875128984 CEST	443	49908	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:58.875546932 CEST	49908	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:58.875555038 CEST	443	49908	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:58.978856087 CEST	443	49910	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:58.979477882 CEST	49910	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:58.979518890 CEST	443	49910	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:58.979929924 CEST	49910	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:58.979934931 CEST	443	49910	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:58.987966061 CEST	443	49911	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:58.988349915 CEST	49911	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:58.988394976 CEST	443	49911	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:58.988759041 CEST	49911	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:58.988770008 CEST	443	49911	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:59.003988981 CEST	443	49912	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:59.004367113 CEST	49912	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:59.004396915 CEST	443	49912	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:59.004710913 CEST	49912	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:59.004717112 CEST	443	49912	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:59.010521889 CEST	443	49908	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:59.010606050 CEST	443	49908	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:59.010662079 CEST	49908	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:59.010844946 CEST	49908	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:59.010868073 CEST	443	49908	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:59.010893106 CEST	49908	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:59.010901928 CEST	443	49908	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:59.013504982 CEST	49913	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:59.013540030 CEST	443	49913	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:59.013617039 CEST	49913	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:59.013797998 CEST	49913	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:59.013813019 CEST	443	49913	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:59.045603037 CEST	443	49909	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:59.046184063 CEST	49909	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:59.046206951 CEST	443	49909	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:59.046749115 CEST	49909	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:59.046753883 CEST	443	49909	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:59.112550020 CEST	443	49910	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:59.112674952 CEST	443	49910	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:59.112782955 CEST	49910	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:59.113054037 CEST	49910	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:59.113078117 CEST	443	49910	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:59.113095045 CEST	49910	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:59.113101006 CEST	443	49910	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:59.116828918 CEST	49914	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:59.116878033 CEST	443	49914	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:59.116952896 CEST	49914	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:59.117129087 CEST	49914	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:59.117145061 CEST	443	49914	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:59.122648954 CEST	443	49911	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:59.122832060 CEST	443	49911	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:59.122896910 CEST	49911	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:59.123016119 CEST	49911	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:59.123016119 CEST	49911	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:59.123034954 CEST	443	49911	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:59.123047113 CEST	443	49911	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:59.125963926 CEST	49915	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:59.126008034 CEST	443	49915	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:59.126077890 CEST	49915	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:59.126261950 CEST	49915	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:59.126274109 CEST	443	49915	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:59.142254114 CEST	443	49912	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:59.142505884 CEST	443	49912	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:59.142551899 CEST	443	49912	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:59.142582893 CEST	49912	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:59.142627001 CEST	49912	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:59.142672062 CEST	49912	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:59.142684937 CEST	443	49912	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:59.142695904 CEST	49912	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:59.142699957 CEST	443	49912	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:59.144989014 CEST	49916	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:59.145020008 CEST	443	49916	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:59.145100117 CEST	49916	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:59.145281076 CEST	49916	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:59.145289898 CEST	443	49916	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:59.186296940 CEST	443	49909	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:59.186325073 CEST	443	49909	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:59.186381102 CEST	443	49909	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:59.186414003 CEST	49909	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:59.186460018 CEST	49909	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:59.186728954 CEST	49909	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:59.186749935 CEST	443	49909	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:59.186759949 CEST	49909	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:59.186764956 CEST	443	49909	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:59.189927101 CEST	49917	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:59.189964056 CEST	443	49917	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:59.190037012 CEST	49917	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:59.190176964 CEST	49917	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:59.190190077 CEST	443	49917	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:59.771245003 CEST	443	49913	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:59.771825075 CEST	49913	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:59.771847963 CEST	443	49913	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:59.772284031 CEST	49913	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:59.772300005 CEST	443	49913	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:59.865164042 CEST	443	49914	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:59.865644932 CEST	49914	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:59.865664005 CEST	443	49914	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:59.866117954 CEST	49914	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:59.866126060 CEST	443	49914	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:59.878633022 CEST	443	49916	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:59.879100084 CEST	49916	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:59.879115105 CEST	443	49916	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:59.879566908 CEST	49916	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:59.879573107 CEST	443	49916	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:59.879812956 CEST	443	49915	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:59.880422115 CEST	49915	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:59.880422115 CEST	49915	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:59.880453110 CEST	443	49915	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:59.880476952 CEST	443	49915	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:59.906910896 CEST	443	49913	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:59.907002926 CEST	443	49913	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:59.907051086 CEST	49913	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:59.907188892 CEST	49913	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:59.907210112 CEST	443	49913	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:59.907217026 CEST	49913	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:59.907223940 CEST	443	49913	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:59.910022020 CEST	49918	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:59.910059929 CEST	443	49918	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:59.910140038 CEST	49918	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:59.910311937 CEST	49918	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:59.910324097 CEST	443	49918	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:59.934262991 CEST	443	49917	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:59.934840918 CEST	49917	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:59.934866905 CEST	443	49917	13.107.246.45	192.168.2.9
Oct 18, 2024 00:27:59.935318947 CEST	49917	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:27:59.935324907 CEST	443	49917	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.004852057 CEST	443	49914	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.004900932 CEST	443	49914	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.004941940 CEST	443	49914	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.004965067 CEST	49914	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:00.005006075 CEST	49914	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:00.005295992 CEST	49914	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:00.005311012 CEST	443	49914	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.005340099 CEST	49914	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:00.005346060 CEST	443	49914	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.008379936 CEST	49919	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:00.008419037 CEST	443	49919	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.008510113 CEST	49919	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:00.008676052 CEST	49919	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:00.008685112 CEST	443	49919	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.012289047 CEST	443	49916	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.012343884 CEST	443	49916	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.012438059 CEST	49916	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:00.012618065 CEST	49916	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:00.012629986 CEST	443	49916	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.012639999 CEST	49916	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:00.012645006 CEST	443	49916	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.015094042 CEST	49920	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:00.015134096 CEST	443	49920	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.015202045 CEST	49920	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:00.015331030 CEST	49920	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:00.015342951 CEST	443	49920	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.015702009 CEST	443	49915	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.016195059 CEST	443	49915	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.016251087 CEST	49915	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:00.016341925 CEST	49915	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:00.016356945 CEST	443	49915	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.016434908 CEST	49915	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:00.016439915 CEST	443	49915	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.018332958 CEST	49921	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:00.018357038 CEST	443	49921	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.018481970 CEST	49921	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:00.018568993 CEST	49921	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:00.018578053 CEST	443	49921	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.096113920 CEST	443	49917	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.096240044 CEST	443	49917	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.096299887 CEST	443	49917	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.096307039 CEST	49917	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:00.096349955 CEST	49917	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:00.096518040 CEST	49917	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:00.096538067 CEST	443	49917	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.096550941 CEST	49917	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:00.096558094 CEST	443	49917	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.099432945 CEST	49922	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:00.099494934 CEST	443	49922	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.099620104 CEST	49922	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:00.099819899 CEST	49922	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:00.099838018 CEST	443	49922	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.663017035 CEST	443	49918	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.663563013 CEST	49918	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:00.663573027 CEST	443	49918	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.664078951 CEST	49918	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:00.664083004 CEST	443	49918	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.766182899 CEST	443	49921	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.766712904 CEST	49921	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:00.766740084 CEST	443	49921	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.767302990 CEST	49921	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:00.767312050 CEST	443	49921	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.768342018 CEST	443	49919	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.768693924 CEST	49919	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:00.768712997 CEST	443	49919	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.769121885 CEST	49919	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:00.769126892 CEST	443	49919	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.783360004 CEST	443	49920	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.783771038 CEST	49920	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:00.783797979 CEST	443	49920	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.784229994 CEST	49920	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:00.784235001 CEST	443	49920	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.811640978 CEST	443	49918	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.811722040 CEST	443	49918	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.811778069 CEST	49918	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:00.811933994 CEST	49918	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:00.811954975 CEST	443	49918	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.811960936 CEST	49918	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:00.811966896 CEST	443	49918	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.822851896 CEST	49923	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:00.822906017 CEST	443	49923	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.822993040 CEST	49923	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:00.823138952 CEST	49923	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:00.823154926 CEST	443	49923	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.881135941 CEST	443	49922	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.881784916 CEST	49922	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:00.881815910 CEST	443	49922	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.882251978 CEST	49922	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:00.882256985 CEST	443	49922	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.900954962 CEST	443	49921	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.901034117 CEST	443	49921	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.901118040 CEST	49921	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:00.901370049 CEST	49921	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:00.901370049 CEST	49921	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:00.901396990 CEST	443	49921	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.901407003 CEST	443	49921	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.904145002 CEST	443	49919	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.904208899 CEST	49924	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:00.904220104 CEST	443	49919	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.904282093 CEST	49919	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:00.904311895 CEST	443	49924	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.904386044 CEST	49924	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:00.904452085 CEST	49919	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:00.904474974 CEST	443	49919	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.904490948 CEST	49919	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:00.904504061 CEST	443	49919	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.904714108 CEST	49924	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:00.904751062 CEST	443	49924	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.906536102 CEST	49925	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:00.906569958 CEST	443	49925	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.906640053 CEST	49925	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:00.906744003 CEST	49925	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:00.906757116 CEST	443	49925	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.919132948 CEST	443	49920	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.919151068 CEST	443	49920	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.919197083 CEST	443	49920	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.919266939 CEST	49920	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:00.919311047 CEST	49920	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:00.919567108 CEST	49920	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:00.919585943 CEST	443	49920	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.919598103 CEST	49920	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:00.919604063 CEST	443	49920	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.922250986 CEST	49926	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:00.922297001 CEST	443	49926	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:00.922368050 CEST	49926	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:00.922502995 CEST	49926	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:00.922517061 CEST	443	49926	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:01.017316103 CEST	443	49922	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:01.017332077 CEST	443	49922	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:01.017381907 CEST	443	49922	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:01.017395020 CEST	49922	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:01.017426014 CEST	49922	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:01.017668962 CEST	49922	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:01.017677069 CEST	443	49922	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:01.017721891 CEST	49922	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:01.017726898 CEST	443	49922	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:01.020833015 CEST	49927	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:01.020875931 CEST	443	49927	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:01.020948887 CEST	49927	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:01.021140099 CEST	49927	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:01.021156073 CEST	443	49927	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:01.561011076 CEST	443	49923	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:01.561542988 CEST	49923	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:01.561558008 CEST	443	49923	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:01.562026978 CEST	49923	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:01.562031984 CEST	443	49923	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:01.640945911 CEST	443	49924	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:01.641448975 CEST	49924	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:01.641464949 CEST	443	49924	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:01.642077923 CEST	49924	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:01.642081976 CEST	443	49924	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:01.665134907 CEST	443	49926	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:01.665622950 CEST	49926	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:01.665637970 CEST	443	49926	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:01.666070938 CEST	49926	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:01.666075945 CEST	443	49926	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:01.666613102 CEST	443	49925	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:01.666865110 CEST	49925	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:01.666872025 CEST	443	49925	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:01.667181969 CEST	49925	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:01.667186975 CEST	443	49925	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:01.692121983 CEST	443	49923	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:01.692208052 CEST	443	49923	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:01.692270041 CEST	49923	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:01.692452908 CEST	49923	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:01.692473888 CEST	443	49923	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:01.692487001 CEST	49923	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:01.692495108 CEST	443	49923	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:01.695653915 CEST	49928	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:01.695697069 CEST	443	49928	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:01.695813894 CEST	49928	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:01.695995092 CEST	49928	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:01.696013927 CEST	443	49928	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:01.756232977 CEST	443	49927	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:01.756767988 CEST	49927	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:01.756802082 CEST	443	49927	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:01.757215023 CEST	49927	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:01.757220984 CEST	443	49927	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:01.770663023 CEST	443	49924	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:01.770891905 CEST	443	49924	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:01.770953894 CEST	49924	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:01.771009922 CEST	49924	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:01.771017075 CEST	443	49924	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:01.771028042 CEST	49924	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:01.771032095 CEST	443	49924	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:01.773749113 CEST	49929	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:01.773783922 CEST	443	49929	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:01.773857117 CEST	49929	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:01.774029970 CEST	49929	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:01.774040937 CEST	443	49929	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:01.794101000 CEST	443	49926	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:01.794209003 CEST	443	49926	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:01.794256926 CEST	443	49926	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:01.794264078 CEST	49926	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:01.794306993 CEST	49926	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:01.794496059 CEST	49926	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:01.794517994 CEST	443	49926	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:01.794532061 CEST	49926	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:01.794538021 CEST	443	49926	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:01.797353029 CEST	49930	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:01.797389030 CEST	443	49930	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:01.797465086 CEST	49930	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:01.797594070 CEST	49930	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:01.797607899 CEST	443	49930	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:01.802491903 CEST	443	49925	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:01.802572012 CEST	443	49925	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:01.802623034 CEST	49925	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:01.802686930 CEST	49925	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:01.802701950 CEST	443	49925	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:01.802707911 CEST	49925	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:01.802712917 CEST	443	49925	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:01.804738998 CEST	49931	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:01.804769993 CEST	443	49931	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:01.804837942 CEST	49931	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:01.804955959 CEST	49931	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:01.804965973 CEST	443	49931	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:01.887358904 CEST	443	49927	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:01.888498068 CEST	443	49927	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:01.888605118 CEST	49927	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:01.888643980 CEST	49927	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:01.888643980 CEST	49927	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:01.888660908 CEST	443	49927	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:01.888665915 CEST	443	49927	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:01.892034054 CEST	49932	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:01.892075062 CEST	443	49932	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:01.892139912 CEST	49932	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:01.892286062 CEST	49932	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:01.892296076 CEST	443	49932	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:02.459079027 CEST	443	49928	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:02.459686995 CEST	49928	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:02.459713936 CEST	443	49928	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:02.460212946 CEST	49928	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:02.460217953 CEST	443	49928	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:02.512753963 CEST	443	49929	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:02.513267040 CEST	49929	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:02.513289928 CEST	443	49929	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:02.513948917 CEST	49929	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:02.513956070 CEST	443	49929	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:02.532687902 CEST	443	49930	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:02.533164024 CEST	49930	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:02.533179045 CEST	443	49930	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:02.533607960 CEST	49930	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:02.533617020 CEST	443	49930	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:02.547020912 CEST	443	49931	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:02.554970980 CEST	49931	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:02.554989100 CEST	443	49931	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:02.555434942 CEST	49931	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:02.555442095 CEST	443	49931	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:02.593622923 CEST	443	49928	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:02.593667030 CEST	443	49928	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:02.593739033 CEST	443	49928	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:02.593812943 CEST	49928	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:02.593895912 CEST	49928	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:02.594055891 CEST	49928	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:02.594055891 CEST	49928	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:02.594074011 CEST	443	49928	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:02.594083071 CEST	443	49928	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:02.596889019 CEST	49933	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:02.596926928 CEST	443	49933	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:02.597008944 CEST	49933	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:02.597162008 CEST	49933	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:02.597176075 CEST	443	49933	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:02.625967979 CEST	443	49932	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:02.626504898 CEST	49932	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:02.626523972 CEST	443	49932	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:02.627067089 CEST	49932	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:02.627073050 CEST	443	49932	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:02.643805027 CEST	443	49929	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:02.643873930 CEST	443	49929	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:02.644150972 CEST	49929	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:02.644150972 CEST	49929	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:02.644959927 CEST	49929	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:02.644979000 CEST	443	49929	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:02.647172928 CEST	49934	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:02.647192955 CEST	443	49934	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:02.647378922 CEST	49934	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:02.647469044 CEST	49934	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:02.647479057 CEST	443	49934	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:02.690418959 CEST	443	49931	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:02.690486908 CEST	443	49931	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:02.690679073 CEST	49931	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:02.692955017 CEST	49931	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:02.692955017 CEST	49931	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:02.692975998 CEST	443	49931	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:02.692980051 CEST	443	49931	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:02.693665028 CEST	49935	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:02.693706036 CEST	443	49935	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:02.693777084 CEST	49935	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:02.693906069 CEST	49935	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:02.693917036 CEST	443	49935	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:02.754868031 CEST	443	49932	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:02.754954100 CEST	443	49932	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:02.755039930 CEST	49932	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:02.755223989 CEST	49932	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:02.755243063 CEST	443	49932	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:02.755255938 CEST	49932	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:02.755261898 CEST	443	49932	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:02.757910967 CEST	49936	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:02.757946968 CEST	443	49936	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:02.758013964 CEST	49936	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:02.758157969 CEST	49936	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:02.758167028 CEST	443	49936	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:02.914052963 CEST	443	49930	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:02.914483070 CEST	443	49930	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:02.914520025 CEST	49930	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:02.914530039 CEST	443	49930	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:02.914550066 CEST	443	49930	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:02.914587021 CEST	49930	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:02.914622068 CEST	49930	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:02.914628029 CEST	443	49930	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:02.914638996 CEST	49930	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:02.914643049 CEST	443	49930	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:02.917236090 CEST	49937	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:02.917275906 CEST	443	49937	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:02.917326927 CEST	49937	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:02.917479992 CEST	49937	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:02.917495966 CEST	443	49937	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:03.343444109 CEST	443	49933	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:03.344146967 CEST	49933	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:03.344157934 CEST	443	49933	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:03.344624043 CEST	49933	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:03.344628096 CEST	443	49933	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:03.401654005 CEST	443	49934	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:03.402358055 CEST	49934	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:03.402375937 CEST	443	49934	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:03.402874947 CEST	49934	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:03.402883053 CEST	443	49934	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:03.416382074 CEST	443	49935	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:03.416806936 CEST	49935	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:03.416841030 CEST	443	49935	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:03.417366982 CEST	49935	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:03.417375088 CEST	443	49935	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:03.470243931 CEST	443	49933	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:03.470310926 CEST	443	49933	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:03.470364094 CEST	49933	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:03.470824003 CEST	49933	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:03.470824003 CEST	49933	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:03.470839024 CEST	443	49933	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:03.470853090 CEST	443	49933	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:03.474323988 CEST	49938	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:03.474366903 CEST	443	49938	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:03.474421978 CEST	49938	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:03.474720955 CEST	49938	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:03.474742889 CEST	443	49938	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:03.484422922 CEST	443	49936	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:03.484896898 CEST	49936	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:03.484915018 CEST	443	49936	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:03.485589027 CEST	49936	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:03.485594034 CEST	443	49936	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:03.541699886 CEST	443	49934	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:03.542258024 CEST	443	49934	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:03.542299986 CEST	49934	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:03.542310953 CEST	443	49934	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:03.542330980 CEST	443	49934	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:03.542412043 CEST	49934	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:03.542412043 CEST	49934	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:03.542438984 CEST	49934	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:03.542449951 CEST	443	49934	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:03.545367956 CEST	49939	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:03.545403004 CEST	443	49939	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:03.545453072 CEST	49939	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:03.545824051 CEST	49939	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:03.545833111 CEST	443	49939	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:03.548782110 CEST	443	49935	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:03.548850060 CEST	443	49935	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:03.548892021 CEST	49935	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:03.549005985 CEST	49935	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:03.549024105 CEST	443	49935	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:03.549036980 CEST	49935	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:03.549042940 CEST	443	49935	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:03.551337957 CEST	49940	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:03.551373005 CEST	443	49940	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:03.551424980 CEST	49940	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:03.551525116 CEST	49940	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:03.551537037 CEST	443	49940	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:03.622040987 CEST	443	49936	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:03.622112036 CEST	443	49936	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:03.622163057 CEST	49936	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:03.622355938 CEST	49936	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:03.622379065 CEST	443	49936	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:03.622394085 CEST	49936	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:03.622400045 CEST	443	49936	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:03.625077009 CEST	49941	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:03.625122070 CEST	443	49941	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:03.625188112 CEST	49941	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:03.625328064 CEST	49941	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:03.625339985 CEST	443	49941	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:03.655109882 CEST	443	49937	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:03.655620098 CEST	49937	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:03.655653000 CEST	443	49937	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:03.656080961 CEST	49937	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:03.656085968 CEST	443	49937	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:03.789292097 CEST	443	49937	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:03.789351940 CEST	443	49937	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:03.789414883 CEST	49937	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:03.789587975 CEST	49937	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:03.789602995 CEST	443	49937	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:03.789623022 CEST	49937	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:03.789628029 CEST	443	49937	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:03.792388916 CEST	49942	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:03.792422056 CEST	443	49942	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:03.792510033 CEST	49942	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:03.792603970 CEST	49942	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:03.792614937 CEST	443	49942	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:04.228456020 CEST	443	49938	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:04.229005098 CEST	49938	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:04.229021072 CEST	443	49938	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:04.229486942 CEST	49938	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:04.229490995 CEST	443	49938	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:04.270926952 CEST	443	49939	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:04.277560949 CEST	49939	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:04.277580023 CEST	443	49939	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:04.278043032 CEST	49939	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:04.278048038 CEST	443	49939	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:04.305051088 CEST	443	49940	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:04.305936098 CEST	49940	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:04.305959940 CEST	443	49940	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:04.306162119 CEST	49940	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:04.306165934 CEST	443	49940	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:04.364092112 CEST	443	49938	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:04.364265919 CEST	443	49938	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:04.364343882 CEST	49938	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:04.364428997 CEST	49938	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:04.364444017 CEST	443	49938	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:04.364470959 CEST	49938	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:04.364476919 CEST	443	49938	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:04.367664099 CEST	49943	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:04.367701054 CEST	443	49943	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:04.367901087 CEST	49943	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:04.367901087 CEST	49943	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:04.367928982 CEST	443	49943	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:04.379869938 CEST	443	49941	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:04.380337000 CEST	49941	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:04.380359888 CEST	443	49941	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:04.380778074 CEST	49941	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:04.380784035 CEST	443	49941	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:04.404748917 CEST	443	49939	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:04.404933929 CEST	443	49939	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:04.404997110 CEST	49939	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:04.405075073 CEST	49939	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:04.405095100 CEST	443	49939	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:04.405106068 CEST	49939	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:04.405112028 CEST	443	49939	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:04.407747984 CEST	49944	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:04.407782078 CEST	443	49944	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:04.407845974 CEST	49944	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:04.407979965 CEST	49944	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:04.408004999 CEST	443	49944	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:04.444488049 CEST	443	49940	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:04.444566011 CEST	443	49940	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:04.444627047 CEST	49940	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:04.445020914 CEST	49940	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:04.445020914 CEST	49940	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:04.445033073 CEST	443	49940	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:04.445040941 CEST	443	49940	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:04.449333906 CEST	49945	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:04.449361086 CEST	443	49945	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:04.449415922 CEST	49945	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:04.449708939 CEST	49945	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:04.449722052 CEST	443	49945	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:04.516541004 CEST	443	49941	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:04.516597033 CEST	443	49941	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:04.516644955 CEST	49941	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:04.516932011 CEST	49941	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:04.516949892 CEST	443	49941	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:04.516962051 CEST	49941	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:04.516968012 CEST	443	49941	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:04.519505978 CEST	49946	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:04.519555092 CEST	443	49946	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:04.519624949 CEST	49946	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:04.519757032 CEST	49946	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:04.519769907 CEST	443	49946	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:04.546928883 CEST	443	49942	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:04.547293901 CEST	49942	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:04.547302008 CEST	443	49942	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:04.547935963 CEST	49942	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:04.547944069 CEST	443	49942	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:04.684726000 CEST	443	49942	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:04.684775114 CEST	443	49942	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:04.684829950 CEST	443	49942	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:04.684835911 CEST	49942	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:04.684875011 CEST	49942	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:04.702033043 CEST	49942	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:04.702033043 CEST	49942	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:04.702059031 CEST	443	49942	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:04.702073097 CEST	443	49942	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:04.728403091 CEST	49947	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:04.728435040 CEST	443	49947	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:04.728560925 CEST	49947	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:04.735568047 CEST	49947	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:04.735579967 CEST	443	49947	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:05.132935047 CEST	443	49943	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:05.133788109 CEST	49943	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:05.133800983 CEST	443	49943	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:05.135087967 CEST	49943	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:05.135092020 CEST	443	49943	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:05.171581984 CEST	443	49944	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:05.172034025 CEST	49944	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:05.172049999 CEST	443	49944	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:05.172430038 CEST	49944	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:05.172441959 CEST	443	49944	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:05.185801983 CEST	443	49945	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:05.186188936 CEST	49945	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:05.186203957 CEST	443	49945	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:05.186553955 CEST	49945	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:05.186558962 CEST	443	49945	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:05.260631084 CEST	443	49946	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:05.261425018 CEST	49946	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:05.261445999 CEST	443	49946	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:05.262732029 CEST	49946	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:05.262738943 CEST	443	49946	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:05.271497011 CEST	443	49943	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:05.271572113 CEST	443	49943	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:05.271652937 CEST	49943	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:05.271778107 CEST	49943	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:05.271778107 CEST	49943	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:05.271796942 CEST	443	49943	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:05.271806955 CEST	443	49943	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:05.274930954 CEST	49948	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:05.274967909 CEST	443	49948	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:05.275047064 CEST	49948	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:05.275352001 CEST	49948	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:05.275366068 CEST	443	49948	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:05.310331106 CEST	443	49944	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:05.310369968 CEST	443	49944	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:05.310412884 CEST	443	49944	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:05.310444117 CEST	49944	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:05.310489893 CEST	49944	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:05.310728073 CEST	49944	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:05.310728073 CEST	49944	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:05.310744047 CEST	443	49944	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:05.310751915 CEST	443	49944	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:05.313333035 CEST	49949	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:05.313369036 CEST	443	49949	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:05.313488960 CEST	49949	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:05.313663006 CEST	49949	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:05.313671112 CEST	443	49949	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:05.321089029 CEST	443	49945	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:05.321223974 CEST	443	49945	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:05.321275949 CEST	49945	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:05.324615955 CEST	49945	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:05.324635029 CEST	443	49945	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:05.324645996 CEST	49945	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:05.324651003 CEST	443	49945	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:05.327522039 CEST	49950	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:05.327568054 CEST	443	49950	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:05.327756882 CEST	49950	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:05.327756882 CEST	49950	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:05.327789068 CEST	443	49950	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:05.389960051 CEST	443	49946	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:05.390034914 CEST	443	49946	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:05.390120029 CEST	49946	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:05.390149117 CEST	443	49946	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:05.390206099 CEST	49946	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:05.390392065 CEST	49946	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:05.390440941 CEST	443	49946	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:05.390470028 CEST	49946	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:05.390486002 CEST	443	49946	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:05.393495083 CEST	49951	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:05.393520117 CEST	443	49951	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:05.393635988 CEST	49951	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:05.393804073 CEST	49951	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:05.393819094 CEST	443	49951	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:05.493946075 CEST	443	49947	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:05.494507074 CEST	49947	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:05.494519949 CEST	443	49947	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:05.494990110 CEST	49947	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:05.495001078 CEST	443	49947	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:05.772340059 CEST	443	49947	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:05.772399902 CEST	443	49947	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:05.772551060 CEST	49947	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:05.772723913 CEST	49947	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:05.772742987 CEST	443	49947	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:05.772783995 CEST	49947	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:05.772800922 CEST	443	49947	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:05.775819063 CEST	49952	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:05.775855064 CEST	443	49952	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:05.776015997 CEST	49952	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:05.776207924 CEST	49952	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:05.776217937 CEST	443	49952	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:06.024169922 CEST	443	49948	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:06.024936914 CEST	49948	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:06.024946928 CEST	443	49948	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:06.025399923 CEST	49948	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:06.025403976 CEST	443	49948	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:06.071074963 CEST	443	49949	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:06.071688890 CEST	49949	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:06.071705103 CEST	443	49949	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:06.072156906 CEST	49949	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:06.072163105 CEST	443	49949	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:06.089478970 CEST	443	49950	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:06.089977026 CEST	49950	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:06.089992046 CEST	443	49950	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:06.090440989 CEST	49950	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:06.090445042 CEST	443	49950	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:06.144913912 CEST	443	49951	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:06.145421982 CEST	49951	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:06.145443916 CEST	443	49951	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:06.146028042 CEST	49951	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:06.146033049 CEST	443	49951	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:06.163991928 CEST	443	49948	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:06.164084911 CEST	443	49948	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:06.164143085 CEST	49948	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:06.164386988 CEST	49948	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:06.164401054 CEST	443	49948	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:06.164413929 CEST	49948	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:06.164418936 CEST	443	49948	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:06.167192936 CEST	49953	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:06.167243958 CEST	443	49953	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:06.167334080 CEST	49953	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:06.167503119 CEST	49953	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:06.167512894 CEST	443	49953	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:06.205935955 CEST	443	49949	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:06.206006050 CEST	443	49949	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:06.206083059 CEST	49949	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:06.206413031 CEST	49949	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:06.206413031 CEST	49949	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:06.206424952 CEST	443	49949	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:06.206434965 CEST	443	49949	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:06.209460974 CEST	49954	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:06.209475994 CEST	443	49954	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:06.209573030 CEST	49954	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:06.209773064 CEST	49954	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:06.209784031 CEST	443	49954	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:06.224739075 CEST	443	49950	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:06.224805117 CEST	443	49950	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:06.224853992 CEST	49950	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:06.224857092 CEST	443	49950	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:06.224900007 CEST	49950	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:06.225075006 CEST	49950	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:06.225083113 CEST	443	49950	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:06.225092888 CEST	49950	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:06.225097895 CEST	443	49950	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:06.227615118 CEST	49955	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:06.227644920 CEST	443	49955	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:06.227761984 CEST	49955	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:06.227874994 CEST	49955	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:06.227885962 CEST	443	49955	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:06.280554056 CEST	443	49951	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:06.280627966 CEST	443	49951	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:06.280680895 CEST	49951	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:06.280880928 CEST	49951	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:06.280889034 CEST	443	49951	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:06.280899048 CEST	49951	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:06.280903101 CEST	443	49951	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:06.283793926 CEST	49956	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:06.283822060 CEST	443	49956	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:06.283926964 CEST	49956	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:06.284059048 CEST	49956	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:06.284075022 CEST	443	49956	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:06.528815985 CEST	443	49952	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:06.529253006 CEST	49952	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:06.529268026 CEST	443	49952	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:06.530105114 CEST	49952	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:06.530109882 CEST	443	49952	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:06.663289070 CEST	443	49952	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:06.663360119 CEST	443	49952	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:06.663404942 CEST	49952	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:06.667836905 CEST	49952	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:06.667846918 CEST	443	49952	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:06.667870998 CEST	49952	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:06.667875051 CEST	443	49952	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:06.672250032 CEST	49957	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:06.672288895 CEST	443	49957	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:06.672353029 CEST	49957	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:06.672499895 CEST	49957	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:06.672508001 CEST	443	49957	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:06.903139114 CEST	443	49953	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:06.904550076 CEST	49953	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:06.904550076 CEST	49953	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:06.904567957 CEST	443	49953	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:06.904584885 CEST	443	49953	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:06.971786022 CEST	443	49954	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:06.972318888 CEST	49954	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:06.972337008 CEST	443	49954	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:06.972939014 CEST	49954	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:06.972943068 CEST	443	49954	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.001569033 CEST	443	49955	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.002049923 CEST	49955	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:07.002068043 CEST	443	49955	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.002475023 CEST	49955	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:07.002480984 CEST	443	49955	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.018037081 CEST	443	49956	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.018469095 CEST	49956	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:07.018481016 CEST	443	49956	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.018853903 CEST	49956	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:07.018863916 CEST	443	49956	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.035185099 CEST	443	49953	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.035211086 CEST	443	49953	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.035293102 CEST	49953	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:07.035306931 CEST	443	49953	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.035433054 CEST	443	49953	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.036950111 CEST	49953	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:07.039179087 CEST	49953	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:07.039179087 CEST	49953	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:07.039192915 CEST	443	49953	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.039201021 CEST	443	49953	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.042429924 CEST	49958	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:07.042471886 CEST	443	49958	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.042742014 CEST	49958	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:07.042742014 CEST	49958	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:07.042771101 CEST	443	49958	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.110070944 CEST	443	49954	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.110591888 CEST	443	49954	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.110682011 CEST	49954	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:07.110682011 CEST	49954	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:07.110853910 CEST	49954	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:07.110867023 CEST	443	49954	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.113317013 CEST	49959	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:07.113352060 CEST	443	49959	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.113584042 CEST	49959	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:07.113584042 CEST	49959	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:07.113615990 CEST	443	49959	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.135945082 CEST	443	49955	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.135963917 CEST	443	49955	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.136056900 CEST	49955	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:07.136069059 CEST	443	49955	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.136121988 CEST	443	49955	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.136224985 CEST	49955	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:07.136284113 CEST	49955	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:07.136284113 CEST	49955	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:07.136296034 CEST	443	49955	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.136305094 CEST	443	49955	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.149456024 CEST	443	49956	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.149482012 CEST	443	49956	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.149625063 CEST	49956	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:07.149638891 CEST	443	49956	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.149713039 CEST	443	49956	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.149897099 CEST	49956	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:07.161890984 CEST	49960	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:07.161935091 CEST	443	49960	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.162002087 CEST	49960	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:07.162214041 CEST	49956	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:07.162230015 CEST	443	49956	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.162266970 CEST	49956	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:07.162273884 CEST	443	49956	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.163551092 CEST	49960	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:07.163563967 CEST	443	49960	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.165198088 CEST	49961	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:07.165245056 CEST	443	49961	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.165338039 CEST	49961	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:07.165493965 CEST	49961	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:07.165508032 CEST	443	49961	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.395999908 CEST	443	49957	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.400824070 CEST	49957	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:07.400845051 CEST	443	49957	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.401315928 CEST	49957	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:07.401324034 CEST	443	49957	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.529896021 CEST	443	49957	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.529915094 CEST	443	49957	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.529975891 CEST	443	49957	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.529989958 CEST	49957	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:07.530020952 CEST	49957	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:07.580097914 CEST	49957	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:07.580115080 CEST	443	49957	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.585717916 CEST	49962	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:07.585766077 CEST	443	49962	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.585828066 CEST	49962	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:07.586222887 CEST	49962	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:07.586236954 CEST	443	49962	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.775479078 CEST	443	49958	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.776139021 CEST	49958	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:07.776164055 CEST	443	49958	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.776588917 CEST	49958	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:07.776595116 CEST	443	49958	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.874177933 CEST	443	49959	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.874859095 CEST	49959	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:07.874872923 CEST	443	49959	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.875092030 CEST	49959	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:07.875101089 CEST	443	49959	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.908066034 CEST	443	49958	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.908096075 CEST	443	49958	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.908160925 CEST	443	49958	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.908299923 CEST	49958	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:07.908557892 CEST	49958	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:07.908585072 CEST	443	49958	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.908598900 CEST	49958	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:07.908605099 CEST	443	49958	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.911406994 CEST	49963	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:07.911462069 CEST	443	49963	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.911557913 CEST	49963	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:07.911720037 CEST	49963	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:07.911734104 CEST	443	49963	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.923232079 CEST	443	49960	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.923633099 CEST	49960	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:07.923651934 CEST	443	49960	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.924094915 CEST	49960	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:07.924108982 CEST	443	49960	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.927141905 CEST	443	49961	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.927402973 CEST	49961	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:07.927422047 CEST	443	49961	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:07.927716970 CEST	49961	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:07.927725077 CEST	443	49961	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:08.010284901 CEST	443	49959	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:08.010644913 CEST	443	49959	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:08.010750055 CEST	49959	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:08.010804892 CEST	49959	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:08.010804892 CEST	49959	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:08.010822058 CEST	443	49959	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:08.010831118 CEST	443	49959	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:08.014029980 CEST	49964	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:08.014065027 CEST	443	49964	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:08.014221907 CEST	49964	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:08.015192032 CEST	49964	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:08.015204906 CEST	443	49964	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:08.063478947 CEST	443	49961	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:08.063870907 CEST	443	49961	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:08.063944101 CEST	49961	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:08.064546108 CEST	443	49960	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:08.065258980 CEST	49961	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:08.065284014 CEST	443	49961	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:08.065299034 CEST	49961	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:08.065306902 CEST	443	49961	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:08.066366911 CEST	443	49960	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:08.066453934 CEST	49960	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:08.066481113 CEST	49960	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:08.066494942 CEST	443	49960	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:08.068515062 CEST	49965	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:08.068584919 CEST	443	49965	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:08.068634987 CEST	49966	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:08.068658113 CEST	443	49966	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:08.068675041 CEST	49965	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:08.068725109 CEST	49966	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:08.068840027 CEST	49965	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:08.068880081 CEST	443	49965	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:08.068938971 CEST	49966	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:08.068998098 CEST	443	49966	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:08.362092972 CEST	443	49962	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:08.362780094 CEST	49962	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:08.362809896 CEST	443	49962	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:08.363249063 CEST	49962	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:08.363255024 CEST	443	49962	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:08.496022940 CEST	443	49962	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:08.496104002 CEST	443	49962	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:08.496156931 CEST	49962	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:08.496299982 CEST	49962	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:08.496320963 CEST	443	49962	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:08.496334076 CEST	49962	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:08.496340990 CEST	443	49962	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:08.499304056 CEST	49967	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:08.499341965 CEST	443	49967	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:08.499418974 CEST	49967	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:08.499560118 CEST	49967	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:08.499588013 CEST	443	49967	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:08.658696890 CEST	443	49963	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:08.659312963 CEST	49963	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:08.659351110 CEST	443	49963	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:08.659827948 CEST	49963	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:08.659835100 CEST	443	49963	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:08.779751062 CEST	443	49964	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:08.780276060 CEST	49964	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:08.780296087 CEST	443	49964	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:08.780632019 CEST	49964	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:08.780637026 CEST	443	49964	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:08.791721106 CEST	443	49963	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:08.791750908 CEST	443	49963	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:08.791794062 CEST	49963	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:08.791811943 CEST	443	49963	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:08.791841030 CEST	443	49963	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:08.791870117 CEST	49963	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:08.791918993 CEST	49963	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:08.792048931 CEST	49963	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:08.792048931 CEST	49963	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:08.792067051 CEST	443	49963	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:08.792074919 CEST	443	49963	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:08.794790983 CEST	49968	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:08.794828892 CEST	443	49968	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:08.794919014 CEST	49968	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:08.795387983 CEST	49968	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:08.795398951 CEST	443	49968	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:08.803189039 CEST	443	49966	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:08.803580046 CEST	49966	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:08.803608894 CEST	443	49966	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:08.804038048 CEST	49966	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:08.804044008 CEST	443	49966	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:08.820626020 CEST	443	49965	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:08.821041107 CEST	49965	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:08.821053982 CEST	443	49965	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:08.821501970 CEST	49965	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:08.821506977 CEST	443	49965	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:08.924732924 CEST	443	49964	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:08.924751997 CEST	443	49964	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:08.924828053 CEST	443	49964	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:08.924828053 CEST	49964	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:08.924877882 CEST	49964	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:08.925081968 CEST	49964	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:08.925100088 CEST	443	49964	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:08.925112009 CEST	49964	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:08.925117970 CEST	443	49964	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:08.927843094 CEST	49969	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:08.927881002 CEST	443	49969	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:08.927978039 CEST	49969	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:08.928257942 CEST	49969	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:08.928271055 CEST	443	49969	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:08.936743021 CEST	443	49966	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:08.936774015 CEST	443	49966	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:08.936832905 CEST	49966	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:08.936836958 CEST	443	49966	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:08.936887026 CEST	49966	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:08.937046051 CEST	49966	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:08.937046051 CEST	49966	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:08.937092066 CEST	443	49966	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:08.937114954 CEST	443	49966	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:08.939234018 CEST	49970	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:08.939253092 CEST	443	49970	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:08.939390898 CEST	49970	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:08.939557076 CEST	49970	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:08.939572096 CEST	443	49970	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:09.081520081 CEST	443	49965	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:09.081548929 CEST	443	49965	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:09.081597090 CEST	443	49965	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:09.081623077 CEST	49965	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:09.081634045 CEST	443	49965	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:09.081662893 CEST	49965	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:09.081687927 CEST	49965	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:09.082257032 CEST	443	49965	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:09.082314014 CEST	49965	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:09.082317114 CEST	443	49965	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:09.082348108 CEST	443	49965	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:09.082390070 CEST	49965	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:09.088335037 CEST	49965	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:09.088359118 CEST	443	49965	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:09.088373899 CEST	49965	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:09.088382006 CEST	443	49965	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:09.091447115 CEST	49971	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:09.091490030 CEST	443	49971	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:09.091556072 CEST	49971	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:09.091734886 CEST	49971	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:09.091747999 CEST	443	49971	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:09.246274948 CEST	443	49967	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:09.246965885 CEST	49967	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:09.246989012 CEST	443	49967	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:09.247440100 CEST	49967	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:09.247445107 CEST	443	49967	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:09.491241932 CEST	443	49967	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:09.491266966 CEST	443	49967	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:09.491282940 CEST	443	49967	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:09.491328001 CEST	49967	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:09.491343975 CEST	443	49967	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:09.491377115 CEST	49967	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:09.491396904 CEST	49967	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:09.521544933 CEST	443	49968	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:09.522193909 CEST	49968	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:09.522222042 CEST	443	49968	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:09.522732019 CEST	49968	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:09.522741079 CEST	443	49968	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:09.800528049 CEST	443	49968	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:09.800551891 CEST	443	49968	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:09.800609112 CEST	443	49968	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:09.800631046 CEST	49968	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:09.800667048 CEST	49968	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:09.800937891 CEST	49968	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:09.800957918 CEST	443	49968	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:09.800970078 CEST	49968	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:09.800975084 CEST	443	49968	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:09.801397085 CEST	443	49967	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:09.801405907 CEST	443	49967	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:09.801435947 CEST	443	49967	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:09.801465034 CEST	49967	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:09.801470995 CEST	443	49967	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:09.801492929 CEST	443	49967	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:09.801498890 CEST	49967	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:09.801512957 CEST	49967	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:09.801538944 CEST	49967	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:09.801629066 CEST	49967	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:09.801640034 CEST	443	49967	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:09.801651001 CEST	49967	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:09.801656008 CEST	443	49967	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:09.802707911 CEST	443	49969	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:09.802941084 CEST	443	49970	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:09.803172112 CEST	49969	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:09.803189993 CEST	443	49969	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:09.803678036 CEST	49969	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:09.803683996 CEST	443	49969	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:09.803874969 CEST	49970	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:09.803883076 CEST	443	49970	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:09.803910017 CEST	49972	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:09.803939104 CEST	443	49972	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:09.804017067 CEST	49972	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:09.804102898 CEST	49972	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:09.804114103 CEST	443	49972	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:09.804440022 CEST	49970	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:09.804445982 CEST	443	49970	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:09.804817915 CEST	49973	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:09.804847002 CEST	443	49973	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:09.804949045 CEST	49973	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:09.805051088 CEST	49973	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:09.805067062 CEST	443	49973	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:09.930799961 CEST	443	49971	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:09.931412935 CEST	49971	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:09.931441069 CEST	443	49971	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:09.931880951 CEST	49971	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:09.931888103 CEST	443	49971	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:09.936774015 CEST	443	49969	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:09.936806917 CEST	443	49969	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:09.936896086 CEST	49969	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:09.936909914 CEST	443	49969	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:09.937015057 CEST	443	49969	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:09.937071085 CEST	49969	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:09.937146902 CEST	49969	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:09.937160969 CEST	443	49969	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:09.937179089 CEST	49969	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:09.937184095 CEST	443	49969	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:09.941152096 CEST	49974	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:09.941183090 CEST	443	49974	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:09.941240072 CEST	49974	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:09.941396952 CEST	49974	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:09.941411972 CEST	443	49974	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:09.998536110 CEST	443	49970	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:10.000128984 CEST	443	49970	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:10.000238895 CEST	49970	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:10.000282049 CEST	49970	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:10.000282049 CEST	49970	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:10.000300884 CEST	443	49970	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:10.000309944 CEST	443	49970	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:10.002993107 CEST	49975	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:10.003046036 CEST	443	49975	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:10.003129005 CEST	49975	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:10.003268003 CEST	49975	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:10.003276110 CEST	443	49975	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:10.063914061 CEST	443	49971	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:10.064207077 CEST	443	49971	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:10.064292908 CEST	49971	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:10.064347029 CEST	49971	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:10.064347029 CEST	49971	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:10.064368010 CEST	443	49971	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:10.064380884 CEST	443	49971	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:10.067228079 CEST	49976	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:10.067260027 CEST	443	49976	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:10.067327976 CEST	49976	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:10.067476034 CEST	49976	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:10.067485094 CEST	443	49976	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:10.546112061 CEST	443	49973	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:10.546597004 CEST	49973	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:10.546612978 CEST	443	49973	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:10.547347069 CEST	49973	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:10.547352076 CEST	443	49973	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:10.567455053 CEST	443	49972	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:10.567887068 CEST	49972	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:10.567909002 CEST	443	49972	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:10.568553925 CEST	49972	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:10.568564892 CEST	443	49972	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:10.681066990 CEST	443	49973	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:10.681143045 CEST	443	49973	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:10.681220055 CEST	49973	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:10.681391001 CEST	49973	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:10.681411982 CEST	443	49973	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:10.681425095 CEST	49973	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:10.681431055 CEST	443	49973	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:10.684495926 CEST	49977	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:10.684546947 CEST	443	49977	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:10.684617043 CEST	49977	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:10.684762955 CEST	49977	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:10.684777021 CEST	443	49977	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:10.689904928 CEST	443	49974	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:10.690294981 CEST	49974	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:10.690310001 CEST	443	49974	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:10.690886974 CEST	49974	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:10.690891981 CEST	443	49974	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:10.704248905 CEST	443	49972	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:10.704345942 CEST	443	49972	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:10.704387903 CEST	49972	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:10.704473972 CEST	49972	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:10.704493046 CEST	443	49972	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:10.704505920 CEST	49972	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:10.704515934 CEST	443	49972	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:10.706923962 CEST	49978	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:10.706954002 CEST	443	49978	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:10.707068920 CEST	49978	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:10.707181931 CEST	49978	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:10.707195044 CEST	443	49978	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:10.748224020 CEST	49705	80	192.168.2.9	192.229.221.95
Oct 18, 2024 00:28:10.748295069 CEST	49704	80	192.168.2.9	192.229.221.95
Oct 18, 2024 00:28:10.748362064 CEST	49706	80	192.168.2.9	2.23.198.32
Oct 18, 2024 00:28:10.754910946 CEST	80	49705	192.229.221.95	192.168.2.9
Oct 18, 2024 00:28:10.755068064 CEST	49705	80	192.168.2.9	192.229.221.95
Oct 18, 2024 00:28:10.755958080 CEST	80	49704	192.229.221.95	192.168.2.9
Oct 18, 2024 00:28:10.755969048 CEST	80	49706	2.23.198.32	192.168.2.9
Oct 18, 2024 00:28:10.756011009 CEST	49704	80	192.168.2.9	192.229.221.95
Oct 18, 2024 00:28:10.756023884 CEST	49706	80	192.168.2.9	2.23.198.32
Oct 18, 2024 00:28:10.767635107 CEST	443	49975	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:10.768105984 CEST	49975	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:10.768121958 CEST	443	49975	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:10.768556118 CEST	49975	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:10.768560886 CEST	443	49975	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:10.825423956 CEST	443	49974	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:10.825452089 CEST	443	49974	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:10.825501919 CEST	443	49974	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:10.825542927 CEST	49974	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:10.825577974 CEST	49974	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:10.825823069 CEST	49974	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:10.825849056 CEST	443	49974	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:10.825855017 CEST	49974	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:10.825860977 CEST	443	49974	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:10.902930021 CEST	443	49975	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:10.903012037 CEST	443	49975	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:10.903148890 CEST	49975	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:10.903445959 CEST	49975	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:10.903445959 CEST	49975	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:10.903465033 CEST	443	49975	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:10.903474092 CEST	443	49975	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:11.041961908 CEST	443	49976	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:11.042623997 CEST	49976	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:11.042638063 CEST	443	49976	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:11.043066025 CEST	49976	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:11.043070078 CEST	443	49976	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:11.177741051 CEST	443	49976	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:11.177817106 CEST	443	49976	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:11.177879095 CEST	49976	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:11.178116083 CEST	49976	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:11.178116083 CEST	49976	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:11.178129911 CEST	443	49976	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:11.178138018 CEST	443	49976	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:11.439659119 CEST	443	49978	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:11.440211058 CEST	49978	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:11.440223932 CEST	443	49978	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:11.440665007 CEST	49978	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:11.440670013 CEST	443	49978	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:11.442686081 CEST	443	49977	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:11.442960024 CEST	49977	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:11.442975998 CEST	443	49977	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:11.443276882 CEST	49977	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:11.443298101 CEST	443	49977	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:11.572312117 CEST	443	49978	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:11.572509050 CEST	443	49978	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:11.572571993 CEST	49978	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:11.572618008 CEST	49978	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:11.572632074 CEST	443	49978	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:11.572645903 CEST	49978	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:11.572650909 CEST	443	49978	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:11.579971075 CEST	443	49977	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:11.580106974 CEST	443	49977	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:11.580185890 CEST	49977	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:11.580209017 CEST	49977	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:11.580215931 CEST	443	49977	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:11.580234051 CEST	49977	443	192.168.2.9	13.107.246.45
Oct 18, 2024 00:28:11.580239058 CEST	443	49977	13.107.246.45	192.168.2.9
Oct 18, 2024 00:28:15.763870001 CEST	49708	80	192.168.2.9	93.184.221.240
Oct 18, 2024 00:28:15.770898104 CEST	80	49708	93.184.221.240	192.168.2.9
Oct 18, 2024 00:28:15.770963907 CEST	49708	80	192.168.2.9	93.184.221.240

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 18, 2024 00:27:19.951000929 CEST	1.1.1.1	192.168.2.9	0xcd8c	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 18, 2024 00:27:19.951000929 CEST	1.1.1.1	192.168.2.9	0xcd8c	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	18:27:25
Start date:	17/10/2024
Path:	C:\Users\user\Desktop\RepozetorySetup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\RepozetorySetup.exe"
Imagebase:	0xa90000
File size:	1'532'968 bytes
MD5 hash:	C731CE4E3A8AB780ED4CB4E29CCA10FC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1436031916.0000000000AAB000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	18:27:25
Start date:	17/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0xbd0000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000002.00000002.1477295401.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000002.00000002.1479189708.0000000002F14000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.1479189708.000000000312F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	18:27:26
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7496 -s 260
Imagebase:	0x670000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.3%
Total number of Nodes:	1169
Total number of Limit Nodes:	5

Executed Functions

Function 00A91659 Relevance: 1.6, APIs: 1, Instructions: 104
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(00AF6B30,000004E4,00000040,?), ref: 00A9176E

Memory Dump Source

Source File: 00000000.00000002.1435998490.0000000000A91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.1435984523.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436016696.0000000000AA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AAB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436094996.0000000000AF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436112707.0000000000AF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000AFB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_RepozetorySetup.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 16f430fa0500177a4882dddb86f123d2b28dd550fce488bd7d9fe6c2986bcf81
Instruction ID: d223885873192e53f458abbe94353ad327f78a01f0e734355736ba5463a60f76
Opcode Fuzzy Hash: 16f430fa0500177a4882dddb86f123d2b28dd550fce488bd7d9fe6c2986bcf81
Instruction Fuzzy Hash: 1E21D02B71461747E70CA1B5D9926E7F6D9E789720F440226EB07877E0D7388D0282C4

Function 00AA0264 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__alloca_probe_16.LIBCMT ref: 00AA02EB
__alloca_probe_16.LIBCMT ref: 00AA03AC
__freea.LIBCMT ref: 00AA0413

Part of subcall function 00A98B47: HeapAlloc.KERNEL32(00000000,?,?,?,00A92838,?,?,?,?,?,00A91051,?,?,?,00A910E3,?), ref: 00A98B79

__freea.LIBCMT ref: 00AA0428
__freea.LIBCMT ref: 00AA0438

Strings

5!5x, xrefs: 00AA026B

Memory Dump Source

Source File: 00000000.00000002.1435998490.0000000000A91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.1435984523.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436016696.0000000000AA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AAB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436094996.0000000000AF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436112707.0000000000AF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000AFB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_RepozetorySetup.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID: 5!5x
API String ID: 1096550386-600948960
Opcode ID: 6ab5901423c42a1c9172ded0d20a0a43170970821cd09871d78d3ffdfe5e25fd
Instruction ID: ab964e088481d5370a646c5a26195ab78a985fc833ecd54bd5e4cf223b4a028f
Opcode Fuzzy Hash: 6ab5901423c42a1c9172ded0d20a0a43170970821cd09871d78d3ffdfe5e25fd
Instruction Fuzzy Hash: 5651927260021AAFEF219FA4CD81EBF7AE9EF4A354B154128FE04DB191EB75CC50C660

Function 00A9B591 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A9B0C1: GetOEMCP.KERNEL32(00000000,?,?,?,00000000), ref: 00A9B0EC

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,00A9B3D8,?,00000000,?,?,00000000), ref: 00A9B5F2
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,00A9B3D8,?,00000000,?,?,00000000), ref: 00A9B634

Strings

5!5x, xrefs: 00A9B599

Memory Dump Source

Source File: 00000000.00000002.1435998490.0000000000A91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.1435984523.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436016696.0000000000AA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AAB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436094996.0000000000AF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436112707.0000000000AF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000AFB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_RepozetorySetup.jbxd

Yara matches

Similarity

API ID: CodeInfoPageValid
String ID: 5!5x
API String ID: 546120528-600948960
Opcode ID: b1ba381cfa64459bf3e00f89f640a902df4aa1ad80cf324e87f333b7161e1b81
Instruction ID: 5c524cafae9a0855815deb77ed87b626950401653cdf897145071b2820dd7980
Opcode Fuzzy Hash: b1ba381cfa64459bf3e00f89f640a902df4aa1ad80cf324e87f333b7161e1b81
Instruction Fuzzy Hash: 46513870B103458EDF20CFB5EA906BABBF5EF85300F14456ED1868B292D774A946CB60

Function 00A9B195 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(E8458D00,?,00A9B3E4,00A9B3D8,00000000), ref: 00A9B1C7

Strings

5!5x, xrefs: 00A9B1A0

Memory Dump Source

Source File: 00000000.00000002.1435998490.0000000000A91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.1435984523.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436016696.0000000000AA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AAB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436094996.0000000000AF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436112707.0000000000AF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000AFB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_RepozetorySetup.jbxd

Yara matches

Similarity

API ID: Info
String ID: 5!5x
API String ID: 1807457897-600948960
Opcode ID: d1f0409c6fdba7f89400c290aa453fe1e0520f0d145ae56715f77c957239fe28
Instruction ID: 38c314c539126a41455ac62407dfc1a48827e84376be0d111e58c4fa5f43b1c4
Opcode Fuzzy Hash: d1f0409c6fdba7f89400c290aa453fe1e0520f0d145ae56715f77c957239fe28
Instruction Fuzzy Hash: 9D5147716142589ADF218F28DE84BEA7BFCEB56304F2405ADE59AC7182C3349D46DF30

Function 00A984DE Relevance: 3.0, APIs: 2, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE(?,00AA0352,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00A98512
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00AA0352,?,?,00000000,?,00000000), ref: 00A98530

Memory Dump Source

Source File: 00000000.00000002.1435998490.0000000000A91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.1435984523.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436016696.0000000000AA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AAB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436094996.0000000000AF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436112707.0000000000AF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000AFB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_RepozetorySetup.jbxd

Yara matches

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: f243a422a5fb416449c8ff7ee52c47c58dcd0ab1750094f38a2e32cc3c5522a6
Instruction ID: ed47e5bc9951c2981ce009bece729421c9a294b53738e15800dcb336db10c190
Opcode Fuzzy Hash: f243a422a5fb416449c8ff7ee52c47c58dcd0ab1750094f38a2e32cc3c5522a6
Instruction Fuzzy Hash: 2CF09D3250011AFBCF125F90DD05DDE3FA6EF593A0F064115FA1825120CB7AC972AB90

Non-executed Functions

Function 00A9E1A8 Relevance: 11.9, APIs: 1, Strings: 5, Instructions: 1436COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00A9E38C

Strings

1#IND, xrefs: 00A9E2AD
1#INF, xrefs: 00A9E2DE
1#QNAN, xrefs: 00A9E2BB
1#SNAN, xrefs: 00A9E2B4
5!5x, xrefs: 00A9E1B3

Memory Dump Source

Source File: 00000000.00000002.1435998490.0000000000A91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.1435984523.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436016696.0000000000AA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AAB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436094996.0000000000AF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436112707.0000000000AF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000AFB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_RepozetorySetup.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN$5!5x
API String ID: 4168288129-1958590150
Opcode ID: 55bb5cfad97c87483161c33dd35f948f872aa47e48e8c927f385784489e3484a
Instruction ID: 79e0c4b50bc5b59a9f79604f1a081fdb845bb66212a8c85646093d337a50fbb3
Opcode Fuzzy Hash: 55bb5cfad97c87483161c33dd35f948f872aa47e48e8c927f385784489e3484a
Instruction Fuzzy Hash: 19D2E372E082298FDF65CF28DD407EAB7F5AB85305F1445EAD40DE6241EB78AE818F41

Function 00A96A44 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 00A96B3C
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00A96B46
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 00A96B53

Strings

5!5x, xrefs: 00A96A4F

Memory Dump Source

Source File: 00000000.00000002.1435998490.0000000000A91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.1435984523.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436016696.0000000000AA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AAB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436094996.0000000000AF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436112707.0000000000AF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000AFB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_RepozetorySetup.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID: 5!5x
API String ID: 3906539128-600948960
Opcode ID: f7f64fb5ad42e934cba063957a0e69eee0c31daa5cc24770f93b0ee43f9ccdfa
Instruction ID: 732a79c8436133f02681c57c2fb886ce35cd193ae95295ce5f9ea7546ddcff40
Opcode Fuzzy Hash: f7f64fb5ad42e934cba063957a0e69eee0c31daa5cc24770f93b0ee43f9ccdfa
Instruction Fuzzy Hash: DE31D275901229ABCF21DF68D988BCDBBF8AF48310F5041EAE50CA6290E7709F858F44

Function 00A99028 Relevance: 6.3, APIs: 4, Instructions: 337COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00A990B5

Memory Dump Source

Source File: 00000000.00000002.1435998490.0000000000A91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.1435984523.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436016696.0000000000AA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AAB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436094996.0000000000AF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436112707.0000000000AF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000AFB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_RepozetorySetup.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: e742114cad1722125c79802c132c505b8aa059e1db89f26ea849efe0e0605f33
Instruction ID: 61b6af8f82fe5bf114a05de1b47acb598136bb5c4a3c62d88a92b9a7dac47cb6
Opcode Fuzzy Hash: e742114cad1722125c79802c132c505b8aa059e1db89f26ea849efe0e0605f33
Instruction Fuzzy Hash: B2B11232B04246BFDF158F6CC8817EFBBE5EF59300F15826EE814AB281D2359901CBA1

Function 00A92240 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00A9224C
IsDebuggerPresent.KERNEL32 ref: 00A92318
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00A92331
UnhandledExceptionFilter.KERNEL32(?), ref: 00A9233B

Memory Dump Source

Source File: 00000000.00000002.1435998490.0000000000A91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.1435984523.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436016696.0000000000AA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AAB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436094996.0000000000AF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436112707.0000000000AF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000AFB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_RepozetorySetup.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 86b3e487bba1dcdce00add323f4f5d1a6fba6cabe271217b6ffacf4e387db436
Instruction ID: df0fbbe112a6363a17b0d94f3a624a8b765b2534b1977270d66d484fa54f5bf8
Opcode Fuzzy Hash: 86b3e487bba1dcdce00add323f4f5d1a6fba6cabe271217b6ffacf4e387db436
Instruction Fuzzy Hash: B2312779D01219DBDF21DFA4D949BCDBBF8AF48300F1041AAE50CAB290EB749B859F45

Function 00A9A88B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 140COMMON

Download Yara Rule

Strings

5!5x, xrefs: 00A9A947

Memory Dump Source

Source File: 00000000.00000002.1435998490.0000000000A91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.1435984523.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436016696.0000000000AA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AAB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436094996.0000000000AF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436112707.0000000000AF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000AFB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_RepozetorySetup.jbxd

Yara matches

Similarity

API ID:
String ID: 5!5x
API String ID: 0-600948960
Opcode ID: f149d5af3239c5c46749509486b926af6f44101b34b2661295604668ecefb8de
Instruction ID: ca0f0ffa29d43c4e0d17728459bdb938ffcfd40049d54aa0f3d7310f8fb785a4
Opcode Fuzzy Hash: f149d5af3239c5c46749509486b926af6f44101b34b2661295604668ecefb8de
Instruction Fuzzy Hash: F641D2B5D00219AFCF20DF69CD89AAABBF8EF55300F1442DAE40DD3201DA359E818F50

Function 00A9DD20 Relevance: 3.4, APIs: 2, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1435998490.0000000000A91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.1435984523.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436016696.0000000000AA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AAB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436094996.0000000000AF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436112707.0000000000AF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000AFB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_RepozetorySetup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18b3df0f6a783b84a0005ec9b5b8d67f3646548f487e0ba2d8827565c9d32673
Instruction ID: 6ae030c5b2b19dce4c7f17d3437ea36186e4a352e46455c78bd6150775b3f5eb
Opcode Fuzzy Hash: 18b3df0f6a783b84a0005ec9b5b8d67f3646548f487e0ba2d8827565c9d32673
Instruction Fuzzy Hash: 25F12D71E012199FDF14CFA9D9806ADB7F1FF98314F258269E819AB381D731AE418B90

Function 00A95F0E Relevance: 2.8, Strings: 2, Instructions: 314COMMON

Download Yara Rule

Strings

0, xrefs: 00A96098
5!5x, xrefs: 00A95F16

Memory Dump Source

Source File: 00000000.00000002.1435998490.0000000000A91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.1435984523.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436016696.0000000000AA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AAB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436094996.0000000000AF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436112707.0000000000AF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000AFB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_RepozetorySetup.jbxd

Yara matches

Similarity

API ID:
String ID: 0$5!5x
API String ID: 0-2204905526
Opcode ID: 889f3207443f6b57b07b1b7e99738c924dab8e15e1f5aab7b11d354d617305fb
Instruction ID: 22bf6b5fd47807324fd05247114378dc78537b65634727ca95958f43609cfacf
Opcode Fuzzy Hash: 889f3207443f6b57b07b1b7e99738c924dab8e15e1f5aab7b11d354d617305fb
Instruction Fuzzy Hash: BEB1D070F00A0A9BCF25CF68CA966BEB7F1AF01314F24461ED492AB691D731EA41CB51

Function 00AA28E0 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00AA28DB,?,?,00000008,?,?,00AA24E5,00000000), ref: 00AA2B0D

Memory Dump Source

Source File: 00000000.00000002.1435998490.0000000000A91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.1435984523.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436016696.0000000000AA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AAB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436094996.0000000000AF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436112707.0000000000AF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000AFB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_RepozetorySetup.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: f4fb14984351dd3dd02f6d59c2c439683df5c658372b02891d82a51049cbc27b
Instruction ID: aaee8deab3afd7e3fc3c36149791c403258481babe5acd9956ee9be395ac668d
Opcode Fuzzy Hash: f4fb14984351dd3dd02f6d59c2c439683df5c658372b02891d82a51049cbc27b
Instruction Fuzzy Hash: B8B108356106099FD729CF2CC486B657BA0FF46365F258658E89ACF2E1C335E9A2CB40

Function 00A924D5 Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00A924EB

Memory Dump Source

Source File: 00000000.00000002.1435998490.0000000000A91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.1435984523.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436016696.0000000000AA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AAB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436094996.0000000000AF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436112707.0000000000AF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000AFB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_RepozetorySetup.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 2caaa0e7b5b1c9950699ac70875fede6b012674a4e62aca7e934a1e0403fdd81
Instruction ID: 88239ae00bc3e1b79c719fee001eb90d59c6374f6e52f25e7a62973d594fd53b
Opcode Fuzzy Hash: 2caaa0e7b5b1c9950699ac70875fede6b012674a4e62aca7e934a1e0403fdd81
Instruction Fuzzy Hash: 92A17EB1A156469FDB18CF98D8817AEBBF0FB49314F24822ED425EB7A1D3349845CF60

Function 00A923CD Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000023D9,00A91C04), ref: 00A923D2

Memory Dump Source

Source File: 00000000.00000002.1435998490.0000000000A91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.1435984523.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436016696.0000000000AA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AAB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436094996.0000000000AF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436112707.0000000000AF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000AFB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_RepozetorySetup.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: cecd48dc439f677bf0cac17fee027b0c4a804e1b18e41db1a3c1750b5a768917
Instruction ID: 11d6c0ec486ef7a802918136cb709910fb1a796dd31110b5f5949158eacd94f5
Opcode Fuzzy Hash: cecd48dc439f677bf0cac17fee027b0c4a804e1b18e41db1a3c1750b5a768917
Instruction Fuzzy Hash:

Function 00A9BAA5 Relevance: 1.3, Strings: 1, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Strings

5!5x, xrefs: 00A9BABF, 00A9BAC2

Memory Dump Source

Source File: 00000000.00000002.1435998490.0000000000A91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.1435984523.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436016696.0000000000AA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AAB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436094996.0000000000AF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436112707.0000000000AF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000AFB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_RepozetorySetup.jbxd

Yara matches

Similarity

API ID:
String ID: 5!5x
API String ID: 0-600948960
Opcode ID: a531db49a4f3729ab887177585f355256e3b6d79a99a6b39f015d026f8895b42
Instruction ID: 4d3b1ee6408e754b4e8cd4c707d12c68639ca21ee5bbf35091e650e2f7b02348
Opcode Fuzzy Hash: a531db49a4f3729ab887177585f355256e3b6d79a99a6b39f015d026f8895b42
Instruction Fuzzy Hash: BFE08C32A21238EBCB14DB88DA04D8AF3FCEB49B80B150096B501E3500C674DE00C7E0

Function 00A9C51B Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00A9C51B

Memory Dump Source

Source File: 00000000.00000002.1435998490.0000000000A91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.1435984523.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436016696.0000000000AA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AAB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436094996.0000000000AF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436112707.0000000000AF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000AFB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_RepozetorySetup.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 51008e2bda193ce8f0dc74b4d209e2b2033921ea7bd7ac938ceb6bd474aef7e5
Instruction ID: d1a6db2c9a79b76ce60feb108f314f64eb054c34d445261b1c94ae743de279c1
Opcode Fuzzy Hash: 51008e2bda193ce8f0dc74b4d209e2b2033921ea7bd7ac938ceb6bd474aef7e5
Instruction Fuzzy Hash: 80A01230104101CB4300CFF26D0920C35986546180301C0546102C02A0D7244011DF00

Function 00A91317 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1435998490.0000000000A91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.1435984523.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436016696.0000000000AA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AAB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436094996.0000000000AF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436112707.0000000000AF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000AFB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_RepozetorySetup.jbxd

Yara matches

Similarity

API ID: H_prolog3_catch
String ID:
API String ID: 3886170330-0
Opcode ID: 653a0b566cbe3f88cf29540f0e7a705313fb94238d11bfe9de31dfc28c651a3a
Instruction ID: 694aa469f5ffc06504e0945290e9cacc714c6e96093204941207789ca2ee8014
Opcode Fuzzy Hash: 653a0b566cbe3f88cf29540f0e7a705313fb94238d11bfe9de31dfc28c651a3a
Instruction Fuzzy Hash: E651F776E1022A5BCF48DFB9C9855EEFBF5EB89310F14423AD914EB390D2348A01CB90

Function 00A915F4 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1435998490.0000000000A91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.1435984523.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436016696.0000000000AA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AAB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436094996.0000000000AF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436112707.0000000000AF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000AFB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_RepozetorySetup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3925294ec3a04296e9b5ebb35d33663f777b60c9ce8f992e8f26ee94434d769
Instruction ID: 96fa23fd28b7ef129fcd783351577536c0a4256ade5f91919c6800009ebd4371
Opcode Fuzzy Hash: f3925294ec3a04296e9b5ebb35d33663f777b60c9ce8f992e8f26ee94434d769
Instruction Fuzzy Hash: A7E092B0759208ABE3089B54D5267677AE5EBC5300F10C43DF389CB7C0DFB898059B96

Function 00A9771D Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1435998490.0000000000A91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.1435984523.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436016696.0000000000AA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AAB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436094996.0000000000AF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436112707.0000000000AF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000AFB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_RepozetorySetup.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6f8aa25285df3118817bb43e8fb066e78d4562735eb8b7e63a52ee34af13324
Instruction ID: e0b08b8bedd247daac6f066c88f609f886480584e038559b6a9197e4c1e62187
Opcode Fuzzy Hash: c6f8aa25285df3118817bb43e8fb066e78d4562735eb8b7e63a52ee34af13324
Instruction Fuzzy Hash: C3C08C3822090087CE298B10AB713A833E5A7917C2FC0048CC4020BB82CE1E9C83D674

Function 00A92EC0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_ValidateLocalCookies.LIBCMT ref: 00A92EF7
___except_validate_context_record.LIBVCRUNTIME ref: 00A92EFF
_ValidateLocalCookies.LIBCMT ref: 00A92F88
__IsNonwritableInCurrentImage.LIBCMT ref: 00A92FB3
_ValidateLocalCookies.LIBCMT ref: 00A93008

Strings

csm, xrefs: 00A92F9D
5!5x, xrefs: 00A92EE9, 00A92F72, 00A92FEF

Memory Dump Source

Source File: 00000000.00000002.1435998490.0000000000A91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.1435984523.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436016696.0000000000AA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AAB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436094996.0000000000AF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436112707.0000000000AF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000AFB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_RepozetorySetup.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: 5!5x$csm
API String ID: 1170836740-1068043909
Opcode ID: de4f48f3e32e7770c64328f1cec080be6c125f5381427bd8963a1e222b9537d5
Instruction ID: 5eac87ef00b9898993bf61c968eae7e777480213b92e835112ba04dcc39f4bc7
Opcode Fuzzy Hash: de4f48f3e32e7770c64328f1cec080be6c125f5381427bd8963a1e222b9537d5
Instruction Fuzzy Hash: 19418F35B00209AFCF10DF68C884B9EBBF5AF45324F148159F8199B392D771EA66CB90

Function 00A93F1D Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 303
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

type_info::operator==.LIBVCRUNTIME ref: 00A9403C
___TypeMatch.LIBVCRUNTIME ref: 00A9414A
CallUnexpected.LIBVCRUNTIME ref: 00A942B7

Strings

csm, xrefs: 00A93FC7
csm, xrefs: 00A94073
csm, xrefs: 00A93F5A

Memory Dump Source

Source File: 00000000.00000002.1435998490.0000000000A91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.1435984523.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436016696.0000000000AA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AAB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436094996.0000000000AF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436112707.0000000000AF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000AFB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_RepozetorySetup.jbxd

Yara matches

Similarity

API ID: CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 1206542248-393685449
Opcode ID: 5bc0eb868dfcb4bb072926d20acdaf39250f0ba9eaebd66cb8380c3da21f557e
Instruction ID: 00d2fdac14cc6cfdf33fc035fa0885e159f2d4a3398faa1488bb8743006b0859
Opcode Fuzzy Hash: 5bc0eb868dfcb4bb072926d20acdaf39250f0ba9eaebd66cb8380c3da21f557e
Instruction Fuzzy Hash: 17B16572A00219AFCF28DFA5D981DAEBBF5FF18310F11416AF8116B212D730DA52CB91

Function 00A981E7 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00A982F4,?,00A910E3,?,00000000,?,?,00A9846D,00000021,FlsSetValue,00AA55B8,00AA55C0,?), ref: 00A982A8

Strings

api-ms-, xrefs: 00A9823E
ext-ms-, xrefs: 00A98252

Memory Dump Source

Source File: 00000000.00000002.1435998490.0000000000A91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.1435984523.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436016696.0000000000AA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AAB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436094996.0000000000AF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436112707.0000000000AF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000AFB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_RepozetorySetup.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: bd15c1ca6b79ab1076c7cc21bfd7e5e1559d712b44bf1cf149ccb4df8ad0242e
Instruction ID: 2038a5396e18e232ba3f624d7de2ee717b253aacb4b321a37d897af4c61567fc
Opcode Fuzzy Hash: bd15c1ca6b79ab1076c7cc21bfd7e5e1559d712b44bf1cf149ccb4df8ad0242e
Instruction Fuzzy Hash: 11210831B01911ABCF219BB4DD41AAA37A8AB43360F250114FA21A72C0DF78EE02C6E0

Function 00A9773F Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 42
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,78352135,?,?,00000000,00AA358C,000000FF,?,00A976CF,00A977FF,?,00A976A3,00000000), ref: 00A97774
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00A97786
FreeLibrary.KERNEL32(00000000,?,?,00000000,00AA358C,000000FF,?,00A976CF,00A977FF,?,00A976A3,00000000), ref: 00A977A8

Strings

mscoree.dll, xrefs: 00A9776D
CorExitProcess, xrefs: 00A9777E
5!5x, xrefs: 00A97754

Memory Dump Source

Source File: 00000000.00000002.1435998490.0000000000A91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.1435984523.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436016696.0000000000AA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AAB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436094996.0000000000AF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436112707.0000000000AF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000AFB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_RepozetorySetup.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: 5!5x$CorExitProcess$mscoree.dll
API String ID: 4061214504-2132634123
Opcode ID: 97b5c9addebd79248db19f6d90311d874d665432c4704327287cd7cba274300f
Instruction ID: 0367feb4d67515dfe3220c4b863dacdf412f1827c5beba89527e18b3303919a2
Opcode Fuzzy Hash: 97b5c9addebd79248db19f6d90311d874d665432c4704327287cd7cba274300f
Instruction Fuzzy Hash: 9F016731A5461AEFDB118BD4DC05BAEBBB8FB49B15F014625F822A26D0D7B49901CA50

Function 00A9D0E9 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 338
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleOutputCP.KERNEL32(78352135,00000000,00000000,?), ref: 00A9D14C

Part of subcall function 00A9B917: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00AA0409,?,00000000,-00000008), ref: 00A9B9C3

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00A9D3A7
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00A9D3EF
GetLastError.KERNEL32 ref: 00A9D492

Strings

5!5x, xrefs: 00A9D0FF

Memory Dump Source

Source File: 00000000.00000002.1435998490.0000000000A91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.1435984523.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436016696.0000000000AA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AAB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436094996.0000000000AF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436112707.0000000000AF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000AFB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_RepozetorySetup.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID: 5!5x
API String ID: 2112829910-600948960
Opcode ID: 3b10ced108f356be740d98083db9d799bdfa6123cedde38eed3203ff3f9115f8
Instruction ID: e90afd1ef306d8ae3b0cfa5eb1bb5c783dc82e311433f894b4d15e99fc8ba50b
Opcode Fuzzy Hash: 3b10ced108f356be740d98083db9d799bdfa6123cedde38eed3203ff3f9115f8
Instruction Fuzzy Hash: 34D147B5E002589FCF15CFE8D8809ADBBF5FF49300F18856AE956EB255D730A982CB50

Function 00A93571 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00A93568,00A9323C,00A9241D), ref: 00A9357F
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00A9358D
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00A935A6
SetLastError.KERNEL32(00000000,00A93568,00A9323C,00A9241D), ref: 00A935F8

Memory Dump Source

Source File: 00000000.00000002.1435998490.0000000000A91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.1435984523.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436016696.0000000000AA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AAB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436094996.0000000000AF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436112707.0000000000AF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000AFB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_RepozetorySetup.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: d26c169785318d7eca31d83c07812612edc6a1becffab0d2a34696414da9fa3f
Instruction ID: 65eb7978bd3ac67dda41425a7a06f72d25a97447c5615082badbe5bd3dc6448c
Opcode Fuzzy Hash: d26c169785318d7eca31d83c07812612edc6a1becffab0d2a34696414da9fa3f
Instruction Fuzzy Hash: 0B01BC333192166EEE2867B4BC8A67B66F4DB0A775721033DF530851F1FF914E069260

Function 00A9AE15 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\RepozetorySetup.exe, xrefs: 00A9AE31

Memory Dump Source

Source File: 00000000.00000002.1435998490.0000000000A91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.1435984523.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436016696.0000000000AA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AAB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436094996.0000000000AF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436112707.0000000000AF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000AFB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_RepozetorySetup.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\Desktop\RepozetorySetup.exe
API String ID: 0-1785955159
Opcode ID: 6b56998d7b20261c88ab9be15ea5afa54c464fe9174dc51717e12f9a4360000c
Instruction ID: 9a904774f2ac65ac4f3d096091e611fbb0cc5b69d7d375c66b74a34a914d1aff
Opcode Fuzzy Hash: 6b56998d7b20261c88ab9be15ea5afa54c464fe9174dc51717e12f9a4360000c
Instruction Fuzzy Hash: 3D21F03130022AAFCF20AFB1DD8096B77EAEF60324710851AFA14C7541DB35EC00A7E2

Function 00A91847 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00A9187A
Concurrency::cancel_current_task.LIBCPMT ref: 00A91966
std::_Xinvalid_argument.LIBCPMT ref: 00A91976

Strings

vector too long, xrefs: 00A91971

Memory Dump Source

Source File: 00000000.00000002.1435998490.0000000000A91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.1435984523.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436016696.0000000000AA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AAB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436094996.0000000000AF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436112707.0000000000AF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000AFB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_RepozetorySetup.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_taskH_prolog3_catchXinvalid_argumentstd::_
String ID: vector too long
API String ID: 4133478652-2873823879
Opcode ID: 34d46fab142d9d055fc1994ce4c0fd21a860304c62ce7caf25d6a2c97b173872
Instruction ID: d3b635bd339db8c58e3085bb2a0cac66a2552492b4bfb23182fb87253f1743bf
Opcode Fuzzy Hash: 34d46fab142d9d055fc1994ce4c0fd21a860304c62ce7caf25d6a2c97b173872
Instruction Fuzzy Hash: FF417B71B00106AFCF18DF6CC9919AEBBF5FF48350B20861DE855DB685EB31AA50CB90

Function 00A9BFEB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00A9C05D
GetStringTypeW.KERNEL32(?,00000000,00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,E8458D00), ref: 00A9C0BB
__freea.LIBCMT ref: 00A9C0CA

Part of subcall function 00A98B47: HeapAlloc.KERNEL32(00000000,?,?,?,00A92838,?,?,?,?,?,00A91051,?,?,?,00A910E3,?), ref: 00A98B79

Strings

5!5x, xrefs: 00A9BFF3

Memory Dump Source

Source File: 00000000.00000002.1435998490.0000000000A91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.1435984523.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436016696.0000000000AA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AAB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436094996.0000000000AF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436112707.0000000000AF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000AFB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_RepozetorySetup.jbxd

Yara matches

Similarity

API ID: AllocHeapStringType__alloca_probe_16__freea
String ID: 5!5x
API String ID: 324646697-600948960
Opcode ID: 671c97562f1eb8632b3edcc41415a6c224c0b8187727dabd58544ad6711afe18
Instruction ID: 2f15733c99c58b1d83c2b1267d98c235e036b695263d8a644c665291e0674793
Opcode Fuzzy Hash: 671c97562f1eb8632b3edcc41415a6c224c0b8187727dabd58544ad6711afe18
Instruction Fuzzy Hash: E831AD72B0061AEBDF219FA9DC45EAF7BE9EF49720F054128F805AB251E7358D50C7A0

Function 00A9AF12 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 00A9AF37
GetLastError.KERNEL32 ref: 00A9AF41
__dosmaperr.LIBCMT ref: 00A9AF48

Strings

5!5x, xrefs: 00A9AF1D

Memory Dump Source

Source File: 00000000.00000002.1435998490.0000000000A91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.1435984523.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436016696.0000000000AA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AAB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436094996.0000000000AF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436112707.0000000000AF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000AFB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_RepozetorySetup.jbxd

Yara matches

Similarity

API ID: ErrorFileLastModuleName__dosmaperr
String ID: 5!5x
API String ID: 4076908705-600948960
Opcode ID: 8388904fb4f4394c6878444fb833b8a195a38209239719b2d930ad4c715d9c2d
Instruction ID: 0b5df895bbb0ac422d4a4ae2f63068905b7ab4e63ee706ffc8a8c3e13672e519
Opcode Fuzzy Hash: 8388904fb4f4394c6878444fb833b8a195a38209239719b2d930ad4c715d9c2d
Instruction Fuzzy Hash: 6B115B71A0021DABCF20DFA4DD89BDE77F8AB58304F10449AA109E7241EB749A848F95

Function 00A93793 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00A93744,00000000,?,00AF74FC,?,?,?,00A938E7,00000004,InitializeCriticalSectionEx,00AA4C68,InitializeCriticalSectionEx), ref: 00A937A0
GetLastError.KERNEL32(?,00A93744,00000000,?,00AF74FC,?,?,?,00A938E7,00000004,InitializeCriticalSectionEx,00AA4C68,InitializeCriticalSectionEx,00000000,?,00A93667), ref: 00A937AA
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00A937D2

Strings

api-ms-, xrefs: 00A937B7

Memory Dump Source

Source File: 00000000.00000002.1435998490.0000000000A91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.1435984523.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436016696.0000000000AA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AAB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436094996.0000000000AF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436112707.0000000000AF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000AFB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_RepozetorySetup.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 60c8edd95149912eb9f6c86a5414f61d41c4636c3466e1939995835d753d8359
Instruction ID: 33005328316a3df8f7c906414837019cd135688dd18f03180072329044f4f0de
Opcode Fuzzy Hash: 60c8edd95149912eb9f6c86a5414f61d41c4636c3466e1939995835d753d8359
Instruction Fuzzy Hash: 92E092B1380205B6DF105BE0DE06B183FA8AB41B50F200020FA0CE48E1E7A599119541

Function 00A93CC6 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00A93D8D
___AdjustPointer.LIBCMT ref: 00A93DB0
___AdjustPointer.LIBCMT ref: 00A93E4C

Memory Dump Source

Source File: 00000000.00000002.1435998490.0000000000A91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.1435984523.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436016696.0000000000AA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AAB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436094996.0000000000AF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436112707.0000000000AF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000AFB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_RepozetorySetup.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: a2d0e3d12c5e379e634583c0d5f555062afe0c2e9e5f614dbc3c35d1f38960fd
Instruction ID: 0939e03c477397277d37e2a1542e969d09088263debe1f0d2431bc5457b50102
Opcode Fuzzy Hash: a2d0e3d12c5e379e634583c0d5f555062afe0c2e9e5f614dbc3c35d1f38960fd
Instruction Fuzzy Hash: 3051AC77701206AFDF298F55C992B6AB7F4EF44710F24492DE806872A0E731EE41CB90

Function 00A9A62B Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00A9B917: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00AA0409,?,00000000,-00000008), ref: 00A9B9C3

GetLastError.KERNEL32 ref: 00A9A68F
__dosmaperr.LIBCMT ref: 00A9A696
GetLastError.KERNEL32(?,?,?,?), ref: 00A9A6D0
__dosmaperr.LIBCMT ref: 00A9A6D7

Memory Dump Source

Source File: 00000000.00000002.1435998490.0000000000A91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.1435984523.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436016696.0000000000AA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AAB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436094996.0000000000AF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436112707.0000000000AF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000AFB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_RepozetorySetup.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 5d05326e931e93d6bbd4991eecffcd6508b8b00c0740b10a71935fa8208a6bb9
Instruction ID: 09d1a0941c4bd3b0a07dd339b27d02083114546876842067731a0c698a74dfbd
Opcode Fuzzy Hash: 5d05326e931e93d6bbd4991eecffcd6508b8b00c0740b10a71935fa8208a6bb9
Instruction Fuzzy Hash: D321D771700205AFDF20AFA2C98096BB7FDFF65364728841AFA2597151DB35EC508BD2

Function 00A9BA05 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00A9BA0D

Part of subcall function 00A9B917: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00AA0409,?,00000000,-00000008), ref: 00A9B9C3

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00A9BA45
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00A9BA65

Memory Dump Source

Source File: 00000000.00000002.1435998490.0000000000A91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.1435984523.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436016696.0000000000AA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AAB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436094996.0000000000AF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436112707.0000000000AF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000AFB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_RepozetorySetup.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: be0f7fb89eacb51d3125e8dba32c027ffe2f0eebe57c145e3f76709f58d9ffdd
Instruction ID: e805ab0b33e9412d2e5b8e89ba6835de237dc998c7bc4e0a37e66a64bbc37742
Opcode Fuzzy Hash: be0f7fb89eacb51d3125e8dba32c027ffe2f0eebe57c145e3f76709f58d9ffdd
Instruction Fuzzy Hash: BE1104F672061ABF6F11A7B5BE8AC6F69EDDE8A3D43200414F506D1101EF689E029170

Function 00AA1638 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,?,00000000,00000000,?,00AA0AED,00000000,00000001,00000000,?,?,00A9D4E6,?,00000000,00000000), ref: 00AA164F
GetLastError.KERNEL32(?,00AA0AED,00000000,00000001,00000000,?,?,00A9D4E6,?,00000000,00000000,?,?,?,00A9DA6D,?), ref: 00AA165B

Part of subcall function 00AA1621: CloseHandle.KERNEL32(FFFFFFFE,00AA166B,?,00AA0AED,00000000,00000001,00000000,?,?,00A9D4E6,?,00000000,00000000,?,?), ref: 00AA1631

___initconout.LIBCMT ref: 00AA166B

Part of subcall function 00AA15E3: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00AA1612,00AA0ADA,?,?,00A9D4E6,?,00000000,00000000,?), ref: 00AA15F6

WriteConsoleW.KERNEL32(00000000,?,?,00000000,?,00AA0AED,00000000,00000001,00000000,?,?,00A9D4E6,?,00000000,00000000,?), ref: 00AA1680

Memory Dump Source

Source File: 00000000.00000002.1435998490.0000000000A91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.1435984523.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436016696.0000000000AA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AAB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436094996.0000000000AF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436112707.0000000000AF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000AFB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_RepozetorySetup.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 559db324bfdaf90cfd70a08277090b32d594a9e3102783a323564b0582f7fa86
Instruction ID: 94b4fa3785430de00e232e7ff38652a97bc7a330df7d617e5a5586309c802cc0
Opcode Fuzzy Hash: 559db324bfdaf90cfd70a08277090b32d594a9e3102783a323564b0582f7fa86
Instruction Fuzzy Hash: C2F0303640012ABBCF226FD5DC059993F6AFB8E3A0F194110FB19861B1C736CD21AB90

Function 00A942C2 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 00A942E7

Strings

MOC, xrefs: 00A942F9
RCC, xrefs: 00A94301

Memory Dump Source

Source File: 00000000.00000002.1435998490.0000000000A91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.1435984523.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436016696.0000000000AA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AAB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436094996.0000000000AF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436112707.0000000000AF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000AFB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_RepozetorySetup.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 38ac0be6bddeda8bd6a26d9fb794b517e32c66ac5641d815caa66e9e1a18ffd7
Instruction ID: cc3e9361d1fcdefcc52c574edf0310b2a833ddd418f291ea9ec0ab4d02e9747e
Opcode Fuzzy Hash: 38ac0be6bddeda8bd6a26d9fb794b517e32c66ac5641d815caa66e9e1a18ffd7
Instruction Fuzzy Hash: 75415872A00209AFCF15DFA8C981EAEBBF5FF48304F158199F9146B221D3759A51DB50

Function 00A9D765 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,00000000,?,00000000,00A9DADC,?,00000000,00000000,?,?,00000000,00000000,?,?,?), ref: 00A9D84E
GetLastError.KERNEL32(00A9DADC,?,00000000,00000000,?,?,00000000,00000000,?,?,?,?,?,?,?,?), ref: 00A9D87E

Strings

5!5x, xrefs: 00A9D774

Memory Dump Source

Source File: 00000000.00000002.1435998490.0000000000A91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.1435984523.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436016696.0000000000AA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AAB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436094996.0000000000AF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436112707.0000000000AF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000AFB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_RepozetorySetup.jbxd

Yara matches

Similarity

API ID: ErrorFileLastWrite
String ID: 5!5x
API String ID: 442123175-600948960
Opcode ID: 2e7b0b286fcf505234b0c63fa4e20b75477b961bf5070de06586dffe3a6f230e
Instruction ID: 257f08acbf84b7549aed738ec071809bbf64f4dcfc98f6af5ab7d1ac6f743b82
Opcode Fuzzy Hash: 2e7b0b286fcf505234b0c63fa4e20b75477b961bf5070de06586dffe3a6f230e
Instruction Fuzzy Hash: FE315E71B1021AAFDF14CFA9DD81BEAB3B5EB48744F1440A9E505D7290D770AE81CB60

Function 00A9D67C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,00000000,00000000,?,?,00A9DAC7,?,00000000,00000000,?,?,00000000), ref: 00A9D726
GetLastError.KERNEL32(?,00A9DAC7,?,00000000,00000000,?,?,00000000,00000000,?,?,?,?,?,?,?), ref: 00A9D74C

Strings

5!5x, xrefs: 00A9D68B

Memory Dump Source

Source File: 00000000.00000002.1435998490.0000000000A91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.1435984523.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436016696.0000000000AA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AAB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436094996.0000000000AF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436112707.0000000000AF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000AFB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_RepozetorySetup.jbxd

Yara matches

Similarity

API ID: ErrorFileLastWrite
String ID: 5!5x
API String ID: 442123175-600948960
Opcode ID: d0c4418914cfa05927b324d60d8c6b10815992e60e2a6310651056bfdfc6f16a
Instruction ID: bb0f963a09ec30b2e99a81a4da4c755f5d93c7f691c62e5a9afb5be0886b775f
Opcode Fuzzy Hash: d0c4418914cfa05927b324d60d8c6b10815992e60e2a6310651056bfdfc6f16a
Instruction Fuzzy Hash: 6B217135B102199BCF14CF59DC809EAB3F9FF48314B1444AAE90AD7290D7309D85CA51

Function 00A9D5A1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,00000000,00000000,?,?,00A9DAEE,?,00000000,00000000,?,?,00000000), ref: 00A9D63D
GetLastError.KERNEL32(?,00A9DAEE,?,00000000,00000000,?,?,00000000,00000000,?,?,?,?,?,?,?), ref: 00A9D663

Strings

5!5x, xrefs: 00A9D5B0

Memory Dump Source

Source File: 00000000.00000002.1435998490.0000000000A91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.1435984523.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436016696.0000000000AA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AAB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436094996.0000000000AF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436112707.0000000000AF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000AFB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_RepozetorySetup.jbxd

Yara matches

Similarity

API ID: ErrorFileLastWrite
String ID: 5!5x
API String ID: 442123175-600948960
Opcode ID: a7bfa8135bccc268fb4c4a8573e64bfa43fb3be7ed9b00f0373c5ff4e6186a87
Instruction ID: a3ee116d15b07ca3a2939b6be319bdc9f9b106ea0c57e4608794dd683cd407ce
Opcode Fuzzy Hash: a7bfa8135bccc268fb4c4a8573e64bfa43fb3be7ed9b00f0373c5ff4e6186a87
Instruction Fuzzy Hash: 8B21B131B102199BCF15CF6ADD80AEDB7F9EB8D305F1440A9EA0AD7251D7309E86CB60

Function 00A91ADD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00A91DCA
___raise_securityfailure.LIBCMT ref: 00A91EB2

Strings

5!5x, xrefs: 00A91ADD, 00A91E93

Memory Dump Source

Source File: 00000000.00000002.1435998490.0000000000A91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.1435984523.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436016696.0000000000AA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AAB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436094996.0000000000AF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436112707.0000000000AF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000AFB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_RepozetorySetup.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: 5!5x
API String ID: 3761405300-600948960
Opcode ID: 6aab9feec7b764c46b2397572760bec7deebad563edf4c90f463f41cc911d7c5
Instruction ID: cfa2e27fdc08960768740336ef856a38e2a82a32a11122d8a7f78107a0f435cb
Opcode Fuzzy Hash: 6aab9feec7b764c46b2397572760bec7deebad563edf4c90f463f41cc911d7c5
Instruction Fuzzy Hash: 7421D0B46193059AEB10CFE9ED45AA87BE4FB59350F50526AF9098B3B1E3B05887CF04

Function 00A9B882 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetCommandLineA.KERNEL32 ref: 00A9B882
GetCommandLineW.KERNEL32 ref: 00A9B88D

Strings

$m, xrefs: 00A9B888

Memory Dump Source

Source File: 00000000.00000002.1435998490.0000000000A91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A90000, based on PE: true

Associated: 00000000.00000002.1435984523.0000000000A90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436016696.0000000000AA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AAB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000ADF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436031916.0000000000AEE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436094996.0000000000AF6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436112707.0000000000AF8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000AFB000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1436131966.0000000000B82000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a90000_RepozetorySetup.jbxd

Yara matches

Similarity

API ID: CommandLine
String ID: $m
API String ID: 3253501508-651847903
Opcode ID: e2d7450c2d18745535f6e6ed4aded35a7b721f4d44bdf4108176b367f619700e
Instruction ID: 2927d3cd7e7c3ce9c19b938aaac0f90616c77a5c7b25e1ad18cbe193c9c5e8c7
Opcode Fuzzy Hash: e2d7450c2d18745535f6e6ed4aded35a7b721f4d44bdf4108176b367f619700e
Instruction Fuzzy Hash: 8EB04878808282CB8700CFE0BC0C1183BA0B28A2023804056E906832A4D7780016EF10

Analysis Process: MSBuild.exePID: 7548, Parent PID: 7496COMMON

Execution Graph

Execution Coverage:	7.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	32
Total number of Limit Nodes:	3

Executed Functions

Function 0538AE30 Relevance: 1.7, APIs: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0538B086

Memory Dump Source

Source File: 00000002.00000002.1484828834.0000000005380000.00000040.00000800.00020000.00000000.sdmp, Offset: 05380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5380000_MSBuild.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: d069713dcdc0bae8fd0988d253a4bd9b3cbc2c3696ed78c736684e4eb102fef3
Instruction ID: c5088baae891fe04eb53d1969b98803ef8e9d14a850a0d3d22b07d07767ebdbe
Opcode Fuzzy Hash: d069713dcdc0bae8fd0988d253a4bd9b3cbc2c3696ed78c736684e4eb102fef3
Instruction Fuzzy Hash: 76713AB0A00B058FD728EF69D45476ABBF1FF88314F00892ED44AD7A40D775E849CBA1

Function 05384248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 053859F1

Memory Dump Source

Source File: 00000002.00000002.1484828834.0000000005380000.00000040.00000800.00020000.00000000.sdmp, Offset: 05380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5380000_MSBuild.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: ccd10b8a70cf5946f943030d4c4e546049d8fb77541c1d8b999e6aa13caff3eb
Instruction ID: 20f58a459846e2213c9f93a1875199091b2caef967e8e016c1c15ebb24b7fac9
Opcode Fuzzy Hash: ccd10b8a70cf5946f943030d4c4e546049d8fb77541c1d8b999e6aa13caff3eb
Instruction Fuzzy Hash: 6E41B270C04728DBDB24DFA9C884B9DBBF5FF49314F60806AD418AB251DBB56945CF90

Function 05385935 Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 053859F1

Memory Dump Source

Source File: 00000002.00000002.1484828834.0000000005380000.00000040.00000800.00020000.00000000.sdmp, Offset: 05380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5380000_MSBuild.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 246587c3c00296d10c668ea3176a2c8c3a6da9b7d4d3a7fb9ebe7490e5800f35
Instruction ID: a6926713c0a6409a48c7864a3f90e8f26d4bee32fc9dd4da9f3d9c5310057f04
Opcode Fuzzy Hash: 246587c3c00296d10c668ea3176a2c8c3a6da9b7d4d3a7fb9ebe7490e5800f35
Instruction Fuzzy Hash: B441CEB0C00728CBDB24DFA9C884BDEBBF5BF49304F60806AD418AB251DBB56945CF50

Function 0538C9A0 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0538D2C6,?,?,?,?,?), ref: 0538D387

Memory Dump Source

Source File: 00000002.00000002.1484828834.0000000005380000.00000040.00000800.00020000.00000000.sdmp, Offset: 05380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5380000_MSBuild.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 30c5cbc5d1cacfcb51331e4b4cf81419a3ecf4e485f5b730b0c8cfa291a9e769
Instruction ID: 0e626630977eb2942027773a0d242b28344a6e5054ebcd646afdd8885cfc73d4
Opcode Fuzzy Hash: 30c5cbc5d1cacfcb51331e4b4cf81419a3ecf4e485f5b730b0c8cfa291a9e769
Instruction Fuzzy Hash: 3021E5B5900308AFDB10CF9AD484AEEBBF4FB48310F14842AE958A7351D374A954CFA5

Function 0538D2F9 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0538D2C6,?,?,?,?,?), ref: 0538D387

Memory Dump Source

Source File: 00000002.00000002.1484828834.0000000005380000.00000040.00000800.00020000.00000000.sdmp, Offset: 05380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5380000_MSBuild.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 61a4bb4815b35c83b159dab32fd5fc8f57dcac69d0e2e835eca8e5f7529e484d
Instruction ID: 346b658332d343eacfe9fafe8f6301cbac8a50d15759618362e51bc3f9472aa3
Opcode Fuzzy Hash: 61a4bb4815b35c83b159dab32fd5fc8f57dcac69d0e2e835eca8e5f7529e484d
Instruction Fuzzy Hash: 2B21E0B5D00208AFDB10CFAAD984AEEBBF4FB48314F14842AE958A3250C374A955CF65

Function 0538B020 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0538B086

Memory Dump Source

Source File: 00000002.00000002.1484828834.0000000005380000.00000040.00000800.00020000.00000000.sdmp, Offset: 05380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5380000_MSBuild.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 9804b13634aab08e9d5fb3b3a390cf98e806d786467dcf3eef930267d314a315
Instruction ID: cbe142ff6f17aeec6676ae5ec9575aa14634cfee79e2b38ab6a8d21795597b1b
Opcode Fuzzy Hash: 9804b13634aab08e9d5fb3b3a390cf98e806d786467dcf3eef930267d314a315
Instruction Fuzzy Hash: 81110FB5C007498FCB24DF9AC444BEEFBF4AF89210F10842AD869B7210C375A549CFA1

Function 012DD774 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1477704720.00000000012DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12dd000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6158ca1f4fec80385594f54d8dbda5ff4b128a828d6730a677933ec93c8eaa96
Instruction ID: b843232b4d6c8416e4434f1a8b7df2a25d3f801f14bea459da3951cdea5ee0d7
Opcode Fuzzy Hash: 6158ca1f4fec80385594f54d8dbda5ff4b128a828d6730a677933ec93c8eaa96
Instruction Fuzzy Hash: 77213871514644DFDB06DF94D8C1B26BF65FB88314F20C6A9E90D4A286C376D416CBA1

Function 012DD4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1477704720.00000000012DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12dd000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a33c5e15379821ba9e740c9369cfffa493750f383d636c712f206ddac1727667
Instruction ID: c7a8ff3360b3cd458dbb3273bc4e4b9a461bb86a09da71a7ee870bc05682d056
Opcode Fuzzy Hash: a33c5e15379821ba9e740c9369cfffa493750f383d636c712f206ddac1727667
Instruction Fuzzy Hash: A3217571514608DFDB01DF94E8C0B26BF61FB88318F20C168E9090B286C336D416CBA2

Function 012DD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1477704720.00000000012DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12dd000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47c12d692891eff4227f933eedee65b742354b36d71ef9b2188af3da3d9c3de5
Instruction ID: a8e9437fd36879e3fafb82fb1ab43fc7e096e3a2e3f0caaf6fe4fd892fbbe218
Opcode Fuzzy Hash: 47c12d692891eff4227f933eedee65b742354b36d71ef9b2188af3da3d9c3de5
Instruction Fuzzy Hash: E62175B1114608DFDB01DF84C8C0B66BF65FB88324F20C16CE9090B286C336E456CBA2

Function 012ED01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1477809039.00000000012ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 012ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12ed000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82894478c4d25261f5c12619d9e8a2ba11bd9f74426d39c95f0a571c65b44ca2
Instruction ID: 19dc6ed40284083ff21343e07ee1898d2f97c1cf13eadd823f6e51752480b2e2
Opcode Fuzzy Hash: 82894478c4d25261f5c12619d9e8a2ba11bd9f74426d39c95f0a571c65b44ca2
Instruction Fuzzy Hash: A7212271614308DFDB15DFA4D888B26BFA1FB88314F68C56DD90A0B242C377D447CA62

Function 012DD76F Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1477704720.00000000012DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12dd000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49866488e89149112245f6844e55d9191df11bdf06b21b46701935618eba3e4f
Instruction ID: 63133a94c4f1c8ea271d922b1bd26ec5ac79e964ceaa73feb8519bdb17df3b4f
Opcode Fuzzy Hash: 49866488e89149112245f6844e55d9191df11bdf06b21b46701935618eba3e4f
Instruction Fuzzy Hash: BA21DF72404684DFCB16CF54D9C5B16BF72FB88314F24C2A9DA494B257C33AD426CB91

Function 012DD4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1477704720.00000000012DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12dd000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a9223d17f0c59b9928f2445ae754a3689dedab5288f4c6dbc5edc2f4224d076
Instruction ID: 0ad75eb10ffd3f1ad9f5a7c68f2c3a06ea7cb45f8b88ffaabe32e3be5a3b2310
Opcode Fuzzy Hash: 8a9223d17f0c59b9928f2445ae754a3689dedab5288f4c6dbc5edc2f4224d076
Instruction Fuzzy Hash: 40112676404684CFCB12CF54D5C4B16BF71FB84318F24C6A9D9490B657C336D45ACBA1

Function 012DD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1477704720.00000000012DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12dd000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a9223d17f0c59b9928f2445ae754a3689dedab5288f4c6dbc5edc2f4224d076
Instruction ID: e8ac89655a7676f5d42b22edd96fd45116e23f37ad99fb3bc293f19f3c2b1283
Opcode Fuzzy Hash: 8a9223d17f0c59b9928f2445ae754a3689dedab5288f4c6dbc5edc2f4224d076
Instruction Fuzzy Hash: F5112676404684DFCB12CF44D5C4B56BF71FB84324F24C2A9D9090B657C33AE45ACBA1

Function 012ED017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1477809039.00000000012ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 012ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_12ed000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04b342587f02f4df216fd9fa4589941a60fabf0b5787ec5e4e812599987ae7f8
Instruction ID: 347fbee5807e0ff31092d9060bb99a95a2b7a9443e39d4c504539dddc28e5cfa
Opcode Fuzzy Hash: 04b342587f02f4df216fd9fa4589941a60fabf0b5787ec5e4e812599987ae7f8
Instruction Fuzzy Hash: ED11BB75504284CFCB12CF54D5C8B15BFA2FB84314F28C6AAD9494B656C33AD44ACBA2

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
185.196.9.26	tsle.exe	Get hash	malicious	RedLine	Browse
	#U0415Sh#U0430rk.exe	Get hash	malicious	RedLine	Browse
	GX9zyKVNXR.exe	Get hash	malicious	RedLine	Browse
	Lys2hJAvd1.exe	Get hash	malicious	RedLine	Browse
	JfvFiUr0DO.exe	Get hash	malicious	RedLine	Browse
	gLKtR4HuEw.exe	Get hash	malicious	RedLine	Browse
	injector V2.5.exe	Get hash	malicious	RedLine	Browse
	Jeverly.exe	Get hash	malicious	RedLine	Browse
	by_execute.exe	Get hash	malicious	RedLine	Browse
	Shark#U041ePShC.exe	Get hash	malicious	RedLine	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	9160074916_Payoff_Statement.html	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.246.45
	https://www.guidedtrack.com/programs/53o12sc/run	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://specialpoint.net/	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://get-file303.b-cdn.net/fan.zip	Get hash	malicious	Unknown	Browse	13.107.246.45
	207632331568373362.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	393114579175167727.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	https://url.avanan.click/v2/r01/___https://drickly-com-dot-fluid-dreamer-410607.uc.r.appspot.com/?h=66LVKOwLflbMjYVoJBNTrXiW3CEpoRg_EafL_ygpoXil&fru;v=755/8c88~9&fru;w=6c5ghgij98cg/ffg&fru;E=6a766/89b55~9&fru;t=myyue8Fe7Ke7KBBB.lttlqj.htr.xle7Kzwqe8Kxfe8Iye7~jxwhe8I3ZR/bSIze7~xtzwhje8Ie7~whye8I859Oe7~e7~hie8I7/~Ize7~zfhye7~zwqe8Ifrue7Kxe7KfwrxywtslxyjjqBtwp.htrd.fnlzD___.YXAzOnNvdXRoZXJua2l0Y2hlbmFuZGdyaWxsOmE6bzo3NDhmM2FkMWRiOWU2YTNlMjE1YzgwMzRjMTliODRkZDo3OmNmNmI6NjYyMTE5OWZiNzU5MjU0NTE1ZjgzODM0ZWRlYjRmZDIwOWJmNTQ3YWUwY2MxNmU5NjFiZmExYjYzM2U0YzA0MzpoOlQ6VA#YmJyYWNleUBwcmVzaWRpby5jb20=	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://www.guidedtrack.com/programs/i6rkt1s/run	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	FyDJiRAGnj.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	4ui8luUSNp.exe	Get hash	malicious	Coinhive, Xmrig	Browse	13.107.246.45

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SIMPLECARRIERCH	NOXGUARD AUS 40 UREA__912001_NOR_EN - MSDS.exe	Get hash	malicious	Unknown	Browse	185.196.10.234
	tsle.exe	Get hash	malicious	RedLine	Browse	185.196.9.26
	dG2gzbQyzZ.exe	Get hash	malicious	Unknown	Browse	185.196.10.98
	dG2gzbQyzZ.exe	Get hash	malicious	Unknown	Browse	185.196.10.98
	http://learnthelanguage.nl/?wptouch_switch=desktop&redirect=http://basinindustriesinc.com	Get hash	malicious	HTMLPhisher	Browse	185.196.10.27
	http://learnthelanguage.nl/?wptouch_switch=desktop&redirect=http://basinindustriesinc.com	Get hash	malicious	HTMLPhisher	Browse	185.196.10.27
	#U0415Sh#U0430rk.exe	Get hash	malicious	RedLine	Browse	185.196.9.26
	fBcMVl6ns6.lnk	Get hash	malicious	RHADAMANTHYS	Browse	185.196.9.174
	rpQF1aDIK4.lnk	Get hash	malicious	RHADAMANTHYS	Browse	185.196.9.174
	test.ps1	Get hash	malicious	RHADAMANTHYS	Browse	185.196.9.174

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	Your Encrypted Message Exchange Activation Information.html	Get hash	malicious	Unknown	Browse	13.107.246.45
	http://169.1.16.29/demon.x64.exe	Get hash	malicious	Havoc	Browse	13.107.246.45
	https://q7bmw.com/	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://asiansantai.com/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	http://205.210.31.122	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://r20.rs6.net/tn.jsp?t=ujqgb8abb.0.0.zumspjcab.0&id=preview&r=3&p=http%3A%2F%2Ffiles.constantcontact.com%2F99239f29001%2F765a22db-b453-4315-a344-dc2294500069.pdf	Get hash	malicious	Unknown	Browse	13.107.246.45
	9160074916_Payoff_Statement.html	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.246.45
	https://103.161.71.201/ipc$	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://www.guidedtrack.com/programs/53o12sc/run	Get hash	malicious	Unknown	Browse	13.107.246.45
	bharper@we-worldwide.com.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	2.947188690635946
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	RepozetorySetup.exe
File size:	1'532'968 bytes
MD5:	c731ce4e3a8ab780ed4cb4e29cca10fc
SHA1:	f1d5b853b1e74449729ae1080e1857da3da47747
SHA256:	28a5d9eb092fbde1f785336ac2a8a858ad85129ee3c0b6eb6c6fac919dc77878
SHA512:	6285cad2faf310b58c5e59a553ffbaac68fd1921244dbf17d5cbbb4c10f132adb8d1efdf5ee8e6dd026bc5f46e404b729cb2a75b6ea3ae75359bf2f46c5ac5e8
SSDEEP:	12288:ae+x1TkR0UHV0PlYZWwdsvCU4hkxtRS83rEO:ix1TvUSZoiCFkHRzbt
TLSH:	DF6502057AC0C572C6E26A311864DB22A77DFC301F609D5B33955A7A2F703D28B2AD7B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=...=...=.1.>...=.1.8.o.=.1.9...=..Z>...=..Z9...=.1.<...=...<...=..Z8...=..[4...=..[....=..[?...=.Rich..=................

Entrypoint:	0x401d8d
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x67107D19 [Thu Oct 17 02:57:29 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	c68e3728e5b31346dadca5959fef3f1a

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	13/01/2023 00:00:00 16/01/2026 23:59:59
Subject Chain	CN=NVIDIA Corporation, OU=2-J, O=NVIDIA Corporation, L=Santa Clara, S=California, C=US
Version:	3
Thumbprint MD5:	5F1B6B6C408DB2B4D60BAA489E9A0E5A
Thumbprint SHA-1:	15F760D82C79D22446CC7D4806540BF632B1E104
Thumbprint SHA-256:	28AF76241322F210DA473D9569EFF6F27124C4CA9F43933DA547E8D068B0A95D
Serial:	0997C56CAA59055394D9A9CDB8BEEB56

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1a678	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x68000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x173e00	0x2628	.BSS
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x69000	0x10b4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x19958	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x19898	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x14000	0x108	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x125f0	0x12600	757c6c7d5a4d36a63de76047b9ce1bd0	False	0.6141847363945578	COM executable for DOS	6.654320378827071	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x14000	0x6c64	0x6e00	4d0ed716a67763f2485254189309e646	False	0.4675426136363636	data	5.087659650596345	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1b000	0x4cbb4	0x4c200	cde9583f125ccc1d9185982cd9025609	False	0.9936242816091954	data	7.994065146039034	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x68000	0x1e0	0x200	721c51b513442ebcdea9461ecc09a5eb	False	0.52734375	data	4.7122981932940915	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x69000	0x10b4	0x1200	e0b3bd389f660d37f6b6de3d01d2af8d	False	0.7315538194444444	data	6.288327801243427	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.BSS	0x6b000	0x86470	0x86600	0a977edf0c27774362aae9f009890db9	False	0.001451671511627907	data	0.006554279714957566	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.BSS	0xf2000	0x86470	0x86600	1960f978a0a2aa438ad7f458c8012afe	False	0.0014734738372093024	data	0.006712021752155021	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report RepozetorySetup.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_RepozetorySetup._dbae9c7c1666e638f7cace34c3620537866cb47_6b7089c6_0bf54268-0f17-418d-853d-4b7cde7816bb\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4BE1.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4C30.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4E64.tmp.xml

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MSBuild.exe.log

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Windows Analysis Report
RepozetorySetup.exe

Function 00A91659 Relevance: 1.6, APIs: 1, Instructions: 104
memoryCOMMON

Function 00AA0264 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 202
COMMON

Function 00A9B591 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 177
COMMON

Function 00A9B195 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 147
COMMON

Function 00A984DE Relevance: 3.0, APIs: 2, Instructions: 34
COMMON

Function 00A92EC0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 120
COMMON

Function 00A93F1D Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 303
COMMONLIBRARYCODE

Function 00A981E7 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Function 00A9773F Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 42
libraryloaderCOMMONLIBRARYCODE

Function 00A9D0E9 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 338
fileCOMMONLIBRARYCODE

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre