Edit tour

Windows Analysis Report
SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe
Analysis ID:	1528525
MD5:	802faf03a51fcc731a15541960379d60
SHA1:	65a9594a5acf6c54c7ec1513351c386aa65c9819
SHA256:	fde872c02c049b7b02d8dfa2d694fba47b8d300001c6cf0ec83f11634a7256dd
Tags:	exe
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for sample

Sigma detected: Silenttrinity Stager Msbuild Activity

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

One or more processes crash

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe (PID: 7452 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe" MD5: 802FAF03A51FCC731A15541960379D60)

MSBuild.exe (PID: 7536 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

MSBuild.exe (PID: 7544 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

WerFault.exe (PID: 8148 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7544 -s 1260 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 7692 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7452 -s 280 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://46.8.231.109/c4754d4f680ead72.php", "Botnet": "default"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.1778918680.00000000012E7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000003.00000002.1778401976.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000003.00000002.1778401976.000000000049A000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe PID: 7452	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: MSBuild.exe PID: 7544	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: MSBuild.exe PID: 7544	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe.eedad8.1.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
3.2.MSBuild.exe.400000.1.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
3.2.MSBuild.exe.400000.1.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe.eedad8.1.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe.ec0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Sigma Signatures

System Summary

Sigma detected: Silenttrinity Stager Msbuild Activity

Source: Network Connection

Author: Kiran kumar s, oscd.community: Data: DestinationIp: 46.8.231.109, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 7544, Protocol: tcp, SourceIp: 192.168.2.11, SourceIsIpv6: false, SourcePort: 49713

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://46.8.231.109/c4754d4f680ead72.php	URL Reputation: Label: malware
Source: http://46.8.231.109	URL Reputation: Label: malware
Source: http://46.8.231.109/	URL Reputation: Label: malware

Found malware configuration

Source: 3.2.MSBuild.exe.400000.1.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://46.8.231.109/c4754d4f680ead72.php", "Botnet": "default"}

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe

ReversingLabs: Detection: 34%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe

Joe Sandbox ML: detected

Source: SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.11:49702 version: TLS 1.2

Source: SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe

Code function: 0_2_00ED9ABF FindFirstFileExW,

0_2_00ED9ABF

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://46.8.231.109/c4754d4f680ead72.php

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 46.8.231.109Connection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View

IP Address: 46.8.231.109 46.8.231.109

Source: Joe Sandbox View

ASN Name: FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.42
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.3
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.3
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.3
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.42
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.3
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.42
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.3
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 46.8.231.109Connection: Keep-AliveCache-Control: no-cache

Source: MSBuild.exe, 00000003.00000002.1778918680.00000000012E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109
Source: MSBuild.exe, 00000003.00000002.1778918680.00000000012E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109(x
Source: MSBuild.exe, 00000003.00000002.1778918680.000000000132E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/
Source: MSBuild.exe, 00000003.00000002.1778918680.000000000132E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1
Source: MSBuild.exe, 00000003.00000002.1778918680.00000000012E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/RPC
Source: MSBuild.exe, 00000003.00000002.1778918680.00000000012E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/j
Source: MSBuild.exe, 00000003.00000002.1778918680.000000000132E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/o
Source: Amcache.hve.7.dr	String found in binary or memory: http://upx.sf.net

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443

Source: unknown

HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.11:49702 version: TLS 1.2

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Code function: 0_2_00EC2021	0_2_00EC2021
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Code function: 0_2_00EC729C	0_2_00EC729C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Code function: 0_2_00EDD39B	0_2_00EDD39B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Code function: 0_2_00ED572C	0_2_00ED572C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Code function: 0_2_00ECCAF2	0_2_00ECCAF2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Code function: 0_2_00EDBB36	0_2_00EDBB36
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Code function: 0_2_00ED3C92	0_2_00ED3C92
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Code function: 0_2_00EC1D79	0_2_00EC1D79
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Code function: 0_2_00ECFEF0	0_2_00ECFEF0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Code function: String function: 00EC7B80 appears 49 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 004045C0 appears 317 times

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7452 -s 280

Source: SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe, 00000000.00000002.1460667321.0000000000F3C000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameproquota.exej% vs SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe
Source: SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Binary or memory string: OriginalFilenameproquota.exej% vs SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe

Source: SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe

Static PE information: Section: .data ZLIB complexity 0.98989375

Source: classification engine

Classification label: mal100.troj.evad.winEXE@7/9@0/1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 3_2_00418680 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

3_2_00418680

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7452
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7544

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\beb088b0-b2cf-49fe-88ea-d71c0d8185fe

Jump to behavior

Source: SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe

ReversingLabs: Detection: 34%

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7452 -s 280
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7544 -s 1260
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 3_2_0041C03D LoadLibraryW,GetProcAddress,GetProcAddress,EncodePointer,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

3_2_0041C03D

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Code function: 0_2_00EC71AD push ecx; ret	0_2_00EC71C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Code function: 0_2_00F07F0D push ecx; ret	0_2_00F07F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0041B035 push ecx; ret	3_2_0041B048

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe

API coverage: 4.2 %

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe

Code function: 0_2_00ED9ABF FindFirstFileExW,

0_2_00ED9ABF

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 3_2_00401160 GetSystemInfo,

3_2_00401160

Source: Amcache.hve.7.dr	Binary or memory string: VMware
Source: Amcache.hve.7.dr	Binary or memory string: VMware-42 27 b7 a3 1e b0 86 f3-0a fe 06 07 d0 80 07 92
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.7.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.7.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.7.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.7.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.7.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: MSBuild.exe, 00000003.00000002.1778918680.00000000012E7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.1778918680.0000000001342000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.7.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.7.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.7.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.7.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.7.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.7.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.7.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.7.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: MSBuild.exe, 00000003.00000002.1778918680.00000000012E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Amcache.hve.7.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.7.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.7.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.7.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.7.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.7.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.7.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe

Code function: 0_2_00EC7922 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00EC7922

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 3_2_004045C0 VirtualProtect ?,00000004,00000100,00000000

3_2_004045C0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

3_2_0041C03D

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Code function: 0_2_00EC2003 mov edi, dword ptr fs:[00000030h]	0_2_00EC2003
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Code function: 0_2_00EDA64C mov eax, dword ptr fs:[00000030h]	0_2_00EDA64C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Code function: 0_2_00F06628 mov eax, dword ptr fs:[00000030h]	0_2_00F06628
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Code function: 0_2_00ED0F2E mov ecx, dword ptr fs:[00000030h]	0_2_00ED0F2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00419750 mov eax, dword ptr fs:[00000030h]	3_2_00419750

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe

Code function: 0_2_00EDCC4B GetProcessHeap,

0_2_00EDCC4B

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Code function: 0_2_00EC7610 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00EC7610
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Code function: 0_2_00EC7922 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00EC7922
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Code function: 0_2_00EC7AAF SetUnhandledExceptionFilter,	0_2_00EC7AAF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Code function: 0_2_00ECDA73 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00ECDA73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0041AD48 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_0041AD48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0041CEEA SetUnhandledExceptionFilter,	3_2_0041CEEA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0041B33A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_0041B33A

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe PID: 7452, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7544, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 41E000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 42B000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 65C000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: EC8008	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00EDC085
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Code function: GetLocaleInfoW,	0_2_00ED622B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Code function: EnumSystemLocalesW,	0_2_00EDC372
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Code function: EnumSystemLocalesW,	0_2_00EDC327
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00EDC498
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Code function: EnumSystemLocalesW,	0_2_00EDC40D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Code function: GetLocaleInfoW,	0_2_00EDC6EB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00EDC814
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00EDC9E9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Code function: GetLocaleInfoW,	0_2_00EDC91A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Code function: EnumSystemLocalesW,	0_2_00ED5D7F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetLocaleInfoA,	3_2_00417B90

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe

Code function: 0_2_00EC7815 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00EC7815

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 3_2_00417850 GetUserNameA,

3_2_00417850

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 3_2_00417A30 GetTimeZoneInformation,

3_2_00417A30

Source: Amcache.hve.7.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe.eedad8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.MSBuild.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.MSBuild.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe.eedad8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe.ec0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.1778918680.00000000012E7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1778401976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1778401976.000000000049A000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7544, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe.eedad8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.MSBuild.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.MSBuild.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe.eedad8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe.ec0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.1778918680.00000000012E7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1778401976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1778401976.000000000049A000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7544, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	311 Process Injection	1 Virtualization/Sandbox Evasion	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Disable or Modify Tools	LSASS Memory	41 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	311 Process Injection	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	33 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	34%	ReversingLabs	Win32.Trojan.Generic
SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	100%	Avira	HEUR/AGEN.1310458
SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://upx.sf.net	0%	URL Reputation	safe
http://46.8.231.109/c4754d4f680ead72.php	100%	URL Reputation	malware
http://46.8.231.109	100%	URL Reputation	malware
http://46.8.231.109/	100%	URL Reputation	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://46.8.231.109/c4754d4f680ead72.php	true	URL Reputation: malware	unknown
http://46.8.231.109/	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://46.8.231.109/j	MSBuild.exe, 00000003.00000002.1778918680.00000000012E7000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://upx.sf.net	Amcache.hve.7.dr	false	URL Reputation: safe	unknown
http://46.8.231.109/RPC	MSBuild.exe, 00000003.00000002.1778918680.00000000012E7000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://46.8.231.109(x	MSBuild.exe, 00000003.00000002.1778918680.00000000012E7000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://46.8.231.109/o	MSBuild.exe, 00000003.00000002.1778918680.000000000132E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://46.8.231.109/1	MSBuild.exe, 00000003.00000002.1778918680.000000000132E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://46.8.231.109	MSBuild.exe, 00000003.00000002.1778918680.00000000012E7000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
46.8.231.109	unknown	Russian Federation		28917	FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528525
Start date and time:	2024-10-08 00:40:33 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@7/9@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 31 Number of non-executed functions: 70
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 40.126.32.72, 20.190.160.20, 40.126.32.68, 20.190.160.22, 40.126.32.133, 20.190.160.14, 40.126.32.140, 40.126.32.76, 93.184.221.240, 13.89.179.12, 20.109.210.53, 20.3.187.198, 20.12.23.50, 52.165.164.15, 20.42.65.92, 4.175.87.197
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.afd.azureedge.net, onedsblobprdcus17.centralus.cloudapp.azure.com, wu.azureedge.net, login.live.com, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, glb.cws.prod.dcat.dsp.trafficmanager.net, hlb.apr-52dd2-0.edgecastdns.net, sls.update.microsoft.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, prdv4a.aadg.msidentity.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, www.tm.v4.a.prd.aadg.akadns.net, wu.ec.azureedge.net, ctldl.windowsupdate.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, onedsblobprdeus17.eastus.cloudapp.azure.com, blobcollector.events.data.trafficmanager.net, azureedge-t-prod.trafficmanager.net, umwatson.events.data.microsoft.com, www.tm.lg.prod.aadmsa.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe

Simulations

Behavior and APIs

Time	Type	Description
18:41:43	API Interceptor	2x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
46.8.231.109	lihZ6gUU7V.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	FdjDPFGTZS.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	45Ywq5ad5H.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	NdSXVNeoET.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	fe6yqly1Xh.exe	Get hash	malicious	Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	CR0QGWXdDl.exe	Get hash	malicious	Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	E7Bu6a7eve.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	f2e7fcb20146.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	bCnarg2O62.exe	Get hash	malicious	SmokeLoader	Browse	13.107.246.45
	9Y6R8fs0wd.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	PFW1cgN8EK.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	https://url.avanan.click/v2/r01/___https://www.tiktok.com/qnspdA7?fni=6cbb&qfsl=js&xhjsj=gnt_zwq&yfwljy=myyux:ddBBB.lttlqj.ht.zpdzwq?v=frudxdBjlfmjfqymhfwj.ht.pjd.kwjsy___.YXAzOnNvdXRoZXJua2l0Y2hlbmFuZGdyaWxsOmE6bzpiNGZlZGFhNjcxOTBhYjU4MTE5MjBlZTRiYTAxZmUwMTo3OmIxYWM6MDg1ODNlNjljZDkwNThkM2ZiM2RjYTI4MzFjZGY4NGFmMTYyZTlhYmVjYWYxY2Q4MmNkZDhiNmFmOWVkOWUxOTpoOlQ6VA#Sm9hbi5LbmlwcGVuQEVsa2F5LkNvbQ==	Get hash	malicious	Unknown	Browse	13.107.246.45
	SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	https://login.stmarytx.edu/cas/logout?service=http%3A%2F%2Fgoogle.com%2Famp%2Fmatrikaengineeringworks.com/hebc/?#?m=bWVsaXNzYWdAd2Utd29ybGR3aWRlLmNvbQ==	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://dsdhie.org/dsjhem	Get hash	malicious	Unknown	Browse	13.107.246.45
	SecuriteInfo.com.Win32.PWSX-gen.19404.14810.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	+18365366724753456-83736-10244688.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	https://s.craft.me/yB5midhwwaHUPW	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics	lihZ6gUU7V.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	FdjDPFGTZS.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	45Ywq5ad5H.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	NdSXVNeoET.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	46.8.231.109
	fe6yqly1Xh.exe	Get hash	malicious	Stealc, Vidar	Browse	46.8.231.109
	CR0QGWXdDl.exe	Get hash	malicious	Stealc, Vidar	Browse	46.8.231.109
	E7Bu6a7eve.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	f2e7fcb20146.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	http://hans.uniformeslaamistad.com/prog/66f5db9e54794_vfkagks.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	9Y6R8fs0wd.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	http://xdr.euw31usea1-carbonhelixbytedandomaincontrolpanele-for-github.sentinelone.net/	Get hash	malicious	Unknown	Browse	13.107.246.45
	file.exe	Get hash	malicious	Credential Flusher	Browse	13.107.246.45
	RemittanceDetails(Rjackson)CQDM.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	PFW1cgN8EK.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	https://url.avanan.click/v2/r01/___https://www.tiktok.com/qnspdA7?fni=6cbb&qfsl=js&xhjsj=gnt_zwq&yfwljy=myyux:ddBBB.lttlqj.ht.zpdzwq?v=frudxdBjlfmjfqymhfwj.ht.pjd.kwjsy___.YXAzOnNvdXRoZXJua2l0Y2hlbmFuZGdyaWxsOmE6bzpiNGZlZGFhNjcxOTBhYjU4MTE5MjBlZTRiYTAxZmUwMTo3OmIxYWM6MDg1ODNlNjljZDkwNThkM2ZiM2RjYTI4MzFjZGY4NGFmMTYyZTlhYmVjYWYxY2Q4MmNkZDhiNmFmOWVkOWUxOTpoOlQ6VA#Sm9hbi5LbmlwcGVuQEVsa2F5LkNvbQ==	Get hash	malicious	Unknown	Browse	13.107.246.45
	SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	utmggBCMML.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	lihZ6gUU7V.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	13.107.246.45

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MSBuild.exe_faac6578d9eb4145cf24c623c8a7076a595e99_473dd2bc_52b31ccd-8eba-4a37-807f-7573b8398155\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9521786274529658
Encrypted:	false
SSDEEP:	192:UEQzMNRcOFfE0BU/gju0ZrVZazuiF7Z24IO8q:HJFf/BU/gjPEzuiF7Y4IO8q
MD5:	B0CCD977843DDAFB5B6869F3AEB76A0A
SHA1:	1CCA8A90CC2117869620450EB8142C60111FD4BB
SHA-256:	34BD769FA41087EAEEFF06CC72B5755D35639E3B7BFD1A37C1291767095E9AF8
SHA-512:	E03506060BC34285C598A090C74ABBA330EC2A38C4BC80A987614ACC88BFE148BFC137450057E386E04A02873A35E621FADA922995604B13C12696E783D0D78C
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.8.1.4.5.3.2.9.1.7.3.3.1.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.8.1.4.5.3.3.8.3.9.2.0.9.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.2.b.3.1.c.c.d.-.8.e.b.a.-.4.a.3.7.-.8.0.7.f.-.7.5.7.3.b.8.3.9.8.1.5.5.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.6.3.4.a.6.2.7.-.1.c.9.0.-.4.8.4.5.-.a.a.e.2.-.1.7.6.f.9.d.2.6.1.a.e.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.S.B.u.i.l.d...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.M.S.B.u.i.l.d...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.7.8.-.0.0.0.1.-.0.0.1.3.-.8.5.6.7.-.3.b.0.c.0.a.1.9.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.e.6.2.5.6.a.0.1.5.9.6.8.8.f.0.5.6.0.b.0.1.5.d.a.4.d.9.6.7.f.4.1.c.b.f.8.c.9.b.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_ae274dd2d8e175c4221032451d263566c21c18b0_6b0bd2f1_d1b59c26-6c33-478e-ad15-96ff249114f2\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7016660515842292
Encrypted:	false
SSDEEP:	96:U13eFi2mU0z52sGyo8ANf5QXIDcQvc6QcEVcw3cE/X+HbHg/5hZAX/d5FMT2SlPy:U1ePLU2I0BU/wjhzuiF7Z24IO8+
MD5:	E7AA37B471EEE9AEB345A22FDFF7C114
SHA1:	9DF8B370F8776F87FB6E02FC82111891B791CCB2
SHA-256:	998F1427EDE0E1062873219E3EF2F1AF82A8D839ACB488190D31CEDC61A5EADA
SHA-512:	24BDAC4D6B90C7F611E07C0CD74B323D9665A19A5BC0044CD0479DBB3A41928FDC7F7F0FEC6F01F84F93BAFE902F587D3EE4FD1A1D0A9C1DE719D1DF9901C741
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.8.1.4.4.8.8.7.1.5.0.3.4.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.8.1.4.4.8.9.1.3.6.9.1.3.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.1.b.5.9.c.2.6.-.6.c.3.3.-.4.7.8.e.-.a.d.1.5.-.9.6.f.f.2.4.9.1.1.4.f.2.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.a.b.b.a.f.f.9.-.1.8.2.f.-.4.a.e.a.-.b.e.6.a.-.7.e.a.1.4.5.9.7.b.1.c.e.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.S.e.c.u.r.i.t.e.I.n.f.o...c.o.m...T.r.o.j.a.n...D.o.w.n.L.o.a.d.e.r.4.7...4.3.3.4.0...1.2.5.7.6...1.3.1.6...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.p.r.o.q.u.o.t.a...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.1.c.-.0.0.0.1.-.0.0.1.3.-.8.1.5.d.-.2.2.0.c.0.a.1.9.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.7.d.0.3.f.6.a.1.a.a.4.5.0.5.0.f.7.b.e.5.5.f.8.7.6.f.e.a.2.d.c.0.0.0.0.0.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5B74.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Mon Oct 7 22:42:13 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	112922
Entropy (8bit):	1.5657229818378944
Encrypted:	false
SSDEEP:	384:TQPjHvLAtuSEh2DDPBWlemh4o3yqZN74qJBZl3fWUMrZ7y//1Ir:AHvLAtuSEgElkiq7y3o
MD5:	EC9A09188D9E22135AD33ABCA9E49178
SHA1:	BE4DB2BD40D23A83450BA8B4AAAED1DE7B453497
SHA-256:	41BF6C8E99BF1BD64DFAD85E3E636D6615FCC0DEAE9B0011F792FA7911AA33F8
SHA-512:	2A02F5F8B31AE83CDBB2973688443885F34B325BA88EF438A20A1572014DF4348E47CD2BC6CE5B5BFAA02C86816F8A310FE052B09B7051EFB51C3CF411074802
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ........c.g....................................D....>..........T.......8...........T............0..............<...........(...............................................................................eJ..............GenuineIntel............T.......x....c.g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5E54.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6322
Entropy (8bit):	3.719648210331216
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetb7R6mkN/YsQE/x17yf5aM4UO89bsgsfxEm:R6l7wVeJ7R6m8YsvmRprO89bsgsfxEm
MD5:	E40F9CA8FCC89A67640E329D1AA4D5A3
SHA1:	7DFC562F200A9DEE864557F7730711F69A37FD3D
SHA-256:	ED59A4C3FEE7E33DCE9D11763B5B1F6DEDC18CDE192BA9970431BB52C8B1B279
SHA-512:	18A46B09BD6367BD6FDBF3146CB9CBB3F6811BAE7982DA802EAA1D76D1B69EA6FDCBBCC55394ED5DF0AADC2119F327045C85B0D1BAC4193407B84FBC9F1A26F2
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.5.4.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5E74.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4640
Entropy (8bit):	4.46627191463049
Encrypted:	false
SSDEEP:	48:cvIwWl8zslJg77aI9u7CiVWpW8VYL6Ym8M4JXpeFnv+q88iOJmLRd:uIjf/I7ECV7VKJivbJmLRd
MD5:	5E993CE56DAAC6FAF1417007E7687871
SHA1:	F1D085BE6D492754A9589F725BBB9344F54FFEB1
SHA-256:	615D5FA9067927E887FAE671FB1CB55F24101E5290756A2F327C56965D469CF4
SHA-512:	CA32A95CF58E52CF9B651704DED4BDDCDAAB9470326390088E719DAF343F03C2F7DC3D9FC6F6DDB9B3BFEC2CD06369D949E26CEB0C9CE0A48BBBCD6AE4B61D59
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="533624" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAED9.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Mon Oct 7 22:41:28 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	35804
Entropy (8bit):	1.6460586242525734
Encrypted:	false
SSDEEP:	96:5T8xBGJc/CanSwpi77KQjqiGBsfNYXjphoLGoI5HrnngjIpWIkWIfAI4WWufCF8B:GLa2pOWG+Xjphok5Hrn0INWWuqm+S
MD5:	DF3A076CF10E10E7D372EC0F8181711E
SHA1:	8CDAF9FD52FF3214502CF7AC750A22B3FD8C8CEC
SHA-256:	19F29324D4A7580D6DE8D1582296A1881F1E9E601C1197A17B46C37756B7E329
SHA-512:	87F92A843E7595883A09666BABD0CE2AF4B5E6BE0E28D13C7179964C98D9E5F6194AB245132953AFE303E56E550E2F1E6A4566527B84D6B0B35FE515647D429E
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ........c.g........................d...........................T.......8...........T......................................................................................................................eJ..............GenuineIntel............T............c.g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAFC4.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8584
Entropy (8bit):	3.703977371430379
Encrypted:	false
SSDEEP:	192:R6l7wVeJeH6w6YeaSU9xa+SgmfCE2vmRprZ89bP1sf9lm:R6lXJG6w6YzSU9YgmfCE2eaPOf+
MD5:	12CCD09CC880CA38D90887DFA246791D
SHA1:	4BA7D04AD325BBDD5F02824C37858B32983232FE
SHA-256:	BCF9503C85ABD88231F19868CE9F9937E37FC08E8163D1A2C75B8641731F8173
SHA-512:	ABED7FB7FB6BAEFA562156AEAFDE57A306F1C8B1295EDF6DFEE414EF6754897D75F989F0399285BA62EF498A5AF57876BF9AB1471FE5F4B22246717B0A4A39C3
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.4.5.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAFF4.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4979
Entropy (8bit):	4.594252231172283
Encrypted:	false
SSDEEP:	48:cvIwWl8zslJg77aI9u7CiVWpW8VYcYm8M4JUmFb+q8c7aJI8Vd:uIjf/I7ECV7VEJfVaJI8Vd
MD5:	75CB428551A828406B4869D7547E5EDD
SHA1:	F5DF1421618D4DA2D64DC9128B56DA7275E159DC
SHA-256:	06B3321F6D23C255DD37C4AD026437F2077169B9D34F5104FCD8E12E02A11F7D
SHA-512:	BDE541F52C5C95EF7FA8C3D5ACF239450E9045C947BF84CD004E83BA212534FB4935DB912D1483A4717E329D89B0A77F92A7D5F61D8965609DE98989A7C07C4F
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="533624" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.299344410399795
Encrypted:	false
SSDEEP:	6144:pECqOEmWfd+WQFuy/9026ZTyaRsCDusBqD5dooiBldSD6VJSRkY:eCLL6seqD5SNSWVART
MD5:	0C3A2182FD77C34401395C4FCBA0333A
SHA1:	F475D85773D1C5721A598BFB40941CCDDF31CE9F
SHA-256:	2ACB27F94D0CC869370A80DBB15BFCD8625DE6A1665C1C4A455CE719920EC2D2
SHA-512:	D5C9CEB0AEE4ED441C33D45D635CE7858EDACF493CBF28E705D99875DFB29F505699959F1B199EC7DD1B9967F55DE1C825F19DD5319BDA470A477E90930F59E8
Malicious:	false
Preview:	regfE...E....\.Z.................... ....`......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..r.................................................................................................................................................................................................................................................................................................................................................:.f8........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.682625586989333
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe
File size:	505'344 bytes
MD5:	802faf03a51fcc731a15541960379d60
SHA1:	65a9594a5acf6c54c7ec1513351c386aa65c9819
SHA256:	fde872c02c049b7b02d8dfa2d694fba47b8d300001c6cf0ec83f11634a7256dd
SHA512:	cf8e0bc684fdb90101d1329369e8cdb5ebd9e95fd6d249a2363602ad372e34399c758e349f1689c65fc8d8b1ce923a0d03121c3b4c93102697b9dc9b3908ea2f
SSDEEP:	12288:rwZ1UqlNFaTRHcZeH5ijTgXcW3afEViFfUfily4S:rjql2H+wXl3afEHkj
TLSH:	93B4F125B5C1C072D577153206F4DA749E3EB8B00B62AE9F67940F7E4F31281E721AAB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=.9.y.WUy.WUy.WU..TTu.WU..RT..WU..STl.WU..VTz.WUy.VU!.WUilTTm.WUilSTk.WUilRT4.WU1m^Tx.WU1m.Ux.WU1mUTx.WURichy.WU...............

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x406f52
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x67043A1B [Mon Oct 7 19:44:27 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	d10af643340e1121562abe3e6bd5b0e1

Entrypoint Preview

Instruction
call 00007F608D17F9E0h
jmp 00007F608D17EF4Fh
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
cmp edx, esi
je 00007F608D17F0EBh
mov ecx, dword ptr [ebp+0Ch]
cmp ecx, dword ptr [edx+0Ch]
jc 00007F608D17F0DCh
mov eax, dword ptr [edx+08h]
add eax, dword ptr [edx+0Ch]
cmp ecx, eax
jc 00007F608D17F0DEh
add edx, 28h
cmp edx, esi
jne 00007F608D17F0BCh
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 00007F608D17F0CBh
push esi
call 00007F608D17FCF4h
test eax, eax
je 00007F608D17F0F2h
mov eax, dword ptr fs:[00000018h]
mov esi, 0047B33Ch
mov edx, dword ptr [eax+04h]
jmp 00007F608D17F0D6h
cmp edx, eax
je 00007F608D17F0E2h
xor eax, eax
mov ecx, edx
lock cmpxchg dword ptr [esi], ecx
test eax, eax
jne 00007F608D17F0C2h
xor al, al
pop esi
ret
mov al, 01h
pop esi
ret
push ebp
mov ebp, esp
cmp dword ptr [ebp+08h], 00000000h
jne 00007F608D17F0D9h
mov byte ptr [0047B340h], 00000001h
call 00007F608D17F38Ah
call 00007F608D1822A7h
test al, al
jne 00007F608D17F0D6h
xor al, al
pop ebp
ret
call 00007F608D18AD09h
test al, al
jne 00007F608D17F0DCh
push 00000000h
call 00007F608D1822AEh
pop ecx
jmp 00007F608D17F0BBh
mov al, 01h
pop ebp
ret
push ebp
mov ebp, esp
cmp byte ptr [0047B341h], 00000000h
je 00007F608D17F0D6h
mov al, 01h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2c6c0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x7c000	0x3d8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7d000	0x1ad8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2abc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2ab00	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x23000	0x12c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x210f0	0x21200	af079d14a8bbbdb4e5ed2ff535805329	False	0.586608195754717	data	6.6706588054296105	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x23000	0x9d78	0x9e00	a48667dece7457de0d28325af4e31530	False	0.43527492088607594	data	4.960605741914346	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2d000	0x4ef68	0x4e200	15b445bf8fce05644b51d6b2cb49438c	False	0.98989375	DOS executable (block device driver \377\377\377\377,32-bit sector-support)	7.990572080274887	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x7c000	0x3d8	0x400	5584c2fd2a321b3ff4d89d84727643be	False	0.4404296875	data	3.290569201128903	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x7d000	0x1ad8	0x1c00	6f1043b518415ada005e8fb211fa54fd	False	0.7273995535714286	data	6.393041450913615	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x7c058	0x380	data	English	United States	0.46205357142857145

Imports

DLL

Import

KERNEL32.dll

AttachConsole, MultiByteToWideChar, GetStringTypeW, WideCharToMultiByte, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, LCMapStringEx, GetCPInfo, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, CreateFileW, RaiseException, RtlUnwind, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, HeapAlloc, HeapFree, GetFileType, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileSizeEx, SetFilePointerEx, CloseHandle, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, GetProcessHeap, ReadConsoleW, HeapSize, WriteConsoleW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 00:41:25.157015085 CEST	49673	443	192.168.2.11	173.222.162.42
Oct 8, 2024 00:41:26.048374891 CEST	49676	443	192.168.2.11	20.189.173.3
Oct 8, 2024 00:41:26.360055923 CEST	49676	443	192.168.2.11	20.189.173.3
Oct 8, 2024 00:41:26.969451904 CEST	49676	443	192.168.2.11	20.189.173.3
Oct 8, 2024 00:41:27.016298056 CEST	49671	443	192.168.2.11	204.79.197.203
Oct 8, 2024 00:41:27.970662117 CEST	49702	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:27.970678091 CEST	443	49702	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:27.970740080 CEST	49702	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:27.971074104 CEST	49702	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:27.971088886 CEST	443	49702	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:28.172648907 CEST	49676	443	192.168.2.11	20.189.173.3
Oct 8, 2024 00:41:28.586230993 CEST	443	49702	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:28.586308956 CEST	49702	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:28.589772940 CEST	49702	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:28.589780092 CEST	443	49702	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:28.590054035 CEST	443	49702	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:28.600675106 CEST	49702	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:28.643399954 CEST	443	49702	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:28.699736118 CEST	443	49702	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:28.699759960 CEST	443	49702	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:28.699774981 CEST	443	49702	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:28.699884892 CEST	49702	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:28.699897051 CEST	443	49702	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:28.699960947 CEST	49702	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:28.782250881 CEST	443	49702	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:28.782316923 CEST	443	49702	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:28.782377005 CEST	49702	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:28.782397032 CEST	443	49702	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:28.782434940 CEST	49702	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:28.782454967 CEST	49702	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:28.786439896 CEST	443	49702	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:28.786489964 CEST	443	49702	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:28.786535025 CEST	49702	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:28.786542892 CEST	443	49702	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:28.786586046 CEST	49702	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:28.786601067 CEST	49702	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:28.862823009 CEST	443	49702	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:28.862859011 CEST	443	49702	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:28.862979889 CEST	49702	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:28.862994909 CEST	443	49702	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:28.863045931 CEST	49702	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:28.866993904 CEST	443	49702	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:28.867012024 CEST	443	49702	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:28.867073059 CEST	49702	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:28.867086887 CEST	443	49702	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:28.867130995 CEST	49702	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:28.870677948 CEST	443	49702	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:28.870695114 CEST	443	49702	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:28.870754004 CEST	49702	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:28.870763063 CEST	443	49702	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:28.870809078 CEST	49702	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:28.873951912 CEST	443	49702	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:28.873970985 CEST	443	49702	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:28.874026060 CEST	49702	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:28.874034882 CEST	443	49702	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:28.874077082 CEST	49702	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:28.945472956 CEST	443	49702	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:28.945542097 CEST	443	49702	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:28.945646048 CEST	49702	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:28.945661068 CEST	443	49702	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:28.945673943 CEST	49702	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:28.945719957 CEST	49702	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:28.948867083 CEST	443	49702	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:28.948925972 CEST	443	49702	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:28.948950052 CEST	49702	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:28.948960066 CEST	443	49702	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:28.948985100 CEST	49702	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:28.949002028 CEST	49702	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:28.952233076 CEST	443	49702	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:28.952253103 CEST	443	49702	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:28.952312946 CEST	49702	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:28.952322960 CEST	443	49702	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:28.952359915 CEST	49702	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:28.954797029 CEST	443	49702	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:28.954812050 CEST	443	49702	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:28.954864979 CEST	49702	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:28.954879045 CEST	443	49702	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:28.954916954 CEST	49702	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:28.957891941 CEST	443	49702	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:28.957909107 CEST	443	49702	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:28.957962990 CEST	49702	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:28.957972050 CEST	443	49702	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:28.958008051 CEST	49702	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:28.960316896 CEST	443	49702	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:28.960334063 CEST	443	49702	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:28.960459948 CEST	49702	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:28.960470915 CEST	443	49702	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:28.960515022 CEST	49702	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:28.961925030 CEST	443	49702	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:28.961978912 CEST	49702	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:28.961992025 CEST	443	49702	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:28.962006092 CEST	443	49702	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:28.962040901 CEST	49702	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:28.962091923 CEST	49702	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:28.962106943 CEST	443	49702	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:28.962121010 CEST	49702	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:28.962132931 CEST	443	49702	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.019071102 CEST	49703	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:29.019105911 CEST	443	49703	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.019174099 CEST	49703	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:29.019910097 CEST	49704	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:29.019953012 CEST	443	49704	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.020008087 CEST	49704	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:29.020394087 CEST	49705	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:29.020433903 CEST	443	49705	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.020591974 CEST	49705	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:29.020749092 CEST	49703	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:29.020761013 CEST	443	49703	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.021126032 CEST	49706	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:29.021147013 CEST	443	49706	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.021193027 CEST	49706	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:29.021400928 CEST	49706	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:29.021414995 CEST	443	49706	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.021559000 CEST	49704	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:29.021573067 CEST	443	49704	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.021687984 CEST	49705	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:29.021697044 CEST	443	49705	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.021888971 CEST	49707	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:29.021897078 CEST	443	49707	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.021960974 CEST	49707	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:29.022104025 CEST	49707	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:29.022115946 CEST	443	49707	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.634639978 CEST	443	49703	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.642170906 CEST	443	49706	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.655860901 CEST	49703	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:29.655881882 CEST	443	49703	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.656318903 CEST	49703	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:29.656323910 CEST	443	49703	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.659848928 CEST	49706	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:29.659879923 CEST	443	49706	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.660358906 CEST	49706	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:29.660363913 CEST	443	49706	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.713237047 CEST	443	49705	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.714087963 CEST	49705	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:29.714102983 CEST	443	49705	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.714574099 CEST	49705	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:29.714580059 CEST	443	49705	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.719685078 CEST	443	49704	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.722975969 CEST	49704	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:29.723004103 CEST	443	49704	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.723387957 CEST	49704	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:29.723392963 CEST	443	49704	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.734677076 CEST	443	49707	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.736252069 CEST	49707	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:29.736258030 CEST	443	49707	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.736691952 CEST	49707	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:29.736696005 CEST	443	49707	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.751713037 CEST	443	49706	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.751765966 CEST	443	49706	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.751852989 CEST	49706	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:29.753516912 CEST	49706	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:29.753516912 CEST	49706	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:29.753536940 CEST	443	49706	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.753546000 CEST	443	49706	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.755511999 CEST	443	49703	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.755573034 CEST	443	49703	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.755634069 CEST	49703	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:29.755661011 CEST	443	49703	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.755700111 CEST	49703	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:29.755707026 CEST	443	49703	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.755770922 CEST	443	49703	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.755816936 CEST	49703	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:29.758346081 CEST	49703	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:29.758357048 CEST	443	49703	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.758385897 CEST	49703	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:29.758390903 CEST	443	49703	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.774182081 CEST	49708	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:29.774224043 CEST	443	49708	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.774287939 CEST	49708	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:29.775540113 CEST	49709	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:29.775577068 CEST	443	49709	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.775630951 CEST	49709	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:29.778414011 CEST	49708	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:29.778433084 CEST	443	49708	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.778659105 CEST	49709	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:29.778672934 CEST	443	49709	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.814646959 CEST	443	49705	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.814713955 CEST	443	49705	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.814795017 CEST	49705	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:29.820920944 CEST	443	49704	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.820971012 CEST	443	49704	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.821140051 CEST	49704	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:29.821147919 CEST	443	49704	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.821233988 CEST	49704	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:29.821372986 CEST	443	49704	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.821422100 CEST	443	49704	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.821468115 CEST	49704	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:29.821768999 CEST	49705	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:29.821768999 CEST	49705	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:29.821793079 CEST	443	49705	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.821806908 CEST	443	49705	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.835268021 CEST	443	49707	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.835283995 CEST	443	49707	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.835338116 CEST	49707	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:29.835345984 CEST	443	49707	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.835458994 CEST	443	49707	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.835498095 CEST	49707	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:29.835621119 CEST	49704	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:29.835632086 CEST	443	49704	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.835644007 CEST	49704	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:29.835653067 CEST	443	49704	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.837699890 CEST	49707	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:29.837707043 CEST	443	49707	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.837714911 CEST	49707	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:29.837719917 CEST	443	49707	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.850188971 CEST	49710	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:29.850217104 CEST	443	49710	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.850277901 CEST	49710	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:29.852487087 CEST	49711	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:29.852524042 CEST	443	49711	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.852596045 CEST	49711	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:29.853338957 CEST	49710	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:29.853353977 CEST	443	49710	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.854140043 CEST	49712	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:29.854175091 CEST	443	49712	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.854207993 CEST	49711	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:29.854222059 CEST	443	49711	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.854319096 CEST	49712	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:29.854319096 CEST	49712	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:29.854346991 CEST	443	49712	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:29.882317066 CEST	49713	80	192.168.2.11	46.8.231.109
Oct 8, 2024 00:41:29.887231112 CEST	80	49713	46.8.231.109	192.168.2.11
Oct 8, 2024 00:41:29.887316942 CEST	49713	80	192.168.2.11	46.8.231.109
Oct 8, 2024 00:41:29.887499094 CEST	49713	80	192.168.2.11	46.8.231.109
Oct 8, 2024 00:41:29.892748117 CEST	80	49713	46.8.231.109	192.168.2.11
Oct 8, 2024 00:41:30.402426004 CEST	443	49709	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:30.404350996 CEST	49709	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:30.404361010 CEST	443	49709	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:30.405118942 CEST	49709	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:30.405123949 CEST	443	49709	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:30.421137094 CEST	443	49708	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:30.423257113 CEST	49708	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:30.423278093 CEST	443	49708	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:30.423669100 CEST	49708	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:30.423676014 CEST	443	49708	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:30.461271048 CEST	443	49711	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:30.461381912 CEST	443	49710	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:30.499631882 CEST	443	49709	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:30.499696970 CEST	443	49709	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:30.499764919 CEST	49709	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:30.500163078 CEST	443	49712	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:30.516331911 CEST	49710	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:30.516475916 CEST	49711	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:30.519670963 CEST	443	49708	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:30.519737959 CEST	443	49708	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:30.519813061 CEST	49708	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:30.528007030 CEST	49711	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:30.528014898 CEST	443	49711	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:30.528645992 CEST	49711	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:30.528656006 CEST	443	49711	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:30.529609919 CEST	49708	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:30.529609919 CEST	49708	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:30.529625893 CEST	443	49708	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:30.529633999 CEST	443	49708	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:30.531091928 CEST	49710	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:30.531099081 CEST	443	49710	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:30.531693935 CEST	49710	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:30.531698942 CEST	443	49710	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:30.547532082 CEST	49712	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:30.562598944 CEST	49709	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:30.562617064 CEST	443	49709	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:30.562628031 CEST	49709	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:30.562633991 CEST	443	49709	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:30.563033104 CEST	49712	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:30.563044071 CEST	443	49712	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:30.563560009 CEST	49712	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:30.563566923 CEST	443	49712	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:30.566787958 CEST	49714	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:30.566807985 CEST	443	49714	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:30.566870928 CEST	49714	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:30.567136049 CEST	49715	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:30.567166090 CEST	443	49715	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:30.567214966 CEST	49715	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:30.567351103 CEST	49715	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:30.567370892 CEST	443	49715	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:30.567398071 CEST	49714	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:30.567408085 CEST	443	49714	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:30.578814983 CEST	49676	443	192.168.2.11	20.189.173.3
Oct 8, 2024 00:41:30.746483088 CEST	443	49711	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:30.746599913 CEST	443	49711	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:30.746690035 CEST	49711	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:30.748950958 CEST	49711	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:30.748966932 CEST	443	49711	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:30.748986006 CEST	49711	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:30.748991013 CEST	443	49711	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:30.750366926 CEST	443	49710	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:30.750658989 CEST	443	49710	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:30.750725031 CEST	49710	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:30.752835035 CEST	49710	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:30.752860069 CEST	443	49710	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:30.752861977 CEST	49710	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:30.752868891 CEST	443	49710	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:30.757443905 CEST	49716	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:30.757472992 CEST	443	49716	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:30.757554054 CEST	49716	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:30.758300066 CEST	443	49712	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:30.758363008 CEST	443	49712	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:30.758408070 CEST	49712	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:30.758765936 CEST	49717	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:30.758805990 CEST	443	49717	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:30.758857965 CEST	49717	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:30.762089968 CEST	49716	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:30.762103081 CEST	443	49716	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:30.764573097 CEST	49712	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:30.764591932 CEST	443	49712	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:30.764602900 CEST	49712	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:30.764609098 CEST	443	49712	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:30.874260902 CEST	49718	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:30.874309063 CEST	443	49718	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:30.874396086 CEST	49718	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:30.874552965 CEST	49717	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:30.874569893 CEST	443	49717	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:30.888099909 CEST	49718	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:30.888113976 CEST	443	49718	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:31.282912970 CEST	443	49714	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:31.283519030 CEST	49714	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:31.283540010 CEST	443	49714	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:31.284018993 CEST	49714	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:31.284024000 CEST	443	49714	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:31.289504051 CEST	443	49715	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:31.290045977 CEST	49715	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:31.290064096 CEST	443	49715	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:31.290481091 CEST	49715	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:31.290487051 CEST	443	49715	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:31.385907888 CEST	443	49714	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:31.386060953 CEST	443	49714	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:31.386137962 CEST	49714	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:31.386339903 CEST	49714	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:31.386368990 CEST	443	49714	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:31.386377096 CEST	49714	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:31.386383057 CEST	443	49714	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:31.389305115 CEST	49720	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:31.389345884 CEST	443	49720	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:31.389420033 CEST	49720	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:31.389558077 CEST	49720	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:31.389565945 CEST	443	49720	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:31.393686056 CEST	443	49715	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:31.393748999 CEST	443	49715	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:31.393805027 CEST	49715	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:31.393961906 CEST	49715	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:31.393970013 CEST	443	49715	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:31.397008896 CEST	49721	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:31.397037983 CEST	443	49721	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:31.397281885 CEST	49721	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:31.397281885 CEST	49721	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:31.397317886 CEST	443	49721	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:31.427145004 CEST	443	49716	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:31.427634954 CEST	49716	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:31.427669048 CEST	443	49716	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:31.428127050 CEST	49716	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:31.428133011 CEST	443	49716	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:31.506149054 CEST	443	49718	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:31.506695986 CEST	49718	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:31.506721020 CEST	443	49718	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:31.507407904 CEST	49718	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:31.507415056 CEST	443	49718	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:31.526151896 CEST	443	49717	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:31.526770115 CEST	49717	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:31.526789904 CEST	443	49717	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:31.530170918 CEST	49717	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:31.530178070 CEST	443	49717	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:31.530354023 CEST	443	49716	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:31.530414104 CEST	443	49716	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:31.530473948 CEST	49716	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:31.530977011 CEST	49716	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:31.530977011 CEST	49716	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:31.530996084 CEST	443	49716	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:31.531004906 CEST	443	49716	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:31.535758018 CEST	49722	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:31.535797119 CEST	443	49722	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:31.536039114 CEST	49722	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:31.536959887 CEST	49722	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:31.536977053 CEST	443	49722	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:31.612257004 CEST	443	49718	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:31.612327099 CEST	443	49718	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:31.612399101 CEST	49718	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:31.612569094 CEST	49718	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:31.612612009 CEST	443	49718	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:31.612623930 CEST	49718	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:31.612631083 CEST	443	49718	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:31.615793943 CEST	49723	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:31.615840912 CEST	443	49723	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:31.615904093 CEST	49723	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:31.616038084 CEST	49723	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:31.616046906 CEST	443	49723	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:31.629933119 CEST	443	49717	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:31.629992008 CEST	443	49717	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:31.630083084 CEST	49717	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:31.630290985 CEST	49717	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:31.630290985 CEST	49717	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:31.630302906 CEST	443	49717	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:31.630312920 CEST	443	49717	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:31.633763075 CEST	49724	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:31.633810997 CEST	443	49724	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:31.633992910 CEST	49724	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:31.634135962 CEST	49724	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:31.634150028 CEST	443	49724	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.000838041 CEST	443	49720	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.001532078 CEST	49720	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.001555920 CEST	443	49720	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.002077103 CEST	49720	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.002082109 CEST	443	49720	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.035341024 CEST	443	49721	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.035938978 CEST	49721	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.035962105 CEST	443	49721	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.036479950 CEST	49721	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.036494017 CEST	443	49721	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.096116066 CEST	443	49720	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.096191883 CEST	443	49720	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.096268892 CEST	49720	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.096501112 CEST	49720	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.096522093 CEST	443	49720	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.096559048 CEST	49720	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.096565962 CEST	443	49720	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.099492073 CEST	49726	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.099540949 CEST	443	49726	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.099843025 CEST	49726	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.099992037 CEST	49726	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.100003958 CEST	443	49726	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.135550022 CEST	443	49721	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.135607004 CEST	443	49721	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.135854959 CEST	49721	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.135931015 CEST	49721	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.135947943 CEST	443	49721	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.135958910 CEST	49721	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.135966063 CEST	443	49721	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.138797998 CEST	49727	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.138828039 CEST	443	49727	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.138935089 CEST	49727	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.139084101 CEST	49727	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.139095068 CEST	443	49727	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.158395052 CEST	443	49722	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.159295082 CEST	49722	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.159311056 CEST	443	49722	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.160492897 CEST	49722	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.160499096 CEST	443	49722	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.240793943 CEST	443	49723	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.241229057 CEST	49723	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.241259098 CEST	443	49723	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.241805077 CEST	49723	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.241813898 CEST	443	49723	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.274372101 CEST	443	49722	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.274450064 CEST	443	49722	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.274565935 CEST	49722	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.274780989 CEST	49722	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.274780989 CEST	49722	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.274795055 CEST	443	49722	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.274806976 CEST	443	49722	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.276561975 CEST	443	49724	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.276921034 CEST	49724	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.276937008 CEST	443	49724	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.277353048 CEST	49724	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.277359009 CEST	443	49724	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.277849913 CEST	49728	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.277899027 CEST	443	49728	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.277965069 CEST	49728	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.278090954 CEST	49728	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.278104067 CEST	443	49728	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.360685110 CEST	443	49723	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.360843897 CEST	443	49723	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.360907078 CEST	49723	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.361025095 CEST	49723	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.361044884 CEST	443	49723	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.361078978 CEST	49723	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.361084938 CEST	443	49723	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.363944054 CEST	49729	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.363976955 CEST	443	49729	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.364147902 CEST	49729	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.364325047 CEST	49729	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.364336014 CEST	443	49729	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.378787041 CEST	443	49724	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.378849983 CEST	443	49724	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.378926039 CEST	49724	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.379158974 CEST	49724	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.379182100 CEST	443	49724	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.379193068 CEST	49724	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.379199982 CEST	443	49724	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.382069111 CEST	49730	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.382102013 CEST	443	49730	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.382416010 CEST	49730	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.382416010 CEST	49730	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.382451057 CEST	443	49730	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.713577986 CEST	443	49726	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.714108944 CEST	49726	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.714134932 CEST	443	49726	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.715893984 CEST	49726	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.715899944 CEST	443	49726	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.789176941 CEST	443	49727	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.789660931 CEST	49727	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.789681911 CEST	443	49727	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.790128946 CEST	49727	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.790134907 CEST	443	49727	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.810091019 CEST	443	49726	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.810168028 CEST	443	49726	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.810240030 CEST	49726	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.810379982 CEST	49726	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.810395956 CEST	443	49726	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.810406923 CEST	49726	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.810412884 CEST	443	49726	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.813502073 CEST	49732	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.813538074 CEST	443	49732	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.813616037 CEST	49732	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.813750982 CEST	49732	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.813762903 CEST	443	49732	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.887554884 CEST	443	49728	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.888039112 CEST	49728	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.888067007 CEST	443	49728	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.888459921 CEST	49728	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.888465881 CEST	443	49728	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.892911911 CEST	443	49727	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.892982006 CEST	443	49727	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.893101931 CEST	49727	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.893203974 CEST	49727	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.893218994 CEST	443	49727	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.893265009 CEST	49727	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.893273115 CEST	443	49727	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.898411989 CEST	49733	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.898456097 CEST	443	49733	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.898546934 CEST	49733	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.898736000 CEST	49733	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.898747921 CEST	443	49733	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.982626915 CEST	443	49729	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.983114004 CEST	49729	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.983125925 CEST	443	49729	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.983551979 CEST	49729	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.983556986 CEST	443	49729	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.986488104 CEST	443	49728	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.986548901 CEST	443	49728	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.986613035 CEST	49728	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.986797094 CEST	49728	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.986820936 CEST	443	49728	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.986833096 CEST	49728	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.986839056 CEST	443	49728	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.989424944 CEST	49736	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.989459038 CEST	443	49736	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.989654064 CEST	49736	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.989892006 CEST	49736	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.989905119 CEST	443	49736	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.990030050 CEST	443	49730	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.990744114 CEST	49730	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.990767956 CEST	443	49730	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:32.991276979 CEST	49730	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:32.991281986 CEST	443	49730	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:33.083008051 CEST	443	49729	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:33.083149910 CEST	443	49729	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:33.083316088 CEST	49729	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:33.083450079 CEST	49729	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:33.083470106 CEST	443	49729	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:33.083522081 CEST	49729	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:33.083539009 CEST	443	49729	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:33.087253094 CEST	49737	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:33.087306023 CEST	443	49737	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:33.087425947 CEST	49737	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:33.087905884 CEST	49737	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:33.087920904 CEST	443	49737	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:33.091270924 CEST	443	49730	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:33.091337919 CEST	443	49730	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:33.091622114 CEST	49730	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:33.091770887 CEST	49730	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:33.091770887 CEST	49730	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:33.091779947 CEST	443	49730	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:33.091792107 CEST	443	49730	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:33.094676018 CEST	49738	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:33.094696045 CEST	443	49738	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:33.095114946 CEST	49738	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:33.095333099 CEST	49738	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:33.095345974 CEST	443	49738	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:33.449258089 CEST	443	49732	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:33.460686922 CEST	49732	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:33.460717916 CEST	443	49732	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:33.480415106 CEST	49732	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:33.480431080 CEST	443	49732	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:33.547766924 CEST	443	49733	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:33.548275948 CEST	49733	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:33.548295021 CEST	443	49733	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:33.552071095 CEST	49733	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:33.552078962 CEST	443	49733	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:33.574111938 CEST	443	49732	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:33.574177027 CEST	443	49732	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:33.574255943 CEST	49732	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:33.574836016 CEST	49732	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:33.574856997 CEST	443	49732	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:33.574954987 CEST	49732	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:33.574960947 CEST	443	49732	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:33.611745119 CEST	49739	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:33.611793041 CEST	443	49739	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:33.611866951 CEST	49739	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:33.612037897 CEST	49739	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:33.612055063 CEST	443	49739	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:33.628426075 CEST	443	49736	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:33.629127026 CEST	49736	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:33.629138947 CEST	443	49736	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:33.629762888 CEST	49736	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:33.629767895 CEST	443	49736	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:33.653475046 CEST	443	49733	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:33.653544903 CEST	443	49733	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:33.653594017 CEST	49733	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:33.653788090 CEST	49733	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:33.653810978 CEST	443	49733	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:33.653825045 CEST	49733	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:33.653831005 CEST	443	49733	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:33.657798052 CEST	49740	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:33.657831907 CEST	443	49740	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:33.657932997 CEST	49740	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:33.658099890 CEST	49740	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:33.658116102 CEST	443	49740	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:33.707609892 CEST	443	49737	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:33.708090067 CEST	49737	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:33.708111048 CEST	443	49737	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:33.708528042 CEST	49737	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:33.708533049 CEST	443	49737	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:33.715854883 CEST	443	49738	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:33.716238022 CEST	49738	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:33.716263056 CEST	443	49738	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:33.716665030 CEST	49738	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:33.716670036 CEST	443	49738	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:33.728517056 CEST	443	49736	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:33.728574038 CEST	443	49736	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:33.728631973 CEST	49736	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:33.728811026 CEST	49736	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:33.728863001 CEST	443	49736	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:33.728893042 CEST	49736	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:33.728916883 CEST	443	49736	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:33.731635094 CEST	49741	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:33.731678009 CEST	443	49741	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:33.731883049 CEST	49741	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:33.731883049 CEST	49741	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:33.731915951 CEST	443	49741	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:33.804450989 CEST	443	49737	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:33.804610014 CEST	443	49737	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:33.804694891 CEST	49737	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:33.804872036 CEST	49737	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:33.804893970 CEST	443	49737	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:33.804904938 CEST	49737	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:33.804909945 CEST	443	49737	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:33.808150053 CEST	49742	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:33.808202982 CEST	443	49742	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:33.808429003 CEST	49742	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:33.808429003 CEST	49742	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:33.808469057 CEST	443	49742	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:33.817121983 CEST	443	49738	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:33.817197084 CEST	443	49738	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:33.817246914 CEST	49738	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:33.817420006 CEST	49738	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:33.817429066 CEST	443	49738	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:33.817439079 CEST	49738	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:33.817442894 CEST	443	49738	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:33.820096016 CEST	49743	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:33.820144892 CEST	443	49743	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:33.820220947 CEST	49743	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:33.820374012 CEST	49743	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:33.820394993 CEST	443	49743	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:34.239268064 CEST	443	49739	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:34.240010977 CEST	49739	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:34.240036964 CEST	443	49739	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:34.240557909 CEST	49739	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:34.240562916 CEST	443	49739	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:34.293289900 CEST	443	49740	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:34.293977022 CEST	49740	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:34.293997049 CEST	443	49740	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:34.295044899 CEST	49740	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:34.295051098 CEST	443	49740	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:34.356152058 CEST	443	49739	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:34.356348038 CEST	443	49739	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:34.356414080 CEST	49739	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:34.356442928 CEST	49739	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:34.356461048 CEST	443	49739	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:34.356475115 CEST	49739	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:34.356481075 CEST	443	49739	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:34.357593060 CEST	443	49741	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:34.357990980 CEST	49741	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:34.358010054 CEST	443	49741	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:34.358450890 CEST	49741	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:34.358458042 CEST	443	49741	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:34.359528065 CEST	49744	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:34.359570026 CEST	443	49744	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:34.359638929 CEST	49744	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:34.359781027 CEST	49744	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:34.359795094 CEST	443	49744	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:34.400254965 CEST	443	49740	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:34.400322914 CEST	443	49740	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:34.400372982 CEST	49740	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:34.400604963 CEST	49740	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:34.400621891 CEST	443	49740	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:34.400650978 CEST	49740	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:34.400657892 CEST	443	49740	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:34.403667927 CEST	49745	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:34.403707027 CEST	443	49745	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:34.403774977 CEST	49745	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:34.403925896 CEST	49745	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:34.403939962 CEST	443	49745	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:34.453491926 CEST	443	49742	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:34.454153061 CEST	49742	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:34.454183102 CEST	443	49742	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:34.454674959 CEST	49742	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:34.454680920 CEST	443	49742	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:34.457750082 CEST	443	49743	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:34.458195925 CEST	49743	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:34.458225012 CEST	443	49743	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:34.458636045 CEST	443	49741	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:34.458648920 CEST	49743	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:34.458657026 CEST	443	49743	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:34.458703041 CEST	443	49741	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:34.458753109 CEST	49741	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:34.458890915 CEST	49741	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:34.458916903 CEST	443	49741	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:34.458930969 CEST	49741	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:34.458937883 CEST	443	49741	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:34.461591005 CEST	49746	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:34.461622953 CEST	443	49746	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:34.461704969 CEST	49746	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:34.461880922 CEST	49746	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:34.461894989 CEST	443	49746	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:34.557554007 CEST	443	49743	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:34.557626009 CEST	443	49743	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:34.557677984 CEST	49743	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:34.557851076 CEST	49743	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:34.557868958 CEST	443	49743	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:34.557878971 CEST	49743	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:34.557884932 CEST	443	49743	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:34.559751034 CEST	443	49742	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:34.559803009 CEST	443	49742	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:34.559844017 CEST	49742	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:34.559968948 CEST	49742	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:34.559993982 CEST	443	49742	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:34.560008049 CEST	49742	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:34.560015917 CEST	443	49742	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:34.561036110 CEST	49747	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:34.561075926 CEST	443	49747	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:34.561156034 CEST	49747	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:34.561570883 CEST	49747	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:34.561589003 CEST	443	49747	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:34.562777042 CEST	49748	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:34.562819004 CEST	443	49748	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:34.562985897 CEST	49748	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:34.563019991 CEST	49748	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:34.563025951 CEST	443	49748	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:34.766310930 CEST	49673	443	192.168.2.11	173.222.162.42
Oct 8, 2024 00:41:35.052654982 CEST	443	49744	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.053308010 CEST	49744	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.053322077 CEST	443	49744	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.053756952 CEST	49744	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.053761005 CEST	443	49744	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.053906918 CEST	443	49745	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.054192066 CEST	49745	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.054219961 CEST	443	49745	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.054505110 CEST	49745	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.054511070 CEST	443	49745	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.068876028 CEST	443	49746	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.069207907 CEST	49746	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.069231033 CEST	443	49746	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.069619894 CEST	49746	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.069627047 CEST	443	49746	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.154122114 CEST	443	49744	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.154200077 CEST	443	49744	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.154284954 CEST	49744	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.154527903 CEST	49744	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.154544115 CEST	443	49744	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.154573917 CEST	49744	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.154580116 CEST	443	49744	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.157356024 CEST	443	49745	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.157422066 CEST	443	49745	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.157603979 CEST	49749	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.157660961 CEST	443	49749	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.157665014 CEST	49745	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.157665014 CEST	49745	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.157708883 CEST	49745	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.157730103 CEST	443	49745	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.157732964 CEST	49749	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.158142090 CEST	49749	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.158155918 CEST	443	49749	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.159848928 CEST	49750	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.159862995 CEST	443	49750	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.159991026 CEST	49750	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.160105944 CEST	49750	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.160118103 CEST	443	49750	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.167577028 CEST	443	49746	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.167644978 CEST	443	49746	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.167799950 CEST	49746	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.167838097 CEST	49746	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.167838097 CEST	49746	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.167859077 CEST	443	49746	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.167867899 CEST	443	49746	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.170753002 CEST	49751	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.170789003 CEST	443	49751	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.171228886 CEST	49751	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.171228886 CEST	49751	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.171264887 CEST	443	49751	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.229670048 CEST	443	49747	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.230431080 CEST	49747	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.230453968 CEST	443	49747	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.230921984 CEST	49747	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.230930090 CEST	443	49747	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.242525101 CEST	443	49748	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.243216991 CEST	49748	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.243231058 CEST	443	49748	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.243829966 CEST	49748	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.243834972 CEST	443	49748	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.337543964 CEST	443	49747	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.337624073 CEST	443	49747	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.337677002 CEST	49747	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.337888956 CEST	49747	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.337908030 CEST	443	49747	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.337920904 CEST	49747	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.337927103 CEST	443	49747	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.341022015 CEST	49752	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.341072083 CEST	443	49752	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.341308117 CEST	49752	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.341692924 CEST	49752	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.341708899 CEST	443	49752	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.382934093 CEST	443	49748	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.383002043 CEST	443	49748	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.383115053 CEST	49748	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.383327007 CEST	49748	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.383327007 CEST	49748	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.383347988 CEST	443	49748	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.383362055 CEST	443	49748	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.386279106 CEST	49753	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.386327028 CEST	443	49753	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.386420965 CEST	49753	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.386580944 CEST	49753	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.386596918 CEST	443	49753	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.391285896 CEST	49676	443	192.168.2.11	20.189.173.3
Oct 8, 2024 00:41:35.806099892 CEST	443	49749	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.806708097 CEST	49749	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.806747913 CEST	443	49749	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.807260990 CEST	49749	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.807267904 CEST	443	49749	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.808458090 CEST	443	49751	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.808821917 CEST	49751	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.808850050 CEST	443	49751	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.809189081 CEST	49751	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.809196949 CEST	443	49751	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.814054012 CEST	443	49750	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.814574957 CEST	49750	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.814599991 CEST	443	49750	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.814990997 CEST	49750	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.814997911 CEST	443	49750	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.908801079 CEST	443	49751	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.908885956 CEST	443	49751	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.909024000 CEST	49751	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.909459114 CEST	49751	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.909459114 CEST	49751	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.909480095 CEST	443	49751	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.909492970 CEST	443	49751	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.911128998 CEST	443	49749	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.911228895 CEST	443	49749	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.911298037 CEST	49749	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.911469936 CEST	49749	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.911494017 CEST	443	49749	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.911505938 CEST	49749	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.911511898 CEST	443	49749	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.912233114 CEST	49754	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.912281036 CEST	443	49754	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.912353039 CEST	49754	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.912581921 CEST	49754	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.912599087 CEST	443	49754	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.913669109 CEST	49755	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.913703918 CEST	443	49755	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.913781881 CEST	49755	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.913908005 CEST	49755	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.913918972 CEST	443	49755	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.914278030 CEST	443	49750	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.914345026 CEST	443	49750	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.914395094 CEST	49750	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.914465904 CEST	49750	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.914482117 CEST	443	49750	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.914501905 CEST	49750	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.914508104 CEST	443	49750	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.916395903 CEST	49756	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.916438103 CEST	443	49756	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.916610956 CEST	49756	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.916646004 CEST	49756	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.916663885 CEST	443	49756	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.964154005 CEST	443	49752	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.964808941 CEST	49752	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.964823008 CEST	443	49752	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:35.965186119 CEST	49752	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:35.965190887 CEST	443	49752	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:36.037921906 CEST	443	49753	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:36.038500071 CEST	49753	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:36.038516998 CEST	443	49753	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:36.038989067 CEST	49753	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:36.038997889 CEST	443	49753	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:36.064172029 CEST	443	49752	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:36.064248085 CEST	443	49752	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:36.064306974 CEST	49752	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:36.064527988 CEST	49752	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:36.064546108 CEST	443	49752	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:36.064558983 CEST	49752	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:36.064565897 CEST	443	49752	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:36.067624092 CEST	49757	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:36.067670107 CEST	443	49757	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:36.067761898 CEST	49757	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:36.067883968 CEST	49757	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:36.067903042 CEST	443	49757	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:36.142258883 CEST	443	49753	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:36.142352104 CEST	443	49753	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:36.142414093 CEST	49753	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:36.142564058 CEST	49753	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:36.142585993 CEST	443	49753	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:36.142599106 CEST	49753	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:36.142606020 CEST	443	49753	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:36.145191908 CEST	49758	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:36.145234108 CEST	443	49758	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:36.145312071 CEST	49758	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:36.145529985 CEST	49758	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:36.145544052 CEST	443	49758	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:36.394154072 CEST	443	49701	173.222.162.42	192.168.2.11
Oct 8, 2024 00:41:36.394246101 CEST	49701	443	192.168.2.11	173.222.162.42
Oct 8, 2024 00:41:36.546642065 CEST	443	49754	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:36.547431946 CEST	49754	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:36.547460079 CEST	443	49754	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:36.547836065 CEST	49754	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:36.547844887 CEST	443	49754	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:36.553118944 CEST	443	49756	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:36.553539038 CEST	49756	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:36.553558111 CEST	443	49756	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:36.553917885 CEST	49756	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:36.553924084 CEST	443	49756	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:36.561568022 CEST	443	49755	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:36.561920881 CEST	49755	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:36.561943054 CEST	443	49755	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:36.562273979 CEST	49755	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:36.562283039 CEST	443	49755	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:36.625817060 CEST	49671	443	192.168.2.11	204.79.197.203
Oct 8, 2024 00:41:36.652102947 CEST	443	49756	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:36.652180910 CEST	443	49756	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:36.652299881 CEST	49756	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:36.652519941 CEST	49756	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:36.652539968 CEST	443	49756	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:36.652599096 CEST	49756	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:36.652605057 CEST	443	49756	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:36.655579090 CEST	49760	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:36.655611038 CEST	443	49760	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:36.655719995 CEST	49760	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:36.655886889 CEST	49760	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:36.655906916 CEST	443	49760	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:36.665705919 CEST	443	49755	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:36.665781021 CEST	443	49755	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:36.665853024 CEST	49755	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:36.666013956 CEST	49755	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:36.666013956 CEST	49755	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:36.666034937 CEST	443	49755	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:36.666043997 CEST	443	49755	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:36.668498039 CEST	49761	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:36.668539047 CEST	443	49761	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:36.668621063 CEST	49761	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:36.668757915 CEST	49761	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:36.668776035 CEST	443	49761	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:36.676425934 CEST	443	49754	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:36.676500082 CEST	443	49754	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:36.676554918 CEST	49754	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:36.676629066 CEST	49754	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:36.676644087 CEST	443	49754	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:36.676656961 CEST	49754	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:36.676661968 CEST	443	49754	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:36.678915024 CEST	49762	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:36.678925037 CEST	443	49762	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:36.679111958 CEST	49762	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:36.679111958 CEST	49762	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:36.679135084 CEST	443	49762	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:36.754684925 CEST	443	49757	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:36.755424023 CEST	49757	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:36.755439043 CEST	443	49757	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:36.757879972 CEST	49757	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:36.757886887 CEST	443	49757	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:36.766299963 CEST	443	49758	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:36.766752958 CEST	49758	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:36.766766071 CEST	443	49758	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:36.767188072 CEST	49758	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:36.767191887 CEST	443	49758	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:36.856408119 CEST	443	49757	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:36.856488943 CEST	443	49757	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:36.856591940 CEST	49757	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:36.856941938 CEST	49757	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:36.856941938 CEST	49757	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:36.856957912 CEST	443	49757	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:36.856966972 CEST	443	49757	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:36.859811068 CEST	49763	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:36.859847069 CEST	443	49763	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:36.859939098 CEST	49763	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:36.860150099 CEST	49763	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:36.860162020 CEST	443	49763	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:36.863769054 CEST	443	49758	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:36.863903046 CEST	443	49758	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:36.863970995 CEST	49758	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:36.864044905 CEST	49758	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:36.864044905 CEST	49758	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:36.864053011 CEST	443	49758	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:36.864062071 CEST	443	49758	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:36.866229057 CEST	49764	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:36.866271019 CEST	443	49764	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:36.866347075 CEST	49764	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:36.866489887 CEST	49764	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:36.866503954 CEST	443	49764	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:37.308645010 CEST	443	49760	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:37.309252977 CEST	49760	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:37.309276104 CEST	443	49760	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:37.309763908 CEST	49760	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:37.309768915 CEST	443	49760	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:37.313673973 CEST	443	49761	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:37.314075947 CEST	49761	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:37.314095020 CEST	443	49761	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:37.314549923 CEST	49761	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:37.314554930 CEST	443	49761	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:37.322783947 CEST	443	49762	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:37.323230028 CEST	49762	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:37.323260069 CEST	443	49762	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:37.323740959 CEST	49762	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:37.323745966 CEST	443	49762	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:37.417376995 CEST	443	49760	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:37.417447090 CEST	443	49760	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:37.417500019 CEST	49760	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:37.417691946 CEST	49760	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:37.417716980 CEST	443	49760	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:37.417727947 CEST	49760	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:37.417735100 CEST	443	49760	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:37.420686007 CEST	49765	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:37.420741081 CEST	443	49765	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:37.420819998 CEST	49765	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:37.420950890 CEST	49765	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:37.420969009 CEST	443	49765	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:37.425020933 CEST	443	49762	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:37.425087929 CEST	443	49762	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:37.425149918 CEST	49762	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:37.425312996 CEST	49762	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:37.425312996 CEST	49762	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:37.425329924 CEST	443	49762	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:37.425340891 CEST	443	49762	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:37.428653955 CEST	49766	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:37.428669930 CEST	443	49766	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:37.428740025 CEST	49766	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:37.428941965 CEST	49766	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:37.428951979 CEST	443	49766	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:37.433394909 CEST	443	49761	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:37.433468103 CEST	443	49761	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:37.433516026 CEST	49761	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:37.433620930 CEST	49761	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:37.433645964 CEST	443	49761	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:37.433676958 CEST	49761	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:37.433685064 CEST	443	49761	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:37.436156034 CEST	49767	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:37.436191082 CEST	443	49767	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:37.436429024 CEST	49767	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:37.436429024 CEST	49767	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:37.436459064 CEST	443	49767	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:37.575027943 CEST	443	49763	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:37.575059891 CEST	443	49764	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:37.575632095 CEST	49763	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:37.575635910 CEST	49764	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:37.575650930 CEST	443	49764	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:37.575651884 CEST	443	49763	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:37.576070070 CEST	49764	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:37.576081991 CEST	443	49764	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:37.576201916 CEST	49763	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:37.576209068 CEST	443	49763	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:37.881510973 CEST	443	49764	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:37.881932974 CEST	443	49764	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:37.882031918 CEST	49764	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:37.882060051 CEST	49764	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:37.882081032 CEST	443	49764	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:37.882158995 CEST	49764	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:37.882167101 CEST	443	49764	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:37.882447004 CEST	443	49763	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:37.882728100 CEST	443	49763	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:37.882778883 CEST	49763	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:37.882817984 CEST	49763	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:37.882838011 CEST	443	49763	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:37.882862091 CEST	49763	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:37.882867098 CEST	443	49763	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:37.885333061 CEST	49768	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:37.885382891 CEST	443	49768	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:37.885437965 CEST	49769	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:37.885468960 CEST	443	49769	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:37.885508060 CEST	49768	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:37.885535002 CEST	49769	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:37.885643005 CEST	49768	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:37.885667086 CEST	443	49768	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:37.885677099 CEST	49769	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:37.885690928 CEST	443	49769	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.127145052 CEST	443	49767	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.127796888 CEST	49767	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:38.127818108 CEST	443	49767	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.128662109 CEST	49767	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:38.128670931 CEST	443	49767	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.151918888 CEST	443	49766	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.153114080 CEST	49766	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:38.153114080 CEST	49766	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:38.153152943 CEST	443	49766	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.153172970 CEST	443	49766	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.170855999 CEST	443	49765	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.171494961 CEST	49765	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:38.171525002 CEST	443	49765	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.171864986 CEST	49765	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:38.171871901 CEST	443	49765	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.225408077 CEST	443	49767	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.225476027 CEST	443	49767	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.225596905 CEST	49767	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:38.225728035 CEST	49767	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:38.225728035 CEST	49767	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:38.225749016 CEST	443	49767	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.225759983 CEST	443	49767	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.228333950 CEST	49771	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:38.228374958 CEST	443	49771	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.228451967 CEST	49771	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:38.228589058 CEST	49771	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:38.228599072 CEST	443	49771	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.273772955 CEST	443	49766	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.273845911 CEST	443	49766	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.273899078 CEST	49766	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:38.274066925 CEST	49766	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:38.274086952 CEST	443	49766	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.274759054 CEST	443	49765	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.274820089 CEST	443	49765	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.274863958 CEST	49765	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:38.276283026 CEST	49765	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:38.276289940 CEST	443	49765	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.276302099 CEST	49765	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:38.276307106 CEST	443	49765	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.280711889 CEST	49772	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:38.280757904 CEST	443	49772	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.280826092 CEST	49772	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:38.281831026 CEST	49773	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:38.281868935 CEST	443	49773	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.281929970 CEST	49773	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:38.282278061 CEST	49772	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:38.282304049 CEST	443	49772	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.282602072 CEST	49773	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:38.282610893 CEST	443	49773	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.517875910 CEST	443	49769	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.518373966 CEST	49769	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:38.518397093 CEST	443	49769	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.518834114 CEST	49769	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:38.518842936 CEST	443	49769	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.518866062 CEST	443	49768	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.519191027 CEST	49768	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:38.519218922 CEST	443	49768	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.519565105 CEST	49768	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:38.519572973 CEST	443	49768	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.619637966 CEST	443	49769	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.619710922 CEST	443	49769	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.619771957 CEST	49769	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:38.619961023 CEST	49769	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:38.619978905 CEST	443	49769	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.619992018 CEST	49769	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:38.619997978 CEST	443	49769	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.622840881 CEST	49774	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:38.622873068 CEST	443	49774	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.622951984 CEST	49774	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:38.623110056 CEST	49774	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:38.623126030 CEST	443	49774	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.656455994 CEST	443	49768	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.656531096 CEST	443	49768	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.656650066 CEST	49768	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:38.656941891 CEST	49768	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:38.656964064 CEST	443	49768	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.656975031 CEST	49768	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:38.656980991 CEST	443	49768	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.659709930 CEST	49775	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:38.659755945 CEST	443	49775	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.659852028 CEST	49775	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:38.660001993 CEST	49775	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:38.660021067 CEST	443	49775	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.882719040 CEST	443	49771	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.883635044 CEST	49771	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:38.883650064 CEST	443	49771	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.884098053 CEST	49771	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:38.884102106 CEST	443	49771	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.890392065 CEST	443	49772	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.890830040 CEST	49772	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:38.890867949 CEST	443	49772	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.891166925 CEST	49772	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:38.891179085 CEST	443	49772	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.945453882 CEST	443	49773	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.946027040 CEST	49773	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:38.946050882 CEST	443	49773	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.946490049 CEST	49773	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:38.946501017 CEST	443	49773	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.987359047 CEST	443	49771	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.987546921 CEST	443	49771	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.987692118 CEST	49771	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:38.987731934 CEST	49771	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:38.987731934 CEST	49771	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:38.987751007 CEST	443	49771	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.987761974 CEST	443	49771	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.990689993 CEST	49776	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:38.990736961 CEST	443	49776	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.990950108 CEST	49776	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:38.991019011 CEST	49776	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:38.991034985 CEST	443	49776	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.993659973 CEST	443	49772	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.993721008 CEST	443	49772	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.993889093 CEST	49772	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:38.993922949 CEST	49772	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:38.993922949 CEST	49772	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:38.993937969 CEST	443	49772	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.993948936 CEST	443	49772	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.996145010 CEST	49777	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:38.996182919 CEST	443	49777	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:38.996331930 CEST	49777	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:38.996470928 CEST	49777	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:38.996488094 CEST	443	49777	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:39.054019928 CEST	443	49773	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:39.054086924 CEST	443	49773	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:39.054235935 CEST	49773	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:39.054390907 CEST	49773	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:39.054390907 CEST	49773	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:39.054410934 CEST	443	49773	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:39.054414988 CEST	443	49773	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:39.056804895 CEST	49778	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:39.056853056 CEST	443	49778	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:39.057090044 CEST	49778	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:39.057090044 CEST	49778	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:39.057122946 CEST	443	49778	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:39.246464014 CEST	443	49774	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:39.247301102 CEST	49774	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:39.247323036 CEST	443	49774	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:39.248919010 CEST	49774	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:39.248929024 CEST	443	49774	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:39.325705051 CEST	443	49775	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:39.326265097 CEST	49775	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:39.326292992 CEST	443	49775	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:39.327231884 CEST	49775	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:39.327241898 CEST	443	49775	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:39.372581005 CEST	443	49774	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:39.372648954 CEST	443	49774	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:39.372849941 CEST	49774	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:39.372878075 CEST	49774	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:39.372895956 CEST	443	49774	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:39.372941971 CEST	49774	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:39.372947931 CEST	443	49774	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:39.376044035 CEST	49780	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:39.376079082 CEST	443	49780	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:39.376208067 CEST	49780	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:39.376363039 CEST	49780	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:39.376378059 CEST	443	49780	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:39.431921959 CEST	443	49775	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:39.431993961 CEST	443	49775	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:39.432151079 CEST	49775	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:39.432364941 CEST	49775	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:39.432365894 CEST	49775	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:39.432389021 CEST	443	49775	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:39.432399988 CEST	443	49775	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:39.434839964 CEST	49781	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:39.434900999 CEST	443	49781	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:39.435003042 CEST	49781	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:39.435121059 CEST	49781	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:39.435134888 CEST	443	49781	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:39.633574009 CEST	443	49777	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:39.634231091 CEST	49777	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:39.634243965 CEST	443	49777	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:39.635719061 CEST	49777	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:39.635726929 CEST	443	49777	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:39.644494057 CEST	443	49776	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:39.646900892 CEST	49776	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:39.646929979 CEST	443	49776	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:39.647362947 CEST	49776	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:39.647368908 CEST	443	49776	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:39.738389015 CEST	443	49777	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:39.738459110 CEST	443	49777	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:39.738569021 CEST	49777	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:39.738759995 CEST	49777	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:39.738780022 CEST	443	49777	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:39.740259886 CEST	49777	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:39.740267038 CEST	443	49777	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:39.742269039 CEST	49782	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:39.742309093 CEST	443	49782	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:39.742400885 CEST	443	49776	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:39.742407084 CEST	49782	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:39.742475033 CEST	443	49776	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:39.742522001 CEST	49776	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:39.742542982 CEST	49782	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:39.742552996 CEST	443	49782	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:39.742640972 CEST	49776	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:39.742657900 CEST	443	49776	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:39.742676020 CEST	49776	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:39.742681026 CEST	443	49776	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:39.744810104 CEST	49783	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:39.744848013 CEST	443	49783	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:39.745076895 CEST	49783	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:39.745076895 CEST	49783	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:39.745110989 CEST	443	49783	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:39.749305964 CEST	443	49778	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:39.749809027 CEST	49778	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:39.749818087 CEST	443	49778	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:39.750171900 CEST	49778	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:39.750175953 CEST	443	49778	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:39.850588083 CEST	443	49778	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:39.850657940 CEST	443	49778	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:39.850750923 CEST	49778	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:39.850948095 CEST	49778	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:39.850965977 CEST	443	49778	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:39.851308107 CEST	49778	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:39.851314068 CEST	443	49778	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:39.853964090 CEST	49784	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:39.854012012 CEST	443	49784	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:39.854145050 CEST	49784	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:39.854545116 CEST	49784	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:39.854557991 CEST	443	49784	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:40.009097099 CEST	443	49780	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:40.009798050 CEST	49780	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:40.009814978 CEST	443	49780	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:40.010262012 CEST	49780	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:40.010267019 CEST	443	49780	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:40.271485090 CEST	443	49780	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:40.271590948 CEST	443	49780	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:40.271692038 CEST	49780	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:40.271898985 CEST	49780	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:40.271920919 CEST	443	49780	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:40.271934032 CEST	49780	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:40.271940947 CEST	443	49780	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:40.273196936 CEST	443	49781	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:40.274106979 CEST	49781	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:40.274118900 CEST	443	49781	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:40.274812937 CEST	49781	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:40.274816990 CEST	443	49781	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:40.277005911 CEST	49785	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:40.277044058 CEST	443	49785	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:40.277107000 CEST	49785	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:40.277235031 CEST	49785	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:40.277247906 CEST	443	49785	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:40.374138117 CEST	443	49781	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:40.374216080 CEST	443	49781	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:40.374272108 CEST	49781	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:40.374419928 CEST	49781	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:40.374443054 CEST	443	49781	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:40.374458075 CEST	49781	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:40.374463081 CEST	443	49781	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:40.377202988 CEST	49786	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:40.377243996 CEST	443	49786	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:40.377301931 CEST	49786	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:40.377424955 CEST	49786	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:40.377440929 CEST	443	49786	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:40.450754881 CEST	443	49782	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:40.451246023 CEST	49782	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:40.451288939 CEST	443	49782	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:40.451767921 CEST	49782	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:40.451773882 CEST	443	49782	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:40.452042103 CEST	443	49783	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:40.452321053 CEST	49783	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:40.452349901 CEST	443	49783	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:40.452752113 CEST	49783	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:40.452760935 CEST	443	49783	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:40.462799072 CEST	443	49784	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:40.463402987 CEST	49784	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:40.463418007 CEST	443	49784	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:40.463753939 CEST	49784	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:40.463759899 CEST	443	49784	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:40.548221111 CEST	443	49782	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:40.548309088 CEST	443	49782	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:40.548374891 CEST	49782	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:40.548614025 CEST	49782	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:40.548655033 CEST	443	49782	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:40.548683882 CEST	49782	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:40.548698902 CEST	443	49782	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:40.549032927 CEST	443	49783	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:40.549113035 CEST	443	49783	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:40.549158096 CEST	49783	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:40.549299955 CEST	49783	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:40.549319029 CEST	443	49783	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:40.549335003 CEST	49783	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:40.549340963 CEST	443	49783	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:40.551884890 CEST	49787	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:40.551922083 CEST	443	49787	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:40.551980019 CEST	49788	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:40.552021980 CEST	443	49788	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:40.552073002 CEST	49788	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:40.552207947 CEST	49788	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:40.552218914 CEST	443	49788	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:40.552304983 CEST	49787	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:40.552304983 CEST	49787	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:40.552345037 CEST	443	49787	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:40.557641983 CEST	443	49784	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:40.557709932 CEST	443	49784	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:40.557805061 CEST	49784	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:40.558275938 CEST	49784	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:40.558275938 CEST	49784	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:40.558290958 CEST	443	49784	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:40.558300018 CEST	443	49784	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:40.560456038 CEST	49789	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:40.560483932 CEST	443	49789	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:40.560622931 CEST	49789	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:40.560702085 CEST	49789	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:40.560713053 CEST	443	49789	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:40.901760101 CEST	443	49785	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:40.902230978 CEST	49785	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:40.902256966 CEST	443	49785	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:40.902698994 CEST	49785	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:40.902704000 CEST	443	49785	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:40.985975027 CEST	443	49786	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:40.986464977 CEST	49786	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:40.986486912 CEST	443	49786	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:40.986903906 CEST	49786	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:40.986908913 CEST	443	49786	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.000364065 CEST	443	49785	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.000510931 CEST	443	49785	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.000590086 CEST	49785	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:41.000744104 CEST	49785	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:41.000757933 CEST	443	49785	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.000767946 CEST	49785	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:41.000772953 CEST	443	49785	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.003509045 CEST	49792	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:41.003542900 CEST	443	49792	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.003627062 CEST	49792	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:41.003786087 CEST	49792	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:41.003796101 CEST	443	49792	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.085170984 CEST	443	49786	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.085243940 CEST	443	49786	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.085383892 CEST	49786	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:41.085853100 CEST	49786	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:41.085876942 CEST	443	49786	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.085891008 CEST	49786	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:41.085896015 CEST	443	49786	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.088854074 CEST	49793	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:41.088897943 CEST	443	49793	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.088989973 CEST	49793	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:41.089155912 CEST	49793	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:41.089173079 CEST	443	49793	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.206124067 CEST	443	49787	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.206933022 CEST	49787	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:41.206948042 CEST	443	49787	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.207195997 CEST	443	49789	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.207243919 CEST	49787	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:41.207250118 CEST	443	49787	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.207478046 CEST	49789	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:41.207504034 CEST	443	49789	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.208228111 CEST	49789	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:41.208240986 CEST	443	49789	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.212246895 CEST	443	49788	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.212488890 CEST	49788	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:41.212513924 CEST	443	49788	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.212814093 CEST	49788	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:41.212819099 CEST	443	49788	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.316332102 CEST	443	49787	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.316358089 CEST	443	49787	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.316426992 CEST	49787	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:41.316446066 CEST	443	49787	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.316472054 CEST	443	49787	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.316646099 CEST	49787	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:41.316778898 CEST	49787	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:41.316778898 CEST	49787	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:41.316796064 CEST	443	49787	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.316803932 CEST	443	49787	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.317740917 CEST	443	49789	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.317810059 CEST	443	49789	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.317871094 CEST	49789	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:41.318065882 CEST	49789	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:41.318065882 CEST	49789	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:41.318082094 CEST	443	49789	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.318089962 CEST	443	49789	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.320051908 CEST	443	49788	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.320127964 CEST	49794	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:41.320163012 CEST	443	49794	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.320219040 CEST	49794	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:41.320429087 CEST	443	49788	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.320441008 CEST	49794	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:41.320453882 CEST	443	49794	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.320473909 CEST	49795	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:41.320502996 CEST	49788	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:41.320512056 CEST	443	49795	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.320533991 CEST	49788	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:41.320534945 CEST	49788	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:41.320549011 CEST	443	49788	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.320558071 CEST	443	49788	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.320607901 CEST	49795	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:41.320943117 CEST	49795	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:41.320954084 CEST	443	49795	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.322604895 CEST	49796	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:41.322643042 CEST	443	49796	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.322848082 CEST	49796	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:41.322849035 CEST	49796	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:41.322875977 CEST	443	49796	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.671200991 CEST	443	49792	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.671761990 CEST	49792	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:41.671793938 CEST	443	49792	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.672277927 CEST	49792	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:41.672286987 CEST	443	49792	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.738068104 CEST	443	49793	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.738774061 CEST	49793	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:41.738809109 CEST	443	49793	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.739244938 CEST	49793	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:41.739250898 CEST	443	49793	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.785825968 CEST	443	49792	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.785846949 CEST	443	49792	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.785921097 CEST	443	49792	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.785975933 CEST	49792	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:41.786022902 CEST	49792	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:41.786272049 CEST	49792	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:41.786302090 CEST	443	49792	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.786319017 CEST	49792	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:41.786325932 CEST	443	49792	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.789057970 CEST	49797	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:41.789108038 CEST	443	49797	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.789203882 CEST	49797	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:41.789315939 CEST	49797	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:41.789328098 CEST	443	49797	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.839134932 CEST	443	49793	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.839159966 CEST	443	49793	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.839226961 CEST	443	49793	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.839308977 CEST	49793	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:41.839340925 CEST	49793	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:41.839495897 CEST	49793	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:41.839519024 CEST	443	49793	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.839529037 CEST	49793	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:41.839534998 CEST	443	49793	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.842206955 CEST	49798	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:41.842323065 CEST	443	49798	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.842462063 CEST	49798	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:41.842590094 CEST	49798	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:41.842614889 CEST	443	49798	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.932434082 CEST	443	49795	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.933074951 CEST	49795	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:41.933104038 CEST	443	49795	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.933516026 CEST	49795	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:41.933526993 CEST	443	49795	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.946907043 CEST	443	49796	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.947411060 CEST	49796	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:41.947432995 CEST	443	49796	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.947702885 CEST	49796	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:41.947707891 CEST	443	49796	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.958107948 CEST	443	49794	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.958497047 CEST	49794	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:41.958509922 CEST	443	49794	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:41.958861113 CEST	49794	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:41.958864927 CEST	443	49794	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:42.030380011 CEST	443	49795	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:42.030442953 CEST	443	49795	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:42.030500889 CEST	49795	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:42.030764103 CEST	49795	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:42.030788898 CEST	443	49795	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:42.030801058 CEST	49795	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:42.030808926 CEST	443	49795	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:42.033941031 CEST	49799	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:42.033984900 CEST	443	49799	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:42.034054995 CEST	49799	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:42.034182072 CEST	49799	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:42.034198046 CEST	443	49799	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:42.272985935 CEST	443	49796	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:42.273046970 CEST	443	49796	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:42.273138046 CEST	49796	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:42.273205042 CEST	443	49794	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:42.273272991 CEST	443	49794	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:42.273315907 CEST	49794	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:42.273334980 CEST	443	49794	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:42.273456097 CEST	49796	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:42.273484945 CEST	443	49796	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:42.273499012 CEST	49796	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:42.273505926 CEST	443	49796	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:42.273542881 CEST	49794	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:42.273550034 CEST	443	49794	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:42.273560047 CEST	49794	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:42.273942947 CEST	443	49794	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:42.276427031 CEST	49800	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:42.276463032 CEST	443	49800	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:42.276511908 CEST	49801	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:42.276541948 CEST	443	49801	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:42.276547909 CEST	49800	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:42.276591063 CEST	49801	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:42.276663065 CEST	49800	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:42.276675940 CEST	443	49800	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:42.276782990 CEST	49801	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:42.276793957 CEST	443	49801	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:42.658086061 CEST	443	49797	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:42.659050941 CEST	49797	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:42.659120083 CEST	443	49797	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:42.659424067 CEST	49797	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:42.659440994 CEST	443	49797	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:42.670461893 CEST	443	49798	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:42.670960903 CEST	49798	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:42.670978069 CEST	443	49798	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:42.671361923 CEST	49798	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:42.671374083 CEST	443	49798	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:42.760515928 CEST	443	49797	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:42.760904074 CEST	443	49797	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:42.760981083 CEST	49797	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:42.761059999 CEST	49797	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:42.761107922 CEST	443	49797	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:42.761142969 CEST	49797	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:42.761159897 CEST	443	49797	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:42.764267921 CEST	49802	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:42.764321089 CEST	443	49802	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:42.764391899 CEST	49802	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:42.764630079 CEST	49802	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:42.764641047 CEST	443	49802	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:42.774348974 CEST	443	49798	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:42.774420023 CEST	443	49798	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:42.774490118 CEST	49798	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:42.774713993 CEST	49798	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:42.774725914 CEST	443	49798	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:42.774739027 CEST	49798	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:42.774744034 CEST	443	49798	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:42.778137922 CEST	49803	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:42.778172016 CEST	443	49803	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:42.778279066 CEST	49803	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:42.778435946 CEST	49803	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:42.778450966 CEST	443	49803	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.093467951 CEST	443	49799	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.094434023 CEST	49799	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:43.094469070 CEST	443	49799	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.094892979 CEST	49799	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:43.094899893 CEST	443	49799	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.098294973 CEST	443	49801	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.098613024 CEST	49801	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:43.098638058 CEST	443	49801	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.099070072 CEST	49801	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:43.099076033 CEST	443	49801	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.101521969 CEST	443	49800	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.101831913 CEST	49800	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:43.101851940 CEST	443	49800	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.102245092 CEST	49800	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:43.102251053 CEST	443	49800	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.193732977 CEST	443	49799	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.194705963 CEST	443	49799	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.194858074 CEST	49799	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:43.194858074 CEST	49799	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:43.195202112 CEST	49799	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:43.195221901 CEST	443	49799	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.197717905 CEST	49805	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:43.197755098 CEST	443	49805	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.198024035 CEST	49805	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:43.198024988 CEST	49805	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:43.198055983 CEST	443	49805	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.199013948 CEST	443	49801	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.199079990 CEST	443	49801	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.199130058 CEST	49801	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:43.199280977 CEST	49801	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:43.199280977 CEST	49801	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:43.199296951 CEST	443	49801	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.199306965 CEST	443	49801	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.201354980 CEST	49806	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:43.201392889 CEST	443	49806	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.201493025 CEST	49806	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:43.201633930 CEST	49806	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:43.201646090 CEST	443	49806	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.202507019 CEST	443	49800	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.203257084 CEST	443	49800	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.203332901 CEST	49800	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:43.203392982 CEST	49800	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:43.203411102 CEST	443	49800	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.203425884 CEST	49800	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:43.203432083 CEST	443	49800	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.209892988 CEST	49807	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:43.209933043 CEST	443	49807	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.210089922 CEST	49807	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:43.210237026 CEST	49807	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:43.210248947 CEST	443	49807	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.382445097 CEST	443	49802	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.383266926 CEST	49802	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:43.383292913 CEST	443	49802	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.383724928 CEST	49802	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:43.383733034 CEST	443	49802	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.387964964 CEST	443	49803	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.388329029 CEST	49803	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:43.388350964 CEST	443	49803	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.388724089 CEST	49803	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:43.388730049 CEST	443	49803	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.555565119 CEST	443	49803	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.556854010 CEST	443	49802	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.556916952 CEST	443	49802	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.556989908 CEST	49802	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:43.557070017 CEST	49802	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:43.557084084 CEST	443	49802	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.557095051 CEST	49802	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:43.557101011 CEST	443	49802	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.557140112 CEST	443	49803	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.557249069 CEST	49803	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:43.557249069 CEST	49803	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:43.557288885 CEST	49803	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:43.557305098 CEST	443	49803	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.560215950 CEST	49808	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:43.560228109 CEST	49809	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:43.560262918 CEST	443	49809	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.560307026 CEST	443	49808	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.560359001 CEST	49809	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:43.560384989 CEST	49808	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:43.560523987 CEST	49809	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:43.560534954 CEST	443	49809	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.560534954 CEST	49808	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:43.560573101 CEST	443	49808	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.893089056 CEST	443	49805	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.893604994 CEST	49805	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:43.893625975 CEST	443	49805	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.893645048 CEST	443	49806	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.894136906 CEST	49805	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:43.894145012 CEST	443	49805	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.894417048 CEST	49806	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:43.894421101 CEST	443	49806	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.894726992 CEST	49806	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:43.894731045 CEST	443	49806	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.912163019 CEST	443	49807	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.919410944 CEST	49807	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:43.919441938 CEST	443	49807	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.920289993 CEST	49807	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:43.920296907 CEST	443	49807	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.991842985 CEST	443	49805	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.992042065 CEST	443	49805	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.992162943 CEST	49805	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:43.992162943 CEST	49805	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:43.992194891 CEST	49805	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:43.992213964 CEST	443	49805	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.993444920 CEST	443	49806	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.993825912 CEST	443	49806	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.993865013 CEST	443	49806	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.993923903 CEST	49806	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:43.993923903 CEST	49806	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:43.994080067 CEST	49806	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:43.994080067 CEST	49806	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:43.994086027 CEST	443	49806	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.994095087 CEST	443	49806	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.994852066 CEST	49810	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:43.994884968 CEST	443	49810	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.995014906 CEST	49810	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:43.995307922 CEST	49810	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:43.995321989 CEST	443	49810	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.996294975 CEST	49811	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:43.996330976 CEST	443	49811	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:43.996392012 CEST	49811	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:43.996505022 CEST	49811	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:43.996521950 CEST	443	49811	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:44.016705990 CEST	443	49807	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:44.016871929 CEST	443	49807	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:44.016940117 CEST	49807	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:44.017055988 CEST	49807	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:44.017071962 CEST	443	49807	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:44.017081976 CEST	49807	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:44.017087936 CEST	443	49807	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:44.019750118 CEST	49813	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:44.019793034 CEST	443	49813	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:44.019896030 CEST	49813	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:44.020030975 CEST	49813	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:44.020045042 CEST	443	49813	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:44.202332020 CEST	443	49809	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:44.202915907 CEST	49809	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:44.202934027 CEST	443	49809	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:44.203368902 CEST	49809	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:44.203376055 CEST	443	49809	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:44.204658985 CEST	443	49808	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:44.205044031 CEST	49808	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:44.205111980 CEST	443	49808	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:44.205413103 CEST	49808	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:44.205427885 CEST	443	49808	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:44.305450916 CEST	443	49809	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:44.305641890 CEST	443	49809	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:44.305761099 CEST	49809	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:44.305774927 CEST	443	49809	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:44.305819035 CEST	443	49809	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:44.305870056 CEST	49809	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:44.305952072 CEST	49809	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:44.305973053 CEST	443	49809	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:44.305988073 CEST	49809	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:44.305994034 CEST	443	49809	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:44.308286905 CEST	443	49808	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:44.308366060 CEST	443	49808	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:44.308548927 CEST	49808	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:44.308762074 CEST	49808	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:44.308762074 CEST	49808	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:44.308815002 CEST	443	49808	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:44.308845997 CEST	443	49808	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:44.309046030 CEST	49815	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:44.309086084 CEST	443	49815	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:44.309182882 CEST	49815	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:44.309456110 CEST	49815	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:44.309472084 CEST	443	49815	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:44.311568022 CEST	49816	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:44.311626911 CEST	443	49816	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:44.311692953 CEST	49816	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:44.311799049 CEST	49816	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:44.311815977 CEST	443	49816	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:44.617507935 CEST	443	49811	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:44.618001938 CEST	49811	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:44.618061066 CEST	443	49811	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:44.618486881 CEST	49811	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:44.618496895 CEST	443	49811	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:44.640235901 CEST	443	49810	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:44.640707016 CEST	49810	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:44.640754938 CEST	443	49810	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:44.641232967 CEST	49810	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:44.641246080 CEST	443	49810	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:44.651057005 CEST	443	49813	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:44.651503086 CEST	49813	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:44.651525021 CEST	443	49813	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:44.651952028 CEST	49813	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:44.651962042 CEST	443	49813	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:44.731313944 CEST	443	49811	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:44.731867075 CEST	443	49811	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:44.731967926 CEST	49811	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:44.732047081 CEST	49811	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:44.732068062 CEST	443	49811	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:44.732094049 CEST	49811	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:44.732101917 CEST	443	49811	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:44.734947920 CEST	49817	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:44.734988928 CEST	443	49817	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:44.735059977 CEST	49817	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:44.735265970 CEST	49817	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:44.735281944 CEST	443	49817	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:44.739516973 CEST	443	49810	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:44.739659071 CEST	443	49810	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:44.739725113 CEST	49810	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:44.739778042 CEST	49810	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:44.739799023 CEST	443	49810	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:44.739810944 CEST	49810	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:44.739818096 CEST	443	49810	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:44.742223024 CEST	49818	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:44.742237091 CEST	443	49818	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:44.742305994 CEST	49818	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:44.742583036 CEST	49818	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:44.742598057 CEST	443	49818	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:44.748399019 CEST	443	49813	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:44.748435974 CEST	443	49813	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:44.748492002 CEST	49813	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:44.748496056 CEST	443	49813	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:44.748631954 CEST	49813	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:44.748729944 CEST	49813	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:44.748748064 CEST	443	49813	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:44.748760939 CEST	49813	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:44.748765945 CEST	443	49813	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:44.751369953 CEST	49819	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:44.751422882 CEST	443	49819	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:44.751488924 CEST	49819	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:44.751637936 CEST	49819	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:44.751652956 CEST	443	49819	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:44.926490068 CEST	443	49815	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:44.928162098 CEST	49815	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:44.928177118 CEST	443	49815	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:44.928649902 CEST	49815	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:44.928657055 CEST	443	49815	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:44.953746080 CEST	443	49816	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:44.954741955 CEST	49816	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:44.954771042 CEST	443	49816	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:44.955203056 CEST	49816	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:44.955209017 CEST	443	49816	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:45.000679970 CEST	49676	443	192.168.2.11	20.189.173.3
Oct 8, 2024 00:41:45.027674913 CEST	443	49815	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:45.027846098 CEST	443	49815	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:45.027965069 CEST	49815	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:45.027997971 CEST	49815	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:45.028016090 CEST	443	49815	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:45.028028965 CEST	49815	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:45.028036118 CEST	443	49815	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:45.030956984 CEST	49820	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:45.031018972 CEST	443	49820	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:45.031095982 CEST	49820	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:45.031232119 CEST	49820	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:45.031244040 CEST	443	49820	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:45.057145119 CEST	443	49816	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:45.057821989 CEST	443	49816	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:45.058192015 CEST	49816	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:45.058237076 CEST	49816	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:45.058262110 CEST	443	49816	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:45.058276892 CEST	49816	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:45.058283091 CEST	443	49816	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:45.060745955 CEST	49821	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:45.060780048 CEST	443	49821	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:45.060870886 CEST	49821	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:45.061032057 CEST	49821	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:45.061047077 CEST	443	49821	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:45.355154037 CEST	443	49817	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:45.355865955 CEST	49817	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:45.355896950 CEST	443	49817	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:45.356642962 CEST	49817	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:45.356654882 CEST	443	49817	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:45.385081053 CEST	443	49818	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:45.385706902 CEST	49818	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:45.385730982 CEST	443	49818	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:45.386204958 CEST	49818	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:45.386212111 CEST	443	49818	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:45.398269892 CEST	443	49819	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:45.398878098 CEST	49819	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:45.398921013 CEST	443	49819	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:45.399331093 CEST	49819	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:45.399348021 CEST	443	49819	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:45.453953981 CEST	443	49817	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:45.454036951 CEST	443	49817	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:45.454231024 CEST	49817	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:45.454268932 CEST	49817	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:45.454284906 CEST	443	49817	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:45.457330942 CEST	49823	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:45.457381964 CEST	443	49823	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:45.457468987 CEST	49823	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:45.457638979 CEST	49823	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:45.457645893 CEST	443	49823	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:45.482355118 CEST	443	49818	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:45.482590914 CEST	443	49818	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:45.482645988 CEST	443	49818	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:45.482692957 CEST	49818	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:45.482763052 CEST	49818	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:45.482779026 CEST	443	49818	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:45.482789993 CEST	49818	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:45.482795954 CEST	443	49818	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:45.485625029 CEST	49824	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:45.485697985 CEST	443	49824	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:45.485769987 CEST	49824	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:45.485899925 CEST	49824	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:45.485914946 CEST	443	49824	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:45.494184017 CEST	443	49819	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:45.494472980 CEST	443	49819	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:45.494537115 CEST	49819	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:45.494580984 CEST	49819	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:45.494602919 CEST	443	49819	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:45.494615078 CEST	49819	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:45.494620085 CEST	443	49819	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:45.498136997 CEST	49825	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:45.498172998 CEST	443	49825	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:45.498264074 CEST	49825	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:45.498621941 CEST	49825	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:45.498631954 CEST	443	49825	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:45.682681084 CEST	443	49820	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:45.683207989 CEST	49820	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:45.683254004 CEST	443	49820	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:45.683667898 CEST	49820	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:45.683675051 CEST	443	49820	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:45.726941109 CEST	443	49821	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:45.727613926 CEST	49821	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:45.727629900 CEST	443	49821	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:45.727953911 CEST	49821	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:45.727960110 CEST	443	49821	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:45.781419039 CEST	443	49820	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:45.781450033 CEST	443	49820	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:45.781493902 CEST	443	49820	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:45.781593084 CEST	49820	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:45.781593084 CEST	49820	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:45.781950951 CEST	49820	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:45.781980991 CEST	443	49820	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:45.782000065 CEST	49820	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:45.782007933 CEST	443	49820	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:45.784883976 CEST	49826	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:45.784924030 CEST	443	49826	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:45.784996033 CEST	49826	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:45.785193920 CEST	49826	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:45.785213947 CEST	443	49826	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:45.828799009 CEST	443	49821	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:45.829463959 CEST	443	49821	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:45.831568956 CEST	49821	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:45.831569910 CEST	49821	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:45.831569910 CEST	49821	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:45.834363937 CEST	49827	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:45.834402084 CEST	443	49827	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:45.834511042 CEST	49827	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:45.834697962 CEST	49827	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:45.834708929 CEST	443	49827	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.077524900 CEST	443	49823	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.078174114 CEST	49823	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:46.078201056 CEST	443	49823	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.078654051 CEST	49823	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:46.078660965 CEST	443	49823	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.103303909 CEST	443	49824	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.103796005 CEST	49824	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:46.103827953 CEST	443	49824	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.104259014 CEST	49824	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:46.104264021 CEST	443	49824	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.117655993 CEST	443	49825	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.118357897 CEST	49825	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:46.118357897 CEST	49825	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:46.118371010 CEST	443	49825	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.118388891 CEST	443	49825	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.141798019 CEST	49821	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:46.141820908 CEST	443	49821	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.177819967 CEST	443	49823	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.177905083 CEST	443	49823	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.178086042 CEST	49823	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:46.178121090 CEST	49823	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:46.178142071 CEST	443	49823	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.178153038 CEST	49823	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:46.178158998 CEST	443	49823	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.181224108 CEST	49828	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:46.181268930 CEST	443	49828	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.181337118 CEST	49828	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:46.181554079 CEST	49828	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:46.181566954 CEST	443	49828	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.216938972 CEST	443	49824	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.217016935 CEST	443	49824	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.217089891 CEST	49824	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:46.217246056 CEST	49824	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:46.217267990 CEST	443	49824	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.217281103 CEST	49824	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:46.217287064 CEST	443	49824	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.220318079 CEST	49829	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:46.220360041 CEST	443	49829	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.220428944 CEST	49829	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:46.220571995 CEST	49829	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:46.220580101 CEST	443	49829	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.220587969 CEST	443	49825	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.220614910 CEST	443	49825	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.220658064 CEST	443	49825	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.220691919 CEST	49825	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:46.220788002 CEST	49825	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:46.220854044 CEST	49825	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:46.220874071 CEST	443	49825	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.221271992 CEST	49825	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:46.221277952 CEST	443	49825	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.223169088 CEST	49830	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:46.223180056 CEST	443	49830	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.223253965 CEST	49830	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:46.224041939 CEST	49830	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:46.224051952 CEST	443	49830	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.519908905 CEST	443	49827	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.520525932 CEST	49827	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:46.520541906 CEST	443	49827	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.521105051 CEST	49827	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:46.521111965 CEST	443	49827	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.521718025 CEST	443	49826	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.522201061 CEST	49826	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:46.522217035 CEST	443	49826	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.522608042 CEST	49826	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:46.522619963 CEST	443	49826	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.627667904 CEST	443	49827	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.627744913 CEST	443	49827	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.627971888 CEST	49827	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:46.628362894 CEST	49827	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:46.628382921 CEST	443	49827	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.628393888 CEST	49827	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:46.628400087 CEST	443	49827	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.628479004 CEST	443	49826	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.628582954 CEST	443	49826	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.628689051 CEST	49826	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:46.629065990 CEST	49826	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:46.629089117 CEST	443	49826	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.629185915 CEST	49826	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:46.629194975 CEST	443	49826	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.631604910 CEST	49831	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:46.631653070 CEST	443	49831	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.631741047 CEST	49831	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:46.631865978 CEST	49831	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:46.631885052 CEST	443	49831	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.632366896 CEST	49832	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:46.632406950 CEST	443	49832	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.632685900 CEST	49832	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:46.632790089 CEST	49832	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:46.632797956 CEST	443	49832	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.860331059 CEST	443	49829	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.860825062 CEST	49829	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:46.860846043 CEST	443	49829	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.861417055 CEST	49829	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:46.861422062 CEST	443	49829	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.886948109 CEST	443	49828	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.887465000 CEST	49828	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:46.887504101 CEST	443	49828	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.887993097 CEST	49828	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:46.888010979 CEST	443	49828	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.893290997 CEST	443	49830	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.893728018 CEST	49830	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:46.893749952 CEST	443	49830	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.894165993 CEST	49830	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:46.894170046 CEST	443	49830	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.960272074 CEST	443	49829	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.960297108 CEST	443	49829	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.960351944 CEST	443	49829	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.960366964 CEST	49829	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:46.960403919 CEST	49829	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:46.960630894 CEST	49829	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:46.960647106 CEST	443	49829	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.960666895 CEST	49829	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:46.960671902 CEST	443	49829	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.963619947 CEST	49833	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:46.963675022 CEST	443	49833	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.963758945 CEST	49833	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:46.963937044 CEST	49833	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:46.963954926 CEST	443	49833	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.991631031 CEST	443	49828	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.992400885 CEST	443	49828	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.992480993 CEST	49828	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:46.992527008 CEST	49828	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:46.992548943 CEST	443	49828	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.992562056 CEST	49828	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:46.992568016 CEST	443	49828	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.997518063 CEST	49834	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:46.997556925 CEST	443	49834	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.997817039 CEST	49834	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:46.998009920 CEST	49834	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:46.998028994 CEST	443	49834	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.999829054 CEST	443	49830	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:46.999919891 CEST	443	49830	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:47.000066996 CEST	49830	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:47.000271082 CEST	49830	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:47.000289917 CEST	443	49830	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:47.000294924 CEST	49830	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:47.000299931 CEST	443	49830	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:47.003309011 CEST	49835	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:47.003344059 CEST	443	49835	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:47.003437042 CEST	49835	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:47.003612041 CEST	49835	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:47.003624916 CEST	443	49835	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:48.226062059 CEST	443	49832	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:48.226686001 CEST	49832	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:48.226703882 CEST	443	49832	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:48.227142096 CEST	49832	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:48.227152109 CEST	443	49832	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:48.230761051 CEST	443	49831	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:48.232448101 CEST	49831	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:48.232475996 CEST	443	49831	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:48.232800961 CEST	49831	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:48.232808113 CEST	443	49831	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:48.325860023 CEST	443	49832	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:48.325943947 CEST	443	49832	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:48.326231003 CEST	49832	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:48.326272011 CEST	49832	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:48.326296091 CEST	443	49832	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:48.326313972 CEST	49832	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:48.326319933 CEST	443	49832	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:48.328164101 CEST	443	49831	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:48.328268051 CEST	443	49831	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:48.329229116 CEST	49831	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:48.329344988 CEST	49831	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:48.329365969 CEST	443	49831	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:48.329376936 CEST	49831	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:48.329387903 CEST	443	49831	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:48.330054045 CEST	49836	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:48.330140114 CEST	443	49836	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:48.330271959 CEST	49836	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:48.330459118 CEST	49836	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:48.330493927 CEST	443	49836	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:48.331762075 CEST	49837	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:48.331810951 CEST	443	49837	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:48.331898928 CEST	49837	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:48.332009077 CEST	49837	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:48.332026005 CEST	443	49837	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:48.399821997 CEST	443	49835	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:48.400470018 CEST	49835	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:48.400486946 CEST	443	49835	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:48.400999069 CEST	49835	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:48.401002884 CEST	443	49835	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:48.402157068 CEST	443	49833	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:48.402401924 CEST	443	49834	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:48.402535915 CEST	49833	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:48.402549982 CEST	443	49833	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:48.403009892 CEST	49833	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:48.403016090 CEST	443	49833	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:48.406725883 CEST	49834	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:48.406733036 CEST	443	49834	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:48.407181025 CEST	49834	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:48.407185078 CEST	443	49834	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:48.495758057 CEST	443	49835	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:48.496169090 CEST	443	49835	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:48.496231079 CEST	49835	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:48.496360064 CEST	49835	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:48.496376991 CEST	443	49835	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:48.496387005 CEST	49835	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:48.496393919 CEST	443	49835	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:48.497729063 CEST	443	49833	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:48.497756004 CEST	443	49833	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:48.497806072 CEST	443	49833	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:48.497839928 CEST	49833	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:48.497879982 CEST	49833	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:48.498080969 CEST	49833	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:48.498080969 CEST	49833	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:48.498097897 CEST	443	49833	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:48.498106956 CEST	443	49833	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:48.499409914 CEST	49838	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:48.499449968 CEST	443	49838	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:48.499660969 CEST	49838	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:48.499788046 CEST	49838	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:48.499803066 CEST	443	49838	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:48.500077963 CEST	49839	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:48.500129938 CEST	443	49839	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:48.500194073 CEST	49839	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:48.500292063 CEST	49839	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:48.500305891 CEST	443	49839	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:48.501149893 CEST	443	49834	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:48.501209021 CEST	443	49834	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:48.501348019 CEST	49834	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:48.501374006 CEST	49834	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:48.501374006 CEST	49834	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:48.501382113 CEST	443	49834	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:48.501389027 CEST	443	49834	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:48.503313065 CEST	49840	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:48.503349066 CEST	443	49840	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:48.503442049 CEST	49840	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:48.503554106 CEST	49840	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:48.503567934 CEST	443	49840	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.069063902 CEST	443	49837	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.069080114 CEST	443	49836	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.074433088 CEST	49837	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:49.074448109 CEST	443	49837	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.074889898 CEST	49837	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:49.074896097 CEST	443	49837	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.075211048 CEST	49836	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:49.075249910 CEST	443	49836	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.075635910 CEST	49836	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:49.075644016 CEST	443	49836	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.165647030 CEST	443	49837	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.165756941 CEST	443	49837	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.165813923 CEST	443	49837	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.165884018 CEST	49837	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:49.165982008 CEST	49837	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:49.166003942 CEST	443	49837	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.166014910 CEST	49837	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:49.166021109 CEST	443	49837	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.167265892 CEST	443	49836	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.167673111 CEST	443	49836	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.167767048 CEST	49836	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:49.167917013 CEST	49836	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:49.167957067 CEST	443	49836	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.167988062 CEST	49836	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:49.168004036 CEST	443	49836	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.169022083 CEST	49841	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:49.169071913 CEST	443	49841	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.169904947 CEST	49842	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:49.169912100 CEST	443	49842	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.169958115 CEST	49841	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:49.169996023 CEST	49842	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:49.170134068 CEST	49842	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:49.170134068 CEST	49841	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:49.170155048 CEST	443	49842	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.170170069 CEST	443	49841	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.400816917 CEST	443	49839	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.401369095 CEST	443	49840	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.403247118 CEST	443	49838	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.417490959 CEST	49839	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:49.417526960 CEST	443	49839	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.418003082 CEST	49839	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:49.418020010 CEST	443	49839	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.418236971 CEST	49840	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:49.418263912 CEST	443	49840	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.418597937 CEST	49840	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:49.418606997 CEST	443	49840	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.418845892 CEST	49838	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:49.418867111 CEST	443	49838	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.419290066 CEST	49838	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:49.419296026 CEST	443	49838	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.509654999 CEST	443	49839	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.509701014 CEST	443	49839	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.509751081 CEST	443	49839	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.509768009 CEST	49839	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:49.509814978 CEST	49839	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:49.510052919 CEST	49839	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:49.510082960 CEST	443	49839	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.510102034 CEST	49839	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:49.510109901 CEST	443	49839	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.510384083 CEST	443	49838	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.510448933 CEST	443	49838	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.510500908 CEST	49838	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:49.510694027 CEST	49838	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:49.510718107 CEST	443	49838	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.510730028 CEST	49838	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:49.510735989 CEST	443	49838	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.513293982 CEST	49843	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:49.513340950 CEST	443	49843	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.513351917 CEST	49844	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:49.513377905 CEST	443	49844	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.513402939 CEST	49843	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:49.513442039 CEST	49844	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:49.513534069 CEST	49843	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:49.513545990 CEST	443	49843	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.513793945 CEST	49844	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:49.513806105 CEST	443	49844	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.514913082 CEST	443	49840	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.514988899 CEST	443	49840	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.515084982 CEST	49840	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:49.515137911 CEST	49840	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:49.515150070 CEST	443	49840	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.515162945 CEST	49840	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:49.515175104 CEST	443	49840	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.517544985 CEST	49845	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:49.517590046 CEST	443	49845	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.517654896 CEST	49845	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:49.517791033 CEST	49845	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:49.517803907 CEST	443	49845	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.783094883 CEST	443	49842	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.783648968 CEST	49842	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:49.783674955 CEST	443	49842	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.784132957 CEST	49842	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:49.784138918 CEST	443	49842	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.799520016 CEST	443	49841	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.800091982 CEST	49841	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:49.800117016 CEST	443	49841	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.800549030 CEST	49841	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:49.800554037 CEST	443	49841	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.877619028 CEST	443	49842	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.877847910 CEST	443	49842	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.877974987 CEST	49842	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:49.878015995 CEST	49842	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:49.878034115 CEST	443	49842	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.878046989 CEST	49842	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:49.878053904 CEST	443	49842	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.881159067 CEST	49846	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:49.881192923 CEST	443	49846	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.881283045 CEST	49846	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:49.881469965 CEST	49846	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:49.881480932 CEST	443	49846	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.893388033 CEST	443	49841	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.893512964 CEST	443	49841	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.893565893 CEST	443	49841	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.893583059 CEST	49841	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:49.893619061 CEST	49841	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:49.893666983 CEST	49841	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:49.893687010 CEST	443	49841	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.893698931 CEST	49841	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:49.893704891 CEST	443	49841	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.896297932 CEST	49847	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:49.896346092 CEST	443	49847	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:49.896548033 CEST	49847	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:49.896548033 CEST	49847	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:49.896579027 CEST	443	49847	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.132469893 CEST	443	49843	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.133013964 CEST	49843	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.133030891 CEST	443	49843	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.133487940 CEST	49843	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.133491993 CEST	443	49843	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.135015965 CEST	443	49845	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.135371923 CEST	49845	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.135401011 CEST	443	49845	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.135797024 CEST	49845	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.135802984 CEST	443	49845	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.158622980 CEST	443	49844	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.159173965 CEST	49844	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.159188986 CEST	443	49844	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.159461021 CEST	49844	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.159477949 CEST	443	49844	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.271275997 CEST	443	49845	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.271311998 CEST	443	49845	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.271354914 CEST	443	49845	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.271361113 CEST	49845	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.271405935 CEST	49845	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.271544933 CEST	443	49843	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.271569967 CEST	443	49843	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.271614075 CEST	49843	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.271620035 CEST	443	49843	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.271640062 CEST	49845	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.271655083 CEST	443	49845	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.271662951 CEST	49843	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.271693945 CEST	49845	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.271701097 CEST	443	49845	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.272391081 CEST	443	49844	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.272453070 CEST	443	49844	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.272507906 CEST	49844	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.272605896 CEST	49843	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.272620916 CEST	443	49843	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.272631884 CEST	49843	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.272638083 CEST	443	49843	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.273879051 CEST	49844	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.273896933 CEST	443	49844	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.273916960 CEST	49844	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.273922920 CEST	443	49844	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.276438951 CEST	49848	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.276473045 CEST	443	49848	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.276536942 CEST	49848	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.276669979 CEST	49849	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.276762962 CEST	443	49849	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.276839972 CEST	49849	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.276915073 CEST	49848	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.276931047 CEST	443	49848	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.277024984 CEST	49849	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.277060986 CEST	443	49849	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.277339935 CEST	49850	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.277364969 CEST	443	49850	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.277427912 CEST	49850	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.277554989 CEST	49850	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.277581930 CEST	443	49850	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.533960104 CEST	443	49846	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.533967972 CEST	443	49847	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.534574986 CEST	49847	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.534580946 CEST	49846	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.534590006 CEST	443	49847	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.534600019 CEST	443	49846	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.535080910 CEST	49846	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.535089016 CEST	443	49846	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.535171986 CEST	49847	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.535191059 CEST	443	49847	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.628711939 CEST	443	49847	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.628711939 CEST	443	49846	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.629010916 CEST	443	49847	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.629112005 CEST	49847	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.629153967 CEST	49847	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.629167080 CEST	443	49847	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.629180908 CEST	49847	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.629188061 CEST	443	49847	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.629616976 CEST	443	49846	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.629678965 CEST	49846	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.629703999 CEST	49846	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.629719019 CEST	443	49846	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.629729033 CEST	49846	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.629734993 CEST	443	49846	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.632042885 CEST	49851	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.632066011 CEST	49852	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.632078886 CEST	443	49851	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.632091999 CEST	443	49852	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.632143021 CEST	49851	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.632173061 CEST	49852	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.632312059 CEST	49852	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.632313013 CEST	49851	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.632323980 CEST	443	49852	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.632325888 CEST	443	49851	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.886321068 CEST	443	49849	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.886787891 CEST	49849	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.886854887 CEST	443	49849	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.887239933 CEST	49849	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.887255907 CEST	443	49849	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.895844936 CEST	443	49850	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.896281958 CEST	49850	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.896297932 CEST	443	49850	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.896645069 CEST	49850	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.896656990 CEST	443	49850	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.897707939 CEST	443	49848	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.897945881 CEST	49848	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.897963047 CEST	443	49848	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.898273945 CEST	49848	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.898278952 CEST	443	49848	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.985891104 CEST	443	49849	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.986033916 CEST	443	49849	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.986109018 CEST	49849	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.986202002 CEST	49849	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.986236095 CEST	443	49849	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.986258984 CEST	49849	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.986267090 CEST	443	49849	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.989305973 CEST	49853	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.989341974 CEST	443	49853	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.989448071 CEST	49853	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.989613056 CEST	49853	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.989624977 CEST	443	49853	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.992454052 CEST	443	49850	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.992924929 CEST	443	49850	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.992974043 CEST	443	49850	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.992991924 CEST	49850	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.993066072 CEST	49850	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.993127108 CEST	49850	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.993127108 CEST	49850	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.993143082 CEST	443	49850	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.993154049 CEST	443	49850	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.994319916 CEST	443	49848	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.995320082 CEST	49854	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.995332003 CEST	443	49854	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.995397091 CEST	49854	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.995517015 CEST	49854	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.995527029 CEST	443	49854	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.997237921 CEST	443	49848	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.997296095 CEST	49848	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.997322083 CEST	49848	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.997343063 CEST	443	49848	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.997356892 CEST	49848	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.997363091 CEST	443	49848	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.999397039 CEST	49855	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.999433994 CEST	443	49855	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:50.999512911 CEST	49855	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.999639988 CEST	49855	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:50.999653101 CEST	443	49855	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:51.237168074 CEST	443	49852	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:51.237766027 CEST	49852	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:51.237781048 CEST	443	49852	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:51.238213062 CEST	49852	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:51.238217115 CEST	443	49852	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:51.331684113 CEST	443	49852	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:51.332014084 CEST	443	49852	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:51.332065105 CEST	443	49852	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:51.332067966 CEST	49852	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:51.332104921 CEST	49852	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:51.332164049 CEST	49852	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:51.332178116 CEST	443	49852	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:51.332190037 CEST	49852	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:51.332196951 CEST	443	49852	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:51.335020065 CEST	49856	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:51.335056067 CEST	443	49856	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:51.335128069 CEST	49856	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:51.335275888 CEST	49856	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:51.335287094 CEST	443	49856	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:51.615642071 CEST	443	49855	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:51.615654945 CEST	443	49853	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:51.616400957 CEST	49853	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:51.616427898 CEST	443	49853	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:51.616499901 CEST	49855	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:51.616528988 CEST	443	49855	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:51.616838932 CEST	49853	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:51.616852045 CEST	443	49853	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:51.616904020 CEST	49855	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:51.616910934 CEST	443	49855	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:51.623363018 CEST	443	49854	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:51.624207020 CEST	49854	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:51.624207020 CEST	49854	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:51.624228954 CEST	443	49854	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:51.624238968 CEST	443	49854	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:51.789624929 CEST	443	49853	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:51.789670944 CEST	443	49855	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:51.790246964 CEST	443	49855	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:51.790256977 CEST	443	49853	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:51.790343046 CEST	49855	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:51.790358067 CEST	443	49855	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:51.790389061 CEST	443	49855	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:51.790412903 CEST	49853	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:51.790448904 CEST	49853	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:51.790457964 CEST	49855	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:51.790465117 CEST	443	49853	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:51.790478945 CEST	443	49855	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:51.790481091 CEST	49853	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:51.790487051 CEST	443	49853	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:51.790491104 CEST	49855	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:51.790498972 CEST	443	49855	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:51.790507078 CEST	49855	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:51.790509939 CEST	443	49855	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:51.791038990 CEST	443	49854	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:51.791467905 CEST	443	49854	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:51.791533947 CEST	49854	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:51.791637897 CEST	49854	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:51.791637897 CEST	49854	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:51.791647911 CEST	443	49854	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:51.791663885 CEST	443	49854	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:51.793756962 CEST	49857	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:51.793827057 CEST	443	49857	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:51.793848038 CEST	49858	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:51.793863058 CEST	443	49858	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:51.793908119 CEST	49857	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:51.793946981 CEST	49858	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:51.794075012 CEST	49857	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:51.794099092 CEST	443	49857	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:51.794173956 CEST	49858	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:51.794194937 CEST	443	49858	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:51.794612885 CEST	49859	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:51.794648886 CEST	443	49859	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:51.794707060 CEST	49859	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:51.794795990 CEST	49859	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:51.794805050 CEST	443	49859	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:52.054936886 CEST	443	49856	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:52.055589914 CEST	49856	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:52.055604935 CEST	443	49856	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:52.056147099 CEST	49856	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:52.056152105 CEST	443	49856	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:52.149525881 CEST	443	49856	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:52.149931908 CEST	443	49856	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:52.150032043 CEST	49856	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:52.150084972 CEST	49856	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:52.150101900 CEST	443	49856	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:52.150115967 CEST	49856	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:52.150121927 CEST	443	49856	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:52.153933048 CEST	49860	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:52.153984070 CEST	443	49860	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:52.154134989 CEST	49860	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:52.154417038 CEST	49860	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:52.154428959 CEST	443	49860	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:52.400588989 CEST	443	49858	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:52.401252985 CEST	49858	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:52.401278973 CEST	443	49858	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:52.401712894 CEST	49858	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:52.401721001 CEST	443	49858	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:52.405934095 CEST	443	49859	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:52.406305075 CEST	49859	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:52.406313896 CEST	443	49859	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:52.406702042 CEST	49859	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:52.406706095 CEST	443	49859	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:52.468050957 CEST	443	49857	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:52.468545914 CEST	49857	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:52.468559980 CEST	443	49857	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:52.469007969 CEST	49857	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:52.469017029 CEST	443	49857	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:52.501719952 CEST	443	49858	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:52.501751900 CEST	443	49858	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:52.501795053 CEST	443	49858	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:52.501869917 CEST	49858	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:52.501905918 CEST	49858	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:52.502130985 CEST	49858	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:52.502159119 CEST	443	49858	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:52.502172947 CEST	49858	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:52.502180099 CEST	443	49858	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:52.506591082 CEST	443	49859	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:52.506655931 CEST	443	49859	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:52.506732941 CEST	49859	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:52.511837006 CEST	49859	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:52.511861086 CEST	443	49859	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:52.511872053 CEST	49859	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:52.511878014 CEST	443	49859	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:52.513936043 CEST	49861	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:52.513979912 CEST	443	49861	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:52.514034033 CEST	49861	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:52.514293909 CEST	49861	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:52.514293909 CEST	49862	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:52.514311075 CEST	443	49861	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:52.514322996 CEST	443	49862	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:52.514385939 CEST	49862	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:52.514512062 CEST	49862	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:52.514523029 CEST	443	49862	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:52.574184895 CEST	443	49857	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:52.574376106 CEST	443	49857	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:52.574471951 CEST	49857	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:52.574527979 CEST	49857	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:52.574551105 CEST	443	49857	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:52.574565887 CEST	49857	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:52.574573994 CEST	443	49857	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:52.577158928 CEST	49863	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:52.577200890 CEST	443	49863	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:52.577272892 CEST	49863	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:52.577419043 CEST	49863	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:52.577430964 CEST	443	49863	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:52.765788078 CEST	443	49860	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:52.766387939 CEST	49860	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:52.766401052 CEST	443	49860	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:52.766952038 CEST	49860	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:52.766956091 CEST	443	49860	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:52.864865065 CEST	443	49860	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:52.865011930 CEST	443	49860	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:52.865132093 CEST	49860	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:52.870707035 CEST	49860	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:52.870723963 CEST	443	49860	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:52.870734930 CEST	49860	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:52.870740891 CEST	443	49860	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:52.873857975 CEST	49864	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:52.873908997 CEST	443	49864	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:52.874006033 CEST	49864	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:52.874233961 CEST	49864	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:52.874253035 CEST	443	49864	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:53.140996933 CEST	443	49862	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:53.141891956 CEST	49862	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:53.141922951 CEST	443	49862	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:53.142287016 CEST	49862	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:53.142294884 CEST	443	49862	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:53.144975901 CEST	443	49851	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:53.145334005 CEST	49851	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:53.145374060 CEST	443	49851	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:53.145718098 CEST	49851	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:53.145724058 CEST	443	49851	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:53.153760910 CEST	443	49861	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:53.154038906 CEST	49861	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:53.154048920 CEST	443	49861	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:53.154362917 CEST	49861	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:53.154367924 CEST	443	49861	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:53.191457987 CEST	443	49863	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:53.191915035 CEST	49863	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:53.191931009 CEST	443	49863	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:53.192343950 CEST	49863	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:53.192348003 CEST	443	49863	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:53.243207932 CEST	443	49862	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:53.243515968 CEST	443	49862	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:53.243566036 CEST	49862	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:53.243607998 CEST	49862	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:53.243624926 CEST	443	49862	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:53.243633986 CEST	49862	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:53.243638992 CEST	443	49862	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:53.246001959 CEST	49865	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:53.246061087 CEST	443	49865	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:53.246134043 CEST	49865	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:53.246417999 CEST	49865	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:53.246433020 CEST	443	49865	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:53.277800083 CEST	443	49861	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:53.277873993 CEST	443	49861	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:53.277924061 CEST	49861	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:53.278094053 CEST	49861	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:53.278100967 CEST	443	49861	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:53.278110027 CEST	49861	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:53.278114080 CEST	443	49861	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:53.280169964 CEST	443	49851	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:53.280241966 CEST	443	49851	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:53.280303001 CEST	49851	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:53.280359983 CEST	49851	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:53.280380964 CEST	443	49851	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:53.280392885 CEST	49851	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:53.280399084 CEST	443	49851	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:53.280694008 CEST	49866	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:53.280709982 CEST	443	49866	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:53.280764103 CEST	49866	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:53.281069040 CEST	49866	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:53.281078100 CEST	443	49866	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:53.282555103 CEST	49867	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:53.282593966 CEST	443	49867	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:53.282645941 CEST	49867	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:53.282751083 CEST	49867	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:53.282764912 CEST	443	49867	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:53.291949034 CEST	443	49863	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:53.292006969 CEST	443	49863	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:53.292059898 CEST	49863	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:53.292115927 CEST	49863	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:53.292134047 CEST	443	49863	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:53.292145014 CEST	49863	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:53.292150021 CEST	443	49863	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:53.293931007 CEST	49868	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:53.293963909 CEST	443	49868	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:53.294089079 CEST	49868	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:53.294158936 CEST	49868	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:53.294173956 CEST	443	49868	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:53.493479967 CEST	443	49864	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:53.493978024 CEST	49864	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:53.494005919 CEST	443	49864	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:53.494563103 CEST	49864	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:53.494568110 CEST	443	49864	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:53.589821100 CEST	443	49864	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:53.590356112 CEST	443	49864	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:53.590426922 CEST	49864	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:53.590476990 CEST	49864	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:53.590497017 CEST	443	49864	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:53.590516090 CEST	49864	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:53.590522051 CEST	443	49864	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:53.592977047 CEST	49869	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:53.593014956 CEST	443	49869	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:53.593095064 CEST	49869	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:53.593223095 CEST	49869	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:53.593230963 CEST	443	49869	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:53.871196032 CEST	443	49865	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:53.871685982 CEST	49865	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:53.871717930 CEST	443	49865	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:53.872157097 CEST	49865	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:53.872164965 CEST	443	49865	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:54.139291048 CEST	443	49866	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:54.139544964 CEST	443	49868	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:54.139837980 CEST	49866	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:54.139870882 CEST	443	49866	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:54.140041113 CEST	443	49867	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:54.140361071 CEST	49866	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:54.140369892 CEST	443	49866	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:54.141177893 CEST	49867	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:54.141217947 CEST	443	49867	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:54.141475916 CEST	49868	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:54.141477108 CEST	49868	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:54.141498089 CEST	443	49868	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:54.141509056 CEST	443	49868	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:54.141719103 CEST	49867	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:54.141726971 CEST	443	49867	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:54.361479998 CEST	443	49865	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:54.361521006 CEST	443	49865	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:54.361577988 CEST	443	49865	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:54.361674070 CEST	49865	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:54.417938948 CEST	49865	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:54.417974949 CEST	443	49865	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:54.417990923 CEST	49865	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:54.417998075 CEST	443	49865	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:54.421550035 CEST	49870	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:54.421597004 CEST	443	49870	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:54.421686888 CEST	49870	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:54.421824932 CEST	49870	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:54.421834946 CEST	443	49870	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:54.449625969 CEST	443	49867	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:54.449745893 CEST	443	49867	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:54.449835062 CEST	49867	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:54.452847004 CEST	49867	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:54.452867985 CEST	443	49867	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:54.452907085 CEST	49867	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:54.452914000 CEST	443	49867	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:54.454511881 CEST	443	49866	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:54.455236912 CEST	443	49866	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:54.455313921 CEST	49866	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:54.455831051 CEST	443	49868	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:54.455919981 CEST	443	49868	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:54.456015110 CEST	49868	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:54.473119020 CEST	49866	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:54.473162889 CEST	443	49866	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:54.473205090 CEST	49866	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:54.473213911 CEST	443	49866	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:54.505265951 CEST	49868	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:54.505265951 CEST	49868	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:54.505286932 CEST	443	49868	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:54.505296946 CEST	443	49868	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:54.533354998 CEST	443	49869	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:54.578861952 CEST	49869	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:54.644076109 CEST	49869	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:54.644105911 CEST	443	49869	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:54.644539118 CEST	49869	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:54.644543886 CEST	443	49869	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:54.676817894 CEST	49872	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:54.676866055 CEST	443	49872	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:54.676955938 CEST	49872	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:54.677318096 CEST	49873	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:54.677370071 CEST	443	49873	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:54.677428007 CEST	49873	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:54.677588940 CEST	49872	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:54.677607059 CEST	443	49872	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:54.677697897 CEST	49873	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:54.677711964 CEST	443	49873	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:54.678128004 CEST	49871	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:54.678160906 CEST	443	49871	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:54.678440094 CEST	49871	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:54.678440094 CEST	49871	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:54.678479910 CEST	443	49871	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:54.738137007 CEST	443	49869	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:54.738166094 CEST	443	49869	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:54.738220930 CEST	49869	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:54.738238096 CEST	443	49869	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:54.738325119 CEST	443	49869	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:54.738368034 CEST	49869	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:54.738400936 CEST	49869	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:54.738416910 CEST	443	49869	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:54.738428116 CEST	49869	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:54.738432884 CEST	443	49869	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:54.742839098 CEST	49874	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:54.742881060 CEST	443	49874	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:54.742964029 CEST	49874	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:54.743402958 CEST	49874	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:54.743412971 CEST	443	49874	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.065934896 CEST	443	49870	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.066557884 CEST	49870	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:55.066637993 CEST	443	49870	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.067049026 CEST	49870	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:55.067064047 CEST	443	49870	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.167195082 CEST	443	49870	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.167234898 CEST	443	49870	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.167287111 CEST	443	49870	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.167418957 CEST	49870	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:55.167453051 CEST	49870	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:55.167715073 CEST	49870	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:55.167741060 CEST	443	49870	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.167752981 CEST	49870	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:55.167758942 CEST	443	49870	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.170742035 CEST	49875	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:55.170778036 CEST	443	49875	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.170867920 CEST	49875	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:55.171041012 CEST	49875	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:55.171056032 CEST	443	49875	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.236890078 CEST	443	49871	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.237479925 CEST	49871	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:55.237512112 CEST	443	49871	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.237960100 CEST	49871	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:55.237967014 CEST	443	49871	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.316040993 CEST	443	49873	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.316581964 CEST	49873	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:55.316605091 CEST	443	49873	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.317029953 CEST	49873	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:55.317034960 CEST	443	49873	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.322592020 CEST	443	49872	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.323085070 CEST	49872	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:55.323101997 CEST	443	49872	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.323542118 CEST	49872	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:55.323549986 CEST	443	49872	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.337923050 CEST	443	49871	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.337960005 CEST	443	49871	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.338012934 CEST	443	49871	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.338028908 CEST	49871	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:55.338080883 CEST	49871	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:55.338291883 CEST	49871	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:55.338291883 CEST	49871	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:55.338311911 CEST	443	49871	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.338323116 CEST	443	49871	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.341448069 CEST	49876	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:55.341496944 CEST	443	49876	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.341577053 CEST	49876	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:55.341716051 CEST	49876	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:55.341728926 CEST	443	49876	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.402389050 CEST	443	49874	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.403445959 CEST	49874	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:55.403491020 CEST	443	49874	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.404031992 CEST	49874	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:55.404052019 CEST	443	49874	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.417468071 CEST	443	49873	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.418370008 CEST	443	49873	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.418436050 CEST	49873	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:55.418488979 CEST	49873	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:55.418509960 CEST	443	49873	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.418529987 CEST	49873	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:55.418535948 CEST	443	49873	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.421238899 CEST	49877	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:55.421284914 CEST	443	49877	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.421365976 CEST	49877	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:55.421535015 CEST	49877	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:55.421546936 CEST	443	49877	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.423188925 CEST	443	49872	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.423597097 CEST	443	49872	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.423640966 CEST	443	49872	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.423644066 CEST	49872	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:55.423696041 CEST	49872	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:55.423731089 CEST	49872	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:55.423754930 CEST	443	49872	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.423768044 CEST	49872	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:55.423774004 CEST	443	49872	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.426445961 CEST	49878	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:55.426489115 CEST	443	49878	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.426554918 CEST	49878	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:55.426748037 CEST	49878	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:55.426759005 CEST	443	49878	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.502101898 CEST	443	49874	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.502180099 CEST	443	49874	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.502232075 CEST	49874	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:55.502371073 CEST	49874	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:55.502396107 CEST	443	49874	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.502408981 CEST	49874	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:55.502414942 CEST	443	49874	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.505074024 CEST	49879	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:55.505121946 CEST	443	49879	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.505194902 CEST	49879	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:55.505356073 CEST	49879	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:55.505374908 CEST	443	49879	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.812881947 CEST	443	49875	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.814762115 CEST	49875	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:55.814778090 CEST	443	49875	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.815195084 CEST	49875	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:55.815201044 CEST	443	49875	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.915558100 CEST	443	49875	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.915575981 CEST	443	49875	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.915647984 CEST	49875	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:55.915664911 CEST	443	49875	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.915781021 CEST	443	49875	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.915832996 CEST	49875	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:55.915956020 CEST	49875	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:55.915971041 CEST	443	49875	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.916002989 CEST	49875	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:55.916008949 CEST	443	49875	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.918755054 CEST	49880	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:55.918811083 CEST	443	49880	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.918889046 CEST	49880	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:55.919003010 CEST	49880	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:55.919018030 CEST	443	49880	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.983977079 CEST	443	49876	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.984477997 CEST	49876	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:55.984512091 CEST	443	49876	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:55.984945059 CEST	49876	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:55.984954119 CEST	443	49876	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.040440083 CEST	443	49877	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.040448904 CEST	443	49878	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.040950060 CEST	49878	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.040950060 CEST	49877	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.040971994 CEST	443	49878	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.040990114 CEST	443	49877	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.041423082 CEST	49878	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.041428089 CEST	443	49878	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.041450977 CEST	49877	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.041455984 CEST	443	49877	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.094664097 CEST	443	49876	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.094826937 CEST	443	49876	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.094882965 CEST	49876	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.094947100 CEST	443	49876	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.094969988 CEST	49876	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.094969988 CEST	49876	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.095000982 CEST	443	49876	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.095019102 CEST	49876	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.095027924 CEST	443	49876	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.097678900 CEST	49881	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.097723007 CEST	443	49881	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.097836971 CEST	49881	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.098082066 CEST	49881	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.098092079 CEST	443	49881	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.135344028 CEST	443	49878	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.135549068 CEST	443	49878	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.135670900 CEST	49878	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.135876894 CEST	49878	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.135900974 CEST	443	49878	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.135911942 CEST	49878	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.135919094 CEST	443	49878	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.136966944 CEST	443	49877	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.137236118 CEST	443	49877	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.137288094 CEST	443	49877	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.137296915 CEST	49877	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.137332916 CEST	49877	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.137460947 CEST	49877	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.137468100 CEST	443	49877	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.137480974 CEST	49877	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.137485981 CEST	443	49877	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.138863087 CEST	49882	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.138901949 CEST	443	49882	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.139029026 CEST	49882	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.139110088 CEST	49882	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.139123917 CEST	443	49882	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.139799118 CEST	49883	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.139872074 CEST	443	49883	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.142262936 CEST	49883	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.142405033 CEST	49883	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.142432928 CEST	443	49883	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.150727034 CEST	443	49879	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.154577971 CEST	49879	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.154620886 CEST	443	49879	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.155046940 CEST	49879	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.155054092 CEST	443	49879	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.252832890 CEST	443	49879	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.271007061 CEST	443	49879	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.272294044 CEST	49879	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.272346973 CEST	49879	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.272375107 CEST	443	49879	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.272388935 CEST	49879	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.272397995 CEST	443	49879	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.275311947 CEST	49884	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.275372982 CEST	443	49884	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.275468111 CEST	49884	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.275623083 CEST	49884	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.275639057 CEST	443	49884	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.533740044 CEST	443	49880	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.534257889 CEST	49880	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.534286976 CEST	443	49880	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.534723997 CEST	49880	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.534729958 CEST	443	49880	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.635456085 CEST	443	49880	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.635528088 CEST	443	49880	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.635620117 CEST	49880	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.636137009 CEST	49880	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.636153936 CEST	443	49880	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.636166096 CEST	49880	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.636172056 CEST	443	49880	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.640364885 CEST	49885	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.640407085 CEST	443	49885	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.640615940 CEST	49885	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.640769958 CEST	49885	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.640784979 CEST	443	49885	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.721859932 CEST	443	49881	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.723002911 CEST	49881	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.723021984 CEST	443	49881	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.723454952 CEST	49881	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.723460913 CEST	443	49881	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.842242956 CEST	443	49883	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.842928886 CEST	49883	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.842957973 CEST	443	49883	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.843405962 CEST	49883	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.843410969 CEST	443	49883	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.845144033 CEST	443	49882	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.845546961 CEST	49882	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.845566988 CEST	443	49882	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.845982075 CEST	49882	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.845987082 CEST	443	49882	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.873982906 CEST	443	49881	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.874483109 CEST	443	49881	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.874526978 CEST	443	49881	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.874596119 CEST	49881	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.874597073 CEST	49881	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.874651909 CEST	49881	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.874665976 CEST	443	49881	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.874744892 CEST	49881	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.874751091 CEST	443	49881	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.877362013 CEST	49886	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.877408028 CEST	443	49886	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.877490044 CEST	49886	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.877614975 CEST	49886	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.877630949 CEST	443	49886	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.939713001 CEST	443	49882	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.940010071 CEST	443	49882	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.940104008 CEST	49882	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.941864014 CEST	443	49883	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.941895008 CEST	443	49883	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.941940069 CEST	443	49883	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.941981077 CEST	49883	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.942018032 CEST	49883	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.942116022 CEST	49882	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.942116022 CEST	49882	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.942154884 CEST	443	49882	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.942168951 CEST	443	49882	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.943300962 CEST	49883	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.943315983 CEST	443	49883	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.943330050 CEST	49883	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.943336010 CEST	443	49883	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.945656061 CEST	49887	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.945703030 CEST	443	49887	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.945862055 CEST	49887	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.946120977 CEST	49887	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.946134090 CEST	443	49887	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.946898937 CEST	49888	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.946907043 CEST	443	49888	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.946968079 CEST	49888	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.947102070 CEST	49888	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.947108984 CEST	443	49888	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.963134050 CEST	443	49884	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.963578939 CEST	49884	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.963603973 CEST	443	49884	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:56.963913918 CEST	49884	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:56.963921070 CEST	443	49884	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:57.063664913 CEST	443	49884	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:57.063994884 CEST	443	49884	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:57.064071894 CEST	49884	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:57.064117908 CEST	49884	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:57.064117908 CEST	49884	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:57.064143896 CEST	443	49884	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:57.064156055 CEST	443	49884	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:57.066807032 CEST	49889	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:57.066858053 CEST	443	49889	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:57.066929102 CEST	49889	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:57.067086935 CEST	49889	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:57.067095041 CEST	443	49889	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:57.297740936 CEST	443	49885	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:57.340900898 CEST	49885	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:57.340939999 CEST	443	49885	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:57.346154928 CEST	49885	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:57.346167088 CEST	443	49885	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:57.438266039 CEST	443	49885	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:57.438394070 CEST	443	49885	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:57.438447952 CEST	49885	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:57.438450098 CEST	443	49885	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:57.438523054 CEST	49885	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:57.438699961 CEST	49885	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:57.438718081 CEST	443	49885	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:57.438729048 CEST	49885	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:57.438735008 CEST	443	49885	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:57.441854954 CEST	49890	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:57.441879034 CEST	443	49890	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:57.441953897 CEST	49890	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:57.442295074 CEST	49890	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:57.442310095 CEST	443	49890	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:57.488920927 CEST	443	49886	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:57.489408016 CEST	49886	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:57.489425898 CEST	443	49886	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:57.489954948 CEST	49886	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:57.489979982 CEST	443	49886	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:57.557848930 CEST	443	49887	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:57.558602095 CEST	49887	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:57.558674097 CEST	443	49887	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:57.558909893 CEST	49887	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:57.558924913 CEST	443	49887	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:57.569940090 CEST	443	49888	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:57.570626974 CEST	49888	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:57.570693016 CEST	443	49888	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:57.570991993 CEST	49888	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:57.571006060 CEST	443	49888	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:57.587821960 CEST	443	49886	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:57.588136911 CEST	443	49886	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:57.588217974 CEST	49886	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:57.588258982 CEST	49886	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:57.588280916 CEST	443	49886	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:57.588296890 CEST	49886	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:57.588301897 CEST	443	49886	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:57.591329098 CEST	49891	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:57.591443062 CEST	443	49891	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:57.591556072 CEST	49891	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:57.591701984 CEST	49891	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:57.591737986 CEST	443	49891	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:57.653455019 CEST	443	49887	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:57.653630018 CEST	443	49887	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:57.653753996 CEST	49887	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:57.654016972 CEST	49887	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:57.654016972 CEST	49887	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:57.654036999 CEST	443	49887	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:57.654048920 CEST	443	49887	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:57.657089949 CEST	49892	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:57.657135010 CEST	443	49892	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:57.657216072 CEST	49892	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:57.657417059 CEST	49892	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:57.657427073 CEST	443	49892	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:57.666054010 CEST	443	49888	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:57.666460037 CEST	443	49888	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:57.666532993 CEST	49888	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:57.666589022 CEST	49888	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:57.666608095 CEST	443	49888	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:57.666620016 CEST	49888	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:57.666625977 CEST	443	49888	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:57.669317007 CEST	49893	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:57.669364929 CEST	443	49893	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:57.669437885 CEST	49893	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:57.669572115 CEST	49893	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:57.669589043 CEST	443	49893	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:57.727261066 CEST	443	49889	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:57.728003979 CEST	49889	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:57.728029013 CEST	443	49889	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:57.728473902 CEST	49889	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:57.728480101 CEST	443	49889	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:57.827680111 CEST	443	49889	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:57.827883005 CEST	443	49889	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:57.827971935 CEST	49889	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:57.828088999 CEST	49889	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:57.828111887 CEST	443	49889	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:57.828124046 CEST	49889	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:57.828129053 CEST	443	49889	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:57.831291914 CEST	49894	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:57.831336021 CEST	443	49894	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:57.831455946 CEST	49894	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:57.831649065 CEST	49894	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:57.831667900 CEST	443	49894	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:58.066773891 CEST	443	49890	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:58.067315102 CEST	49890	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:58.067342997 CEST	443	49890	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:58.067754030 CEST	49890	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:58.067759037 CEST	443	49890	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:58.163944006 CEST	443	49890	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:58.164016008 CEST	443	49890	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:58.164127111 CEST	49890	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:58.164248943 CEST	49890	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:58.164267063 CEST	443	49890	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:58.164277077 CEST	49890	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:58.164283037 CEST	443	49890	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:58.166836977 CEST	49895	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:58.166933060 CEST	443	49895	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:58.167030096 CEST	49895	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:58.167169094 CEST	49895	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:58.167206049 CEST	443	49895	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:58.214051008 CEST	443	49891	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:58.214704990 CEST	49891	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:58.214773893 CEST	443	49891	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:58.215234995 CEST	49891	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:58.215249062 CEST	443	49891	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:58.288671017 CEST	443	49892	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:58.289266109 CEST	49892	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:58.289297104 CEST	443	49892	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:58.289858103 CEST	49892	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:58.289861917 CEST	443	49892	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:58.312589884 CEST	443	49891	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:58.312623024 CEST	443	49891	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:58.312674999 CEST	443	49891	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:58.312760115 CEST	49891	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:58.313052893 CEST	49891	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:58.313052893 CEST	49891	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:58.313076019 CEST	443	49891	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:58.313097000 CEST	443	49891	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:58.315752029 CEST	49896	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:58.315851927 CEST	443	49896	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:58.315947056 CEST	49896	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:58.316098928 CEST	49896	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:58.316140890 CEST	443	49896	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:58.385842085 CEST	443	49892	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:58.386554956 CEST	443	49892	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:58.386637926 CEST	49892	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:58.386681080 CEST	49892	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:58.386681080 CEST	49892	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:58.386703014 CEST	443	49892	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:58.386713028 CEST	443	49892	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:58.389410973 CEST	49897	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:58.389463902 CEST	443	49897	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:58.389556885 CEST	49897	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:58.389703035 CEST	49897	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:58.389717102 CEST	443	49897	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:58.480267048 CEST	443	49894	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:58.480935097 CEST	49894	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:58.480953932 CEST	443	49894	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:58.482002974 CEST	49894	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:58.482008934 CEST	443	49894	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:58.584388018 CEST	443	49894	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:58.584697008 CEST	443	49894	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:58.584745884 CEST	49894	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:58.585010052 CEST	49894	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:58.585031986 CEST	443	49894	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:58.585165024 CEST	49894	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:58.585174084 CEST	443	49894	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:58.588085890 CEST	49898	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:58.588140011 CEST	443	49898	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:58.588196039 CEST	49898	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:58.588524103 CEST	49898	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:58.588536024 CEST	443	49898	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:58.781758070 CEST	443	49895	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:58.782435894 CEST	49895	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:58.782496929 CEST	443	49895	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:58.782890081 CEST	49895	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:58.782905102 CEST	443	49895	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:58.900506973 CEST	443	49895	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:58.901022911 CEST	443	49895	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:58.901071072 CEST	443	49895	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:58.901093006 CEST	49895	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:58.901134968 CEST	49895	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:58.901194096 CEST	49895	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:58.901210070 CEST	443	49895	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:58.901221991 CEST	49895	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:58.901227951 CEST	443	49895	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:58.904050112 CEST	49899	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:58.904095888 CEST	443	49899	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:58.904195070 CEST	49899	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:58.904355049 CEST	49899	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:58.904370070 CEST	443	49899	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:58.973376989 CEST	443	49896	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:58.974630117 CEST	49896	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:58.974663019 CEST	443	49896	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:58.975075006 CEST	49896	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:58.975080013 CEST	443	49896	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.062670946 CEST	443	49893	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.063946009 CEST	49893	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.063963890 CEST	443	49893	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.064347982 CEST	49893	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.064359903 CEST	443	49893	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.074337959 CEST	443	49897	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.074826002 CEST	49897	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.074839115 CEST	443	49897	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.075280905 CEST	49897	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.075285912 CEST	443	49897	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.076656103 CEST	443	49896	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.077028036 CEST	443	49896	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.077120066 CEST	49896	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.077229023 CEST	49896	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.077229023 CEST	49896	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.077280045 CEST	443	49896	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.077310085 CEST	443	49896	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.079827070 CEST	49900	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.079868078 CEST	443	49900	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.080137014 CEST	49900	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.080317020 CEST	49900	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.080331087 CEST	443	49900	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.159852982 CEST	443	49893	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.160234928 CEST	443	49893	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.160326004 CEST	49893	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.160340071 CEST	443	49893	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.160361052 CEST	443	49893	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.160419941 CEST	49893	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.160485983 CEST	49893	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.160485983 CEST	49893	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.160501957 CEST	443	49893	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.160510063 CEST	443	49893	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.164037943 CEST	49901	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.164083958 CEST	443	49901	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.164197922 CEST	49901	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.164319038 CEST	49901	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.164324045 CEST	443	49901	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.169044971 CEST	443	49897	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.169118881 CEST	443	49897	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.169223070 CEST	443	49897	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.169320107 CEST	49897	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.169320107 CEST	49897	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.169321060 CEST	49897	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.171670914 CEST	49902	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.171679974 CEST	443	49902	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.172457933 CEST	49902	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.172689915 CEST	49902	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.172699928 CEST	443	49902	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.230823994 CEST	443	49898	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.231281042 CEST	49898	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.231297970 CEST	443	49898	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.231707096 CEST	49898	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.231712103 CEST	443	49898	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.325670004 CEST	443	49898	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.325794935 CEST	443	49898	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.325927973 CEST	49898	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.326128960 CEST	49898	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.326150894 CEST	443	49898	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.326160908 CEST	49898	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.326169014 CEST	443	49898	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.328576088 CEST	49903	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.328623056 CEST	443	49903	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.328704119 CEST	49903	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.328836918 CEST	49903	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.328852892 CEST	443	49903	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.375778913 CEST	49897	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.375828981 CEST	443	49897	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.508598089 CEST	443	49899	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.509222031 CEST	49899	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.509299040 CEST	443	49899	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.509783983 CEST	49899	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.509805918 CEST	443	49899	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.604959965 CEST	443	49899	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.604985952 CEST	443	49899	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.605065107 CEST	49899	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.605093002 CEST	443	49899	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.605333090 CEST	49899	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.605348110 CEST	443	49899	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.605356932 CEST	49899	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.605490923 CEST	443	49899	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.605521917 CEST	443	49899	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.605570078 CEST	49899	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.608050108 CEST	49904	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.608083963 CEST	443	49904	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.608186007 CEST	49904	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.608459949 CEST	49904	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.608474970 CEST	443	49904	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.717262030 CEST	443	49900	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.717860937 CEST	49900	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.717888117 CEST	443	49900	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.718326092 CEST	49900	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.718332052 CEST	443	49900	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.805578947 CEST	443	49902	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.806102037 CEST	49902	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.806119919 CEST	443	49902	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.806581974 CEST	49902	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.806586981 CEST	443	49902	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.812942028 CEST	443	49900	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.812971115 CEST	443	49900	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.813051939 CEST	49900	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.813091040 CEST	443	49900	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.813108921 CEST	443	49900	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.813164949 CEST	49900	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.814305067 CEST	49900	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.814330101 CEST	443	49900	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.814344883 CEST	49900	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.814349890 CEST	443	49900	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.817014933 CEST	49905	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.817050934 CEST	443	49905	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.817265034 CEST	49905	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.817415953 CEST	49905	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.817425013 CEST	443	49905	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.820885897 CEST	443	49901	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.821300030 CEST	49901	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.821326971 CEST	443	49901	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.821758032 CEST	49901	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.821768045 CEST	443	49901	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.898237944 CEST	443	49902	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.898746014 CEST	443	49902	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.898827076 CEST	49902	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.899063110 CEST	49902	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.899089098 CEST	443	49902	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.899101019 CEST	49902	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.899107933 CEST	443	49902	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.901981115 CEST	49906	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.902019024 CEST	443	49906	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.902086973 CEST	49906	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.902256966 CEST	49906	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.902267933 CEST	443	49906	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.919063091 CEST	443	49901	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.919734001 CEST	443	49901	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.919846058 CEST	443	49901	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.919914961 CEST	49901	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.919948101 CEST	49901	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.919965982 CEST	443	49901	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.919975996 CEST	49901	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.919981003 CEST	443	49901	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.922259092 CEST	49907	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.922306061 CEST	443	49907	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.922477007 CEST	49907	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.922569036 CEST	49907	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.922597885 CEST	443	49907	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.934268951 CEST	443	49903	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.937290907 CEST	49903	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.937313080 CEST	443	49903	13.107.246.45	192.168.2.11
Oct 8, 2024 00:41:59.937730074 CEST	49903	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:41:59.937735081 CEST	443	49903	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:00.029000998 CEST	443	49903	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:00.029056072 CEST	443	49903	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:00.029102087 CEST	443	49903	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:00.029172897 CEST	49903	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:00.029206038 CEST	49903	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:00.029390097 CEST	49903	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:00.029408932 CEST	443	49903	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:00.029419899 CEST	49903	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:00.029426098 CEST	443	49903	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:00.032004118 CEST	49908	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:00.032040119 CEST	443	49908	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:00.032136917 CEST	49908	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:00.032270908 CEST	49908	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:00.032284975 CEST	443	49908	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:00.244311094 CEST	443	49904	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:00.245404005 CEST	49904	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:00.245431900 CEST	443	49904	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:00.245851994 CEST	49904	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:00.245862007 CEST	443	49904	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:00.362629890 CEST	443	49904	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:00.362704992 CEST	443	49904	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:00.363202095 CEST	49904	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:00.363202095 CEST	49904	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:00.363202095 CEST	49904	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:00.366287947 CEST	49909	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:00.366344929 CEST	443	49909	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:00.366453886 CEST	49909	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:00.366620064 CEST	49909	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:00.366631985 CEST	443	49909	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:00.466026068 CEST	443	49905	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:00.466551065 CEST	49905	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:00.466576099 CEST	443	49905	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:00.467183113 CEST	49905	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:00.467196941 CEST	443	49905	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:00.503585100 CEST	443	49906	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:00.504061937 CEST	49906	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:00.504098892 CEST	443	49906	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:00.504582882 CEST	49906	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:00.504587889 CEST	443	49906	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:00.536981106 CEST	443	49907	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:00.537719011 CEST	49907	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:00.537739992 CEST	443	49907	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:00.538290977 CEST	49907	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:00.538301945 CEST	443	49907	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:00.566770077 CEST	443	49905	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:00.567477942 CEST	443	49905	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:00.567534924 CEST	49905	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:00.567549944 CEST	443	49905	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:00.567564011 CEST	443	49905	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:00.567610979 CEST	49905	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:00.567647934 CEST	49905	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:00.567667961 CEST	443	49905	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:00.567677021 CEST	49905	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:00.567682028 CEST	443	49905	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:00.570374966 CEST	49910	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:00.570425987 CEST	443	49910	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:00.570486069 CEST	49910	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:00.570661068 CEST	49910	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:00.570673943 CEST	443	49910	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:00.598701954 CEST	443	49906	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:00.598879099 CEST	443	49906	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:00.598969936 CEST	49906	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:00.599015951 CEST	49906	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:00.599016905 CEST	49906	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:00.599036932 CEST	443	49906	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:00.599049091 CEST	443	49906	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:00.601638079 CEST	49911	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:00.601686954 CEST	443	49911	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:00.601758957 CEST	49911	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:00.601914883 CEST	49911	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:00.601929903 CEST	443	49911	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:00.632541895 CEST	443	49907	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:00.633239985 CEST	443	49907	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:00.633286953 CEST	443	49907	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:00.633344889 CEST	49907	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:00.633344889 CEST	49907	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:00.633409977 CEST	49907	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:00.633428097 CEST	443	49907	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:00.633460045 CEST	49907	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:00.633466005 CEST	443	49907	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:00.636043072 CEST	49912	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:00.636099100 CEST	443	49912	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:00.636344910 CEST	49912	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:00.636482000 CEST	49912	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:00.636493921 CEST	443	49912	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:00.672574997 CEST	49904	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:00.672601938 CEST	443	49904	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:00.783211946 CEST	443	49908	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:00.783773899 CEST	49908	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:00.783807993 CEST	443	49908	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:00.784190893 CEST	49908	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:00.784194946 CEST	443	49908	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:00.885637999 CEST	443	49908	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:00.886033058 CEST	443	49908	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:00.886307955 CEST	49908	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:00.886476994 CEST	49908	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:00.886496067 CEST	443	49908	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:00.886512995 CEST	49908	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:00.886518955 CEST	443	49908	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:00.889091969 CEST	49913	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:00.889123917 CEST	443	49913	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:00.889203072 CEST	49913	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:00.889368057 CEST	49913	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:00.889381886 CEST	443	49913	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:01.086371899 CEST	443	49909	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:01.088710070 CEST	49909	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:01.088766098 CEST	443	49909	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:01.089154005 CEST	49909	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:01.089160919 CEST	443	49909	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:01.185668945 CEST	443	49909	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:01.185693979 CEST	443	49909	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:01.185744047 CEST	443	49909	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:01.185832977 CEST	49909	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:01.186196089 CEST	49909	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:01.186196089 CEST	49909	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:01.186228991 CEST	443	49909	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:01.186239958 CEST	443	49909	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:01.189126015 CEST	49914	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:01.189166069 CEST	443	49914	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:01.189260960 CEST	49914	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:01.189426899 CEST	49914	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:01.189440966 CEST	443	49914	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:01.280113935 CEST	443	49910	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:01.281069040 CEST	49910	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:01.281100988 CEST	443	49910	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:01.281389952 CEST	49910	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:01.281397104 CEST	443	49910	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:01.332762003 CEST	443	49912	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:01.333380938 CEST	49912	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:01.333410978 CEST	443	49912	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:01.333734989 CEST	49912	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:01.333745956 CEST	443	49912	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:01.366802931 CEST	443	49911	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:01.367364883 CEST	49911	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:01.367398024 CEST	443	49911	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:01.367789984 CEST	49911	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:01.367794991 CEST	443	49911	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:01.381951094 CEST	443	49910	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:01.382028103 CEST	443	49910	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:01.382145882 CEST	49910	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:01.382205009 CEST	49910	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:01.382227898 CEST	443	49910	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:01.382241011 CEST	49910	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:01.382247925 CEST	443	49910	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:01.384953976 CEST	49915	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:01.385001898 CEST	443	49915	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:01.385066986 CEST	49915	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:01.385194063 CEST	49915	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:01.385210037 CEST	443	49915	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:01.429488897 CEST	443	49912	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:01.429522991 CEST	443	49912	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:01.429563999 CEST	443	49912	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:01.429586887 CEST	49912	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:01.429629087 CEST	49912	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:01.429848909 CEST	49912	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:01.429873943 CEST	443	49912	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:01.429888964 CEST	49912	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:01.429894924 CEST	443	49912	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:01.432707071 CEST	49916	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:01.432744026 CEST	443	49916	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:01.432828903 CEST	49916	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:01.432980061 CEST	49916	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:01.432991028 CEST	443	49916	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:01.467122078 CEST	443	49911	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:01.467350960 CEST	443	49911	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:01.467423916 CEST	49911	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:01.467679024 CEST	49911	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:01.467700005 CEST	443	49911	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:01.467710972 CEST	49911	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:01.467716932 CEST	443	49911	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:01.470468998 CEST	49917	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:01.470555067 CEST	443	49917	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:01.470798016 CEST	49917	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:01.470957994 CEST	49917	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:01.470992088 CEST	443	49917	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:01.551296949 CEST	443	49913	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:01.551806927 CEST	49913	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:01.551821947 CEST	443	49913	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:01.552263021 CEST	49913	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:01.552267075 CEST	443	49913	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:01.650087118 CEST	443	49913	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:01.650299072 CEST	443	49913	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:01.650365114 CEST	49913	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:01.650388956 CEST	49913	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:01.650408983 CEST	443	49913	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:01.650419950 CEST	49913	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:01.650424004 CEST	443	49913	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:01.653009892 CEST	49918	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:01.653089046 CEST	443	49918	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:01.653207064 CEST	49918	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:01.653368950 CEST	49918	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:01.653407097 CEST	443	49918	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:01.796314955 CEST	443	49914	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:01.808945894 CEST	49914	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:01.808973074 CEST	443	49914	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:01.809398890 CEST	49914	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:01.809403896 CEST	443	49914	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:01.900815010 CEST	443	49914	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:01.900868893 CEST	443	49914	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:01.900923967 CEST	49914	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:01.901088953 CEST	49914	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:01.901107073 CEST	443	49914	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:01.901120901 CEST	49914	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:01.901125908 CEST	443	49914	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:01.903609991 CEST	49919	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:01.903651953 CEST	443	49919	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:01.903728008 CEST	49919	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:01.903867960 CEST	49919	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:01.903879881 CEST	443	49919	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:01.970726013 CEST	49713	80	192.168.2.11	46.8.231.109
Oct 8, 2024 00:42:02.004086018 CEST	443	49915	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.004584074 CEST	49915	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.004601955 CEST	443	49915	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.004993916 CEST	49915	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.004997969 CEST	443	49915	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.054477930 CEST	443	49916	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.055025101 CEST	49916	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.055063009 CEST	443	49916	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.055478096 CEST	49916	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.055484056 CEST	443	49916	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.087111950 CEST	443	49917	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.087593079 CEST	49917	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.087639093 CEST	443	49917	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.088020086 CEST	49917	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.088027954 CEST	443	49917	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.100404978 CEST	443	49915	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.100778103 CEST	443	49915	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.100831032 CEST	443	49915	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.100886106 CEST	49915	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.100886106 CEST	49915	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.100961924 CEST	49915	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.100961924 CEST	49915	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.100982904 CEST	443	49915	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.101005077 CEST	443	49915	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.104144096 CEST	49920	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.104182005 CEST	443	49920	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.104397058 CEST	49920	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.104397058 CEST	49920	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.104427099 CEST	443	49920	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.154391050 CEST	443	49916	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.154475927 CEST	443	49916	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.154526949 CEST	49916	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.154700041 CEST	49916	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.154719114 CEST	443	49916	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.154742002 CEST	49916	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.154750109 CEST	443	49916	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.157349110 CEST	49921	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.157386065 CEST	443	49921	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.157555103 CEST	49921	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.157555103 CEST	49921	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.157578945 CEST	443	49921	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.181719065 CEST	443	49917	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.181858063 CEST	443	49917	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.181895971 CEST	443	49917	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.181934118 CEST	49917	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.182007074 CEST	49917	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.182007074 CEST	49917	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.182056904 CEST	49917	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.182095051 CEST	443	49917	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.184957027 CEST	49922	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.184978008 CEST	443	49922	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.185184956 CEST	49922	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.185184956 CEST	49922	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.185206890 CEST	443	49922	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.272927999 CEST	443	49918	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.273396969 CEST	49918	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.273442984 CEST	443	49918	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.273801088 CEST	49918	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.273814917 CEST	443	49918	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.371644974 CEST	443	49918	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.371984005 CEST	443	49918	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.372052908 CEST	49918	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.372116089 CEST	49918	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.372116089 CEST	49918	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.372155905 CEST	443	49918	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.372179985 CEST	443	49918	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.378552914 CEST	49923	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.378587961 CEST	443	49923	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.378855944 CEST	49923	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.378855944 CEST	49923	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.378881931 CEST	443	49923	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.538222075 CEST	443	49919	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.538696051 CEST	49919	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.538714886 CEST	443	49919	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.539194107 CEST	49919	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.539197922 CEST	443	49919	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.635754108 CEST	443	49919	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.635828018 CEST	443	49919	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.635883093 CEST	49919	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.636202097 CEST	49919	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.636220932 CEST	443	49919	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.636231899 CEST	49919	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.636236906 CEST	443	49919	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.639276981 CEST	49924	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.639379978 CEST	443	49924	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.639478922 CEST	49924	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.639652014 CEST	49924	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.639693975 CEST	443	49924	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.727546930 CEST	443	49920	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.728279114 CEST	49920	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.728293896 CEST	443	49920	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.728679895 CEST	49920	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.728687048 CEST	443	49920	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.812203884 CEST	443	49921	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.813055992 CEST	49921	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.813088894 CEST	443	49921	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.813247919 CEST	49921	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.813255072 CEST	443	49921	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.823821068 CEST	443	49922	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.824306011 CEST	49922	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.824315071 CEST	443	49922	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.824675083 CEST	49922	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.824680090 CEST	443	49922	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.828820944 CEST	443	49920	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.828950882 CEST	443	49920	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.829009056 CEST	443	49920	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.829065084 CEST	49920	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.829065084 CEST	49920	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.829375029 CEST	49920	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.829375029 CEST	49920	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.829397917 CEST	443	49920	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.829406023 CEST	443	49920	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.842931032 CEST	49925	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.842968941 CEST	443	49925	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.843072891 CEST	49925	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.843173027 CEST	49925	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.843180895 CEST	443	49925	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.917510033 CEST	443	49921	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.917581081 CEST	443	49921	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.917654037 CEST	49921	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.917922020 CEST	49921	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.917922020 CEST	49921	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.917946100 CEST	443	49921	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.917956114 CEST	443	49921	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.927465916 CEST	49926	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.927525043 CEST	443	49926	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.927587986 CEST	49926	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.929755926 CEST	443	49922	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.930404902 CEST	443	49922	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.930547953 CEST	49922	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.930850983 CEST	49926	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.930879116 CEST	443	49926	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.931380987 CEST	49922	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.931380987 CEST	49922	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.931411982 CEST	443	49922	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.931423903 CEST	443	49922	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.933428049 CEST	49927	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.933473110 CEST	443	49927	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:02.933538914 CEST	49927	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.933695078 CEST	49927	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:02.933711052 CEST	443	49927	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:03.057449102 CEST	443	49923	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:03.057924032 CEST	49923	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:03.057945013 CEST	443	49923	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:03.058481932 CEST	49923	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:03.058485985 CEST	443	49923	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:03.160268068 CEST	443	49923	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:03.160298109 CEST	443	49923	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:03.160346985 CEST	443	49923	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:03.160399914 CEST	49923	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:03.160442114 CEST	49923	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:03.174994946 CEST	49923	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:03.175018072 CEST	443	49923	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:03.185518980 CEST	49928	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:03.185575962 CEST	443	49928	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:03.185651064 CEST	49928	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:03.185807943 CEST	49928	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:03.185817003 CEST	443	49928	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:03.272504091 CEST	443	49924	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:03.273055077 CEST	49924	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:03.273076057 CEST	443	49924	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:03.273530960 CEST	49924	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:03.273535967 CEST	443	49924	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:03.374193907 CEST	443	49924	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:03.374352932 CEST	443	49924	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:03.374572992 CEST	49924	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:03.374614000 CEST	49924	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:03.374631882 CEST	443	49924	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:03.374643087 CEST	49924	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:03.374649048 CEST	443	49924	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:03.377346039 CEST	49929	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:03.377404928 CEST	443	49929	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:03.377608061 CEST	49929	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:03.378139019 CEST	49929	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:03.378154993 CEST	443	49929	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:03.503165007 CEST	443	49925	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:03.529056072 CEST	49925	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:03.529072046 CEST	443	49925	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:03.529514074 CEST	49925	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:03.529519081 CEST	443	49925	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:03.558115959 CEST	443	49926	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:03.560019970 CEST	49926	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:03.560029984 CEST	443	49926	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:03.560441971 CEST	49926	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:03.560448885 CEST	443	49926	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:03.576296091 CEST	443	49927	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:03.576692104 CEST	49927	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:03.576714039 CEST	443	49927	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:03.577135086 CEST	49927	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:03.577140093 CEST	443	49927	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:03.624943972 CEST	443	49925	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:03.625077963 CEST	443	49925	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:03.625123978 CEST	443	49925	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:03.625164032 CEST	49925	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:03.625345945 CEST	49925	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:03.626950026 CEST	49925	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:03.626971006 CEST	443	49925	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:03.626982927 CEST	49925	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:03.626988888 CEST	443	49925	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:03.631141901 CEST	49930	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:03.631184101 CEST	443	49930	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:03.631247997 CEST	49930	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:03.631498098 CEST	49930	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:03.631513119 CEST	443	49930	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:03.653603077 CEST	443	49926	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:03.653661966 CEST	443	49926	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:03.653712034 CEST	49926	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:03.653855085 CEST	49926	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:03.653871059 CEST	443	49926	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:03.653881073 CEST	49926	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:03.653897047 CEST	443	49926	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:03.657900095 CEST	49931	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:03.657932997 CEST	443	49931	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:03.657990932 CEST	49931	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:03.658225060 CEST	49931	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:03.658238888 CEST	443	49931	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:03.672980070 CEST	443	49927	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:03.673224926 CEST	443	49927	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:03.673288107 CEST	49927	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:03.673335075 CEST	49927	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:03.673353910 CEST	443	49927	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:03.673365116 CEST	49927	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:03.673369884 CEST	443	49927	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:03.675661087 CEST	49932	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:03.675756931 CEST	443	49932	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:03.675852060 CEST	49932	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:03.676000118 CEST	49932	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:03.676055908 CEST	443	49932	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:03.835944891 CEST	443	49928	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:03.836412907 CEST	49928	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:03.836462021 CEST	443	49928	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:03.836815119 CEST	49928	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:03.836821079 CEST	443	49928	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:03.941015959 CEST	443	49928	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:03.941072941 CEST	443	49928	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:03.941159010 CEST	49928	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:03.941323042 CEST	49928	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:03.941323042 CEST	49928	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:03.941387892 CEST	443	49928	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:03.941412926 CEST	443	49928	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:03.943818092 CEST	49933	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:03.943861961 CEST	443	49933	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:03.943943024 CEST	49933	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:03.944060087 CEST	49933	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:03.944077969 CEST	443	49933	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:04.009336948 CEST	443	49929	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:04.010130882 CEST	49929	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:04.010149956 CEST	443	49929	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:04.011409998 CEST	49929	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:04.011415005 CEST	443	49929	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:04.109379053 CEST	443	49929	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:04.109464884 CEST	443	49929	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:04.109507084 CEST	443	49929	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:04.109546900 CEST	49929	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:04.109600067 CEST	49929	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:04.109797001 CEST	49929	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:04.109813929 CEST	443	49929	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:04.109824896 CEST	49929	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:04.109831095 CEST	443	49929	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:04.112580061 CEST	49934	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:04.112620115 CEST	443	49934	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:04.112692118 CEST	49934	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:04.112817049 CEST	49934	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:04.112833977 CEST	443	49934	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:04.373266935 CEST	443	49931	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:04.373891115 CEST	49931	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:04.373977900 CEST	443	49931	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:04.374309063 CEST	49931	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:04.374325037 CEST	443	49931	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:04.378133059 CEST	443	49930	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:04.378424883 CEST	49930	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:04.378436089 CEST	443	49930	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:04.378763914 CEST	49930	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:04.378767967 CEST	443	49930	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:04.402388096 CEST	443	49932	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:04.402880907 CEST	49932	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:04.402906895 CEST	443	49932	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:04.403330088 CEST	49932	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:04.403335094 CEST	443	49932	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:04.469741106 CEST	443	49931	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:04.470274925 CEST	443	49931	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:04.470326900 CEST	443	49931	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:04.470534086 CEST	49931	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:04.470634937 CEST	49931	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:04.470634937 CEST	49931	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:04.470684052 CEST	443	49931	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:04.470710993 CEST	443	49931	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:04.473443985 CEST	49935	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:04.473498106 CEST	443	49935	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:04.473581076 CEST	49935	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:04.473715067 CEST	49935	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:04.473727942 CEST	443	49935	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:04.503639936 CEST	443	49932	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:04.503808975 CEST	443	49932	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:04.503886938 CEST	49932	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:04.504030943 CEST	49932	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:04.504085064 CEST	443	49932	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:04.504117966 CEST	49932	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:04.504134893 CEST	443	49932	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:04.507555962 CEST	49936	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:04.507594109 CEST	443	49936	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:04.507668018 CEST	49936	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:04.507872105 CEST	49936	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:04.507883072 CEST	443	49936	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:04.508356094 CEST	443	49930	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:04.508537054 CEST	443	49930	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:04.508589029 CEST	49930	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:04.508639097 CEST	49930	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:04.508656979 CEST	443	49930	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:04.508671045 CEST	49930	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:04.508677006 CEST	443	49930	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:04.511527061 CEST	49937	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:04.511564016 CEST	443	49937	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:04.511636972 CEST	49937	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:04.511770010 CEST	49937	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:04.511794090 CEST	443	49937	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:04.656837940 CEST	443	49933	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:04.657591105 CEST	49933	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:04.657614946 CEST	443	49933	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:04.657919884 CEST	49933	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:04.657924891 CEST	443	49933	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:04.753875017 CEST	443	49933	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:04.754117966 CEST	443	49933	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:04.754165888 CEST	49933	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:04.754179001 CEST	443	49933	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:04.754272938 CEST	443	49933	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:04.754292011 CEST	49933	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:04.754316092 CEST	443	49933	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:04.754328012 CEST	49933	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:04.754333973 CEST	443	49933	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:04.754618883 CEST	49933	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:04.754623890 CEST	443	49933	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:04.757256031 CEST	49938	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:04.757311106 CEST	443	49938	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:04.757386923 CEST	49938	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:04.759423018 CEST	49938	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:04.759437084 CEST	443	49938	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:04.850792885 CEST	443	49934	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:04.851269960 CEST	49934	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:04.851298094 CEST	443	49934	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:04.851721048 CEST	49934	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:04.851728916 CEST	443	49934	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:05.090627909 CEST	443	49935	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:05.091146946 CEST	49935	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:05.091212034 CEST	443	49935	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:05.091536999 CEST	49935	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:05.091552973 CEST	443	49935	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:05.118572950 CEST	443	49936	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:05.119021893 CEST	49936	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:05.119045973 CEST	443	49936	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:05.119466066 CEST	49936	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:05.119472027 CEST	443	49936	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:05.146672964 CEST	443	49937	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:05.147111893 CEST	49937	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:05.147140980 CEST	443	49937	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:05.147547960 CEST	49937	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:05.147552967 CEST	443	49937	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:05.187711000 CEST	443	49935	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:05.187932014 CEST	443	49935	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:05.188021898 CEST	49935	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:05.188106060 CEST	49935	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:05.188106060 CEST	49935	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:05.188148975 CEST	443	49935	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:05.188177109 CEST	443	49935	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:05.190720081 CEST	49939	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:05.190784931 CEST	443	49939	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:05.190866947 CEST	49939	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:05.190994024 CEST	49939	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:05.191009045 CEST	443	49939	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:05.214854002 CEST	443	49936	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:05.214998960 CEST	443	49936	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:05.215130091 CEST	49936	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:05.215172052 CEST	49936	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:05.215203047 CEST	443	49936	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:05.215215921 CEST	49936	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:05.215220928 CEST	443	49936	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:05.217636108 CEST	49940	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:05.217678070 CEST	443	49940	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:05.217767000 CEST	49940	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:05.218024015 CEST	49940	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:05.218035936 CEST	443	49940	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:05.272948980 CEST	443	49937	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:05.272989988 CEST	443	49937	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:05.273037910 CEST	443	49937	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:05.273235083 CEST	49937	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:05.273235083 CEST	49937	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:05.273344040 CEST	49937	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:05.273370028 CEST	443	49937	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:05.273382902 CEST	49937	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:05.273389101 CEST	443	49937	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:05.276091099 CEST	49941	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:05.276148081 CEST	443	49941	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:05.276345015 CEST	49941	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:05.276515007 CEST	49941	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:05.276532888 CEST	443	49941	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:05.827609062 CEST	443	49940	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:05.840826035 CEST	443	49939	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:05.852061033 CEST	49940	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:05.852082014 CEST	443	49940	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:05.852699041 CEST	49940	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:05.852704048 CEST	443	49940	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:05.854851961 CEST	49939	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:05.854863882 CEST	443	49939	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:05.855266094 CEST	49939	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:05.855271101 CEST	443	49939	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:05.885654926 CEST	443	49941	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:05.938185930 CEST	49941	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:05.945101023 CEST	443	49940	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:05.945240021 CEST	443	49940	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:05.945321083 CEST	49940	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:05.953618050 CEST	443	49939	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:05.953691959 CEST	443	49939	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:05.953794956 CEST	49939	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:06.171315908 CEST	49941	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:06.171349049 CEST	443	49941	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:06.171730995 CEST	49941	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:06.171736956 CEST	443	49941	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:06.180090904 CEST	49940	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:06.180116892 CEST	443	49940	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:06.180129051 CEST	49940	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:06.180135012 CEST	443	49940	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:06.188550949 CEST	49939	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:06.188550949 CEST	49939	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:06.188610077 CEST	443	49939	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:06.188642979 CEST	443	49939	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:06.229482889 CEST	49942	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:06.229532003 CEST	443	49942	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:06.229603052 CEST	49942	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:06.233388901 CEST	49943	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:06.233426094 CEST	443	49943	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:06.233488083 CEST	49943	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:06.233664989 CEST	49942	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:06.233701944 CEST	443	49942	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:06.233865976 CEST	49943	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:06.233875990 CEST	443	49943	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:06.271332979 CEST	443	49941	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:06.271428108 CEST	443	49941	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:06.271480083 CEST	49941	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:06.277070045 CEST	49941	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:06.277098894 CEST	443	49941	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:06.277115107 CEST	49941	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:06.277122021 CEST	443	49941	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:06.279798031 CEST	49944	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:06.279845953 CEST	443	49944	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:06.279911995 CEST	49944	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:06.280056000 CEST	49944	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:06.280076981 CEST	443	49944	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:06.404690981 CEST	443	49934	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:06.404778004 CEST	443	49934	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:06.404867887 CEST	49934	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:06.405092955 CEST	49934	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:06.405117035 CEST	443	49934	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:06.405132055 CEST	49934	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:06.405137062 CEST	443	49934	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:06.407850027 CEST	49945	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:06.407955885 CEST	443	49945	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:06.408085108 CEST	49945	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:06.408216953 CEST	49945	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:06.408243895 CEST	443	49945	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:06.616378069 CEST	443	49938	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:06.621054888 CEST	49938	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:06.621085882 CEST	443	49938	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:06.621526003 CEST	49938	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:06.621531963 CEST	443	49938	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:06.719666958 CEST	443	49938	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:06.719827890 CEST	443	49938	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:06.719952106 CEST	49938	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:06.720092058 CEST	49938	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:06.720092058 CEST	49938	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:06.720144987 CEST	443	49938	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:06.720176935 CEST	443	49938	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:06.722630978 CEST	49946	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:06.722681046 CEST	443	49946	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:06.722883940 CEST	49946	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:06.723053932 CEST	49946	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:06.723064899 CEST	443	49946	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:06.877830982 CEST	443	49943	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:06.878386974 CEST	49943	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:06.878418922 CEST	443	49943	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:06.878891945 CEST	49943	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:06.878918886 CEST	443	49943	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:06.902790070 CEST	443	49942	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:06.903373957 CEST	49942	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:06.903414011 CEST	443	49942	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:06.903853893 CEST	49942	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:06.903865099 CEST	443	49942	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:06.905344963 CEST	443	49944	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:06.905827999 CEST	49944	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:06.905854940 CEST	443	49944	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:06.906204939 CEST	49944	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:06.906218052 CEST	443	49944	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:06.990215063 CEST	443	49943	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:06.991296053 CEST	443	49943	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:06.991373062 CEST	49943	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:06.991432905 CEST	49943	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:06.991449118 CEST	443	49943	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:06.991460085 CEST	49943	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:06.991466045 CEST	443	49943	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:06.993978024 CEST	49947	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:06.994028091 CEST	443	49947	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:06.994105101 CEST	49947	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:06.994229078 CEST	49947	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:06.994239092 CEST	443	49947	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.042505026 CEST	443	49942	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.042690992 CEST	443	49942	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.042762041 CEST	49942	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:07.042972088 CEST	49942	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:07.042993069 CEST	443	49942	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.043030024 CEST	49942	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:07.043035984 CEST	443	49942	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.045989037 CEST	443	49944	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.046049118 CEST	49948	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:07.046094894 CEST	443	49948	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.046165943 CEST	49948	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:07.046683073 CEST	49948	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:07.046700954 CEST	443	49948	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.046847105 CEST	443	49944	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.046901941 CEST	49944	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:07.046947956 CEST	49944	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:07.046963930 CEST	443	49944	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.046977997 CEST	49944	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:07.046983957 CEST	443	49944	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.049401999 CEST	49949	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:07.049473047 CEST	443	49949	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.049545050 CEST	49949	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:07.049767017 CEST	49949	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:07.049787045 CEST	443	49949	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.156233072 CEST	443	49945	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.156832933 CEST	49945	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:07.156891108 CEST	443	49945	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.157330990 CEST	49945	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:07.157346964 CEST	443	49945	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.302094936 CEST	443	49945	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.302170992 CEST	443	49945	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.302253008 CEST	49945	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:07.302270889 CEST	443	49945	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.302333117 CEST	49945	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:07.324529886 CEST	49945	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:07.324564934 CEST	443	49945	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.324582100 CEST	49945	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:07.324589014 CEST	443	49945	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.327382088 CEST	49950	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:07.327495098 CEST	443	49950	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.327583075 CEST	49950	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:07.327725887 CEST	49950	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:07.327755928 CEST	443	49950	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.490936995 CEST	443	49946	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.491517067 CEST	49946	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:07.491548061 CEST	443	49946	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.491993904 CEST	49946	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:07.491998911 CEST	443	49946	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.592742920 CEST	443	49946	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.592940092 CEST	443	49946	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.593003035 CEST	49946	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:07.593075037 CEST	49946	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:07.593100071 CEST	443	49946	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.593111992 CEST	49946	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:07.593120098 CEST	443	49946	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.596739054 CEST	49951	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:07.596772909 CEST	443	49951	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.596837044 CEST	49951	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:07.596992970 CEST	49951	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:07.597003937 CEST	443	49951	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.724884033 CEST	443	49948	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.725548983 CEST	443	49949	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.725553989 CEST	49948	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:07.725569963 CEST	443	49948	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.726077080 CEST	49948	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:07.726080894 CEST	443	49948	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.726412058 CEST	49949	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:07.726432085 CEST	443	49949	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.726824045 CEST	49949	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:07.726834059 CEST	443	49949	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.745866060 CEST	443	49947	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.746391058 CEST	49947	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:07.746422052 CEST	443	49947	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.746867895 CEST	49947	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:07.746881008 CEST	443	49947	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.819906950 CEST	443	49948	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.820086956 CEST	443	49949	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.820194960 CEST	443	49949	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.820306063 CEST	49949	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:07.820343018 CEST	443	49949	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.820394993 CEST	443	49949	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.820451975 CEST	49949	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:07.820590019 CEST	49949	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:07.820626974 CEST	443	49949	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.820655107 CEST	49949	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:07.820669889 CEST	443	49949	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.820892096 CEST	443	49948	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.820941925 CEST	49948	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:07.821893930 CEST	49948	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:07.821914911 CEST	443	49948	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.821924925 CEST	49948	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:07.821929932 CEST	443	49948	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.824393988 CEST	49952	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:07.824418068 CEST	443	49952	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.824485064 CEST	49952	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:07.825020075 CEST	49953	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:07.825079918 CEST	443	49953	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.825149059 CEST	49953	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:07.825222969 CEST	49952	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:07.825237036 CEST	443	49952	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.825340033 CEST	49953	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:07.825360060 CEST	443	49953	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.845598936 CEST	443	49947	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.845669031 CEST	443	49947	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.845778942 CEST	443	49947	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.845854044 CEST	49947	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:07.846004963 CEST	49947	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:07.846138000 CEST	49947	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:07.846163988 CEST	443	49947	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.846177101 CEST	49947	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:07.846183062 CEST	443	49947	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.848934889 CEST	49954	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:07.849006891 CEST	443	49954	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.849098921 CEST	49954	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:07.849240065 CEST	49954	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:07.849271059 CEST	443	49954	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.945245028 CEST	443	49950	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.945764065 CEST	49950	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:07.945796013 CEST	443	49950	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:07.946244955 CEST	49950	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:07.946255922 CEST	443	49950	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:08.043076992 CEST	443	49950	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:08.043175936 CEST	443	49950	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:08.043246031 CEST	49950	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:08.043462038 CEST	49950	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:08.043483973 CEST	443	49950	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:08.043499947 CEST	49950	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:08.043505907 CEST	443	49950	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:08.046335936 CEST	49955	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:08.046376944 CEST	443	49955	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:08.046443939 CEST	49955	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:08.046583891 CEST	49955	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:08.046602011 CEST	443	49955	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:08.392824888 CEST	443	49951	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:08.423329115 CEST	443	49952	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:08.423418999 CEST	49951	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:08.423435926 CEST	443	49951	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:08.423927069 CEST	49951	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:08.423932076 CEST	443	49951	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:08.469521999 CEST	49952	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:08.470494032 CEST	49952	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:08.470505953 CEST	443	49952	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:08.470916986 CEST	49952	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:08.470921040 CEST	443	49952	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:08.512643099 CEST	443	49953	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:08.517987967 CEST	443	49951	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:08.518071890 CEST	443	49951	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:08.518161058 CEST	49951	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:08.563302994 CEST	49953	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:08.563916922 CEST	443	49952	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:08.564112902 CEST	443	49952	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:08.564167976 CEST	443	49952	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:08.564172983 CEST	49952	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:08.564227104 CEST	49952	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:08.600538969 CEST	443	49954	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:08.628773928 CEST	49953	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:08.628801107 CEST	443	49953	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:08.632576942 CEST	49953	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:08.632621050 CEST	443	49953	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:08.635771036 CEST	49951	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:08.635807991 CEST	443	49951	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:08.635821104 CEST	49951	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:08.635828018 CEST	443	49951	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:08.641288996 CEST	49954	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:08.643646002 CEST	49952	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:08.643663883 CEST	443	49952	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:08.643673897 CEST	49952	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:08.643678904 CEST	443	49952	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:08.655272007 CEST	49954	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:08.655291080 CEST	443	49954	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:08.655708075 CEST	49954	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:08.655719995 CEST	443	49954	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:08.727818966 CEST	443	49953	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:08.728331089 CEST	443	49953	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:08.728404045 CEST	49953	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:08.750479937 CEST	443	49954	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:08.750636101 CEST	443	49954	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:08.750710011 CEST	49954	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:08.765995979 CEST	443	49955	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:08.813153982 CEST	49955	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:08.829322100 CEST	49953	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:08.829372883 CEST	443	49953	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:08.829402924 CEST	49953	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:08.829425097 CEST	443	49953	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:08.829590082 CEST	49954	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:08.829591036 CEST	49954	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:08.829611063 CEST	443	49954	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:08.829633951 CEST	443	49954	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:08.831079006 CEST	49955	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:08.831089973 CEST	443	49955	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:08.831548929 CEST	49955	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:08.831557035 CEST	443	49955	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:08.833293915 CEST	49956	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:08.833343029 CEST	443	49956	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:08.833422899 CEST	49956	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:08.833573103 CEST	49956	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:08.833589077 CEST	443	49956	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:08.838162899 CEST	49957	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:08.838262081 CEST	443	49957	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:08.838344097 CEST	49957	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:08.839704990 CEST	49957	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:08.839740992 CEST	443	49957	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:08.840964079 CEST	49958	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:08.840984106 CEST	443	49958	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:08.841078043 CEST	49958	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:08.841245890 CEST	49958	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:08.841269016 CEST	443	49958	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:08.842075109 CEST	49959	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:08.842091084 CEST	443	49959	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:08.842154026 CEST	49959	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:08.842720032 CEST	49959	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:08.842730045 CEST	443	49959	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:08.929536104 CEST	443	49955	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:08.929687023 CEST	443	49955	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:08.929750919 CEST	49955	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:08.929894924 CEST	49955	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:08.929917097 CEST	443	49955	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:08.929929018 CEST	49955	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:08.929934978 CEST	443	49955	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:08.932621002 CEST	49960	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:08.932660103 CEST	443	49960	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:08.932729006 CEST	49960	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:08.932856083 CEST	49960	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:08.932868004 CEST	443	49960	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:09.494775057 CEST	443	49956	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:09.495242119 CEST	49956	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:09.495249987 CEST	443	49959	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:09.495260954 CEST	443	49956	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:09.495671034 CEST	49956	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:09.495676994 CEST	443	49956	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:09.495920897 CEST	49959	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:09.495930910 CEST	443	49959	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:09.495951891 CEST	443	49957	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:09.496289968 CEST	49959	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:09.496294975 CEST	443	49959	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:09.496623039 CEST	49957	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:09.496709108 CEST	443	49957	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:09.497193098 CEST	49957	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:09.497208118 CEST	443	49957	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:09.502739906 CEST	443	49958	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:09.503042936 CEST	49958	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:09.503057003 CEST	443	49958	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:09.503415108 CEST	49958	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:09.503424883 CEST	443	49958	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:09.587409973 CEST	443	49960	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:09.588052988 CEST	49960	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:09.588066101 CEST	443	49960	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:09.588551044 CEST	49960	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:09.588556051 CEST	443	49960	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:09.591466904 CEST	443	49956	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:09.591497898 CEST	443	49956	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:09.591537952 CEST	49956	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:09.591550112 CEST	443	49956	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:09.591676950 CEST	49956	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:09.591690063 CEST	443	49956	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:09.591696978 CEST	49956	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:09.591847897 CEST	443	49956	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:09.591872931 CEST	443	49956	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:09.591912031 CEST	49956	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:09.591932058 CEST	443	49959	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:09.591963053 CEST	443	49959	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:09.592000961 CEST	49959	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:09.592005014 CEST	443	49959	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:09.592015028 CEST	443	49959	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:09.592047930 CEST	49959	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:09.593003035 CEST	49959	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:09.593017101 CEST	443	49959	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:09.593024969 CEST	49959	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:09.593029976 CEST	443	49959	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:09.595912933 CEST	49961	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:09.595954895 CEST	443	49961	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:09.596015930 CEST	49961	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:09.598325968 CEST	443	49957	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:09.598407030 CEST	443	49957	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:09.598465919 CEST	49957	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:09.598954916 CEST	49962	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:09.598978996 CEST	443	49962	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:09.599030018 CEST	49962	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:09.599539042 CEST	49961	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:09.599551916 CEST	443	49961	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:09.599975109 CEST	49957	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:09.600022078 CEST	443	49957	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:09.600053072 CEST	49957	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:09.600069046 CEST	443	49957	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:09.600120068 CEST	49962	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:09.600131989 CEST	443	49962	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:09.607933044 CEST	443	49958	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:09.608014107 CEST	443	49958	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:09.608069897 CEST	49958	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:09.608104944 CEST	443	49958	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:09.608169079 CEST	443	49958	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:09.608222008 CEST	49958	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:09.609267950 CEST	49958	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:09.609298944 CEST	443	49958	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:09.609327078 CEST	49958	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:09.609340906 CEST	443	49958	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:09.611304998 CEST	49963	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:09.611351013 CEST	443	49963	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:09.611407995 CEST	49963	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:09.611607075 CEST	49963	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:09.611620903 CEST	443	49963	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:09.616234064 CEST	49964	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:09.616261959 CEST	443	49964	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:09.616319895 CEST	49964	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:09.616415977 CEST	49964	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:09.616426945 CEST	443	49964	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:09.725517035 CEST	443	49960	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:09.725584030 CEST	443	49960	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:09.725704908 CEST	49960	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:09.725714922 CEST	443	49960	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:09.725769997 CEST	49960	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:09.735394001 CEST	49960	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:09.735439062 CEST	443	49960	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:09.735476971 CEST	49960	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:09.735488892 CEST	443	49960	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:09.782874107 CEST	49965	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:09.782979965 CEST	443	49965	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:09.783077002 CEST	49965	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:09.797890902 CEST	49965	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:09.797920942 CEST	443	49965	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:10.424910069 CEST	443	49963	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:10.427016973 CEST	49963	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:10.427042961 CEST	443	49963	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:10.427299023 CEST	443	49961	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:10.427664042 CEST	49963	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:10.427670956 CEST	443	49963	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:10.428106070 CEST	49961	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:10.428123951 CEST	443	49961	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:10.428488970 CEST	49961	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:10.428493977 CEST	443	49961	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:10.453494072 CEST	443	49964	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:10.458633900 CEST	49964	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:10.458657026 CEST	443	49964	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:10.459053993 CEST	49964	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:10.459059000 CEST	443	49964	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:10.496059895 CEST	443	49962	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:10.498569012 CEST	49962	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:10.498585939 CEST	443	49962	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:10.499028921 CEST	49962	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:10.499033928 CEST	443	49962	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:10.632107019 CEST	443	49963	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:10.632194996 CEST	443	49963	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:10.632263899 CEST	49963	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:10.632555962 CEST	49963	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:10.632580042 CEST	443	49963	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:10.632611036 CEST	49963	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:10.632617950 CEST	443	49963	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:10.634193897 CEST	443	49961	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:10.634265900 CEST	443	49961	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:10.634315968 CEST	49961	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:10.635010958 CEST	49961	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:10.635032892 CEST	443	49961	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:10.635045052 CEST	49961	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:10.635051012 CEST	443	49961	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:10.637295961 CEST	443	49964	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:10.637348890 CEST	49966	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:10.637367010 CEST	443	49964	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:10.637402058 CEST	443	49966	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:10.637456894 CEST	49964	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:10.637480974 CEST	49966	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:10.638953924 CEST	49967	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:10.638991117 CEST	443	49967	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:10.639154911 CEST	49967	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:10.639216900 CEST	49964	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:10.639226913 CEST	443	49964	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:10.639240026 CEST	49964	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:10.639244080 CEST	443	49964	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:10.639493942 CEST	49966	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:10.639511108 CEST	443	49966	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:10.640693903 CEST	49967	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:10.640707970 CEST	443	49967	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:10.640746117 CEST	443	49962	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:10.640774012 CEST	443	49962	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:10.640825033 CEST	443	49962	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:10.640825033 CEST	49962	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:10.640863895 CEST	49962	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:10.641026974 CEST	49962	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:10.641026974 CEST	49962	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:10.641047001 CEST	443	49962	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:10.641058922 CEST	443	49962	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:10.642771959 CEST	49968	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:10.642812967 CEST	443	49968	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:10.642868042 CEST	49968	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:10.643007994 CEST	49968	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:10.643019915 CEST	443	49968	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:10.645781994 CEST	49969	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:10.645823956 CEST	443	49969	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:10.645963907 CEST	49969	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:10.646190882 CEST	49969	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:10.646205902 CEST	443	49969	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:10.732089043 CEST	443	49965	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:10.732609987 CEST	49965	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:10.732630968 CEST	443	49965	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:10.733277082 CEST	49965	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:10.733283043 CEST	443	49965	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:10.835340977 CEST	443	49965	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:10.835527897 CEST	443	49965	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:10.835623980 CEST	49965	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:10.835707903 CEST	49965	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:10.835733891 CEST	443	49965	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:10.835751057 CEST	49965	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:10.835757971 CEST	443	49965	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:10.838370085 CEST	49970	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:10.838413954 CEST	443	49970	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:10.838479042 CEST	49970	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:10.838604927 CEST	49970	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:10.838617086 CEST	443	49970	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:11.280576944 CEST	443	49967	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:11.280599117 CEST	443	49966	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:11.281363964 CEST	49967	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:11.281390905 CEST	443	49967	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:11.281719923 CEST	49967	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:11.281724930 CEST	443	49967	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:11.282120943 CEST	49966	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:11.282154083 CEST	443	49966	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:11.282448053 CEST	49966	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:11.282455921 CEST	443	49966	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:11.284430027 CEST	443	49968	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:11.284701109 CEST	49968	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:11.284782887 CEST	443	49968	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:11.285020113 CEST	49968	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:11.285037041 CEST	443	49968	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:11.285352945 CEST	443	49969	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:11.285594940 CEST	49969	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:11.285624027 CEST	443	49969	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:11.285936117 CEST	49969	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:11.285943031 CEST	443	49969	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:11.381283045 CEST	443	49967	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:11.381304979 CEST	443	49967	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:11.381356001 CEST	49967	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:11.381362915 CEST	443	49967	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:11.381405115 CEST	49967	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:11.381612062 CEST	49967	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:11.381633997 CEST	443	49967	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:11.381644964 CEST	49967	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:11.381650925 CEST	443	49967	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:11.382915974 CEST	443	49966	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:11.382935047 CEST	443	49966	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:11.383025885 CEST	49966	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:11.383063078 CEST	443	49966	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:11.383083105 CEST	443	49966	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:11.383111954 CEST	49966	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:11.383137941 CEST	49966	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:11.383965015 CEST	49966	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:11.384004116 CEST	443	49966	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:11.384032011 CEST	49966	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:11.384047985 CEST	443	49966	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:11.385349035 CEST	443	49969	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:11.385370970 CEST	443	49969	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:11.385411978 CEST	49969	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:11.385433912 CEST	443	49969	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:11.385755062 CEST	443	49969	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:11.385796070 CEST	49969	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:11.388073921 CEST	443	49968	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:11.388113022 CEST	443	49968	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:11.388132095 CEST	443	49968	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:11.388226986 CEST	49968	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:11.388226986 CEST	49968	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:11.388304949 CEST	443	49968	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:11.388365030 CEST	49968	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:11.388520956 CEST	49971	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:11.388586998 CEST	443	49971	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:11.388659000 CEST	49971	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:11.389564991 CEST	49969	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:11.389588118 CEST	443	49969	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:11.389625072 CEST	49969	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:11.389631987 CEST	443	49969	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:11.390738010 CEST	49971	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:11.390770912 CEST	443	49971	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:11.392052889 CEST	49972	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:11.392083883 CEST	443	49972	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:11.392158031 CEST	49972	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:11.392894030 CEST	49972	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:11.392903090 CEST	443	49972	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:11.394310951 CEST	49973	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:11.394337893 CEST	443	49973	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:11.394401073 CEST	49973	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:11.394514084 CEST	49973	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:11.394522905 CEST	443	49973	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:11.459194899 CEST	443	49970	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:11.459759951 CEST	49970	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:11.459789038 CEST	443	49970	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:11.460302114 CEST	49970	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:11.460308075 CEST	443	49970	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:11.472557068 CEST	443	49968	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:11.472628117 CEST	443	49968	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:11.472750902 CEST	49968	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:11.472750902 CEST	49968	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:11.472817898 CEST	49968	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:11.472817898 CEST	49968	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:11.472852945 CEST	443	49968	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:11.472870111 CEST	443	49968	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:11.475460052 CEST	49974	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:11.475497961 CEST	443	49974	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:11.475564003 CEST	49974	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:11.475687027 CEST	49974	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:11.475692987 CEST	443	49974	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:11.693146944 CEST	443	49970	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:11.693176031 CEST	443	49970	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:11.693197012 CEST	443	49970	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:11.693242073 CEST	49970	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:11.693272114 CEST	443	49970	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:11.693300009 CEST	49970	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:11.693320036 CEST	49970	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:11.803808928 CEST	443	49970	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:11.803858042 CEST	443	49970	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:11.803910971 CEST	49970	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:11.803939104 CEST	443	49970	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:11.803956032 CEST	443	49970	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:11.803967953 CEST	49970	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:11.803983927 CEST	49970	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:11.804017067 CEST	49970	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:11.804161072 CEST	49970	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:11.804178953 CEST	443	49970	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:11.804191113 CEST	49970	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:11.804195881 CEST	443	49970	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:11.806919098 CEST	49975	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:11.806972980 CEST	443	49975	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:11.807035923 CEST	49975	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:11.807179928 CEST	49975	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:11.807194948 CEST	443	49975	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:12.134821892 CEST	443	49971	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:12.135865927 CEST	49971	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:12.135900974 CEST	443	49971	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:12.136315107 CEST	49971	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:12.136320114 CEST	443	49971	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:12.142745972 CEST	443	49973	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:12.143055916 CEST	49973	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:12.143071890 CEST	443	49973	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:12.143472910 CEST	49973	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:12.143479109 CEST	443	49973	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:12.152873039 CEST	443	49972	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:12.153281927 CEST	49972	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:12.153304100 CEST	443	49972	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:12.153634071 CEST	49972	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:12.153640032 CEST	443	49972	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:12.226198912 CEST	443	49974	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:12.244324923 CEST	443	49971	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:12.244352102 CEST	443	49971	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:12.244617939 CEST	49971	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:12.244656086 CEST	443	49971	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:12.244708061 CEST	49971	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:12.245424032 CEST	443	49971	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:12.245484114 CEST	443	49971	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:12.245537996 CEST	49971	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:12.245625973 CEST	443	49973	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:12.245702982 CEST	443	49973	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:12.245745897 CEST	49973	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:12.267776012 CEST	49974	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:12.267776012 CEST	49974	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:12.267796040 CEST	443	49974	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:12.268250942 CEST	49974	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:12.268256903 CEST	443	49974	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:12.270857096 CEST	443	49972	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:12.270878077 CEST	443	49972	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:12.270931005 CEST	443	49972	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:12.270944118 CEST	49972	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:12.270983934 CEST	49972	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:12.271163940 CEST	49972	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:12.271179914 CEST	443	49972	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:12.271188974 CEST	49972	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:12.271194935 CEST	443	49972	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:12.273675919 CEST	49971	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:12.273675919 CEST	49971	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:12.273753881 CEST	443	49971	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:12.273785114 CEST	443	49971	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:12.274240971 CEST	49973	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:12.274270058 CEST	443	49973	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:12.274285078 CEST	49973	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:12.274291039 CEST	443	49973	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:12.290869951 CEST	49976	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:12.290977955 CEST	443	49976	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:12.291171074 CEST	49976	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:12.291908979 CEST	49977	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:12.291945934 CEST	443	49977	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:12.292006969 CEST	49977	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:12.292517900 CEST	49976	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:12.292552948 CEST	443	49976	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:12.292576075 CEST	49977	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:12.292589903 CEST	443	49977	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:12.293596029 CEST	49978	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:12.293611050 CEST	443	49978	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:12.293658018 CEST	49978	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:12.293771982 CEST	49978	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:12.293787003 CEST	443	49978	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:12.362344980 CEST	443	49974	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:12.362422943 CEST	443	49974	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:12.362478971 CEST	49974	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:12.362664938 CEST	49974	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:12.362679005 CEST	443	49974	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:12.362723112 CEST	49974	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:12.362728119 CEST	443	49974	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:12.365335941 CEST	49979	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:12.365436077 CEST	443	49979	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:12.365531921 CEST	49979	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:12.365652084 CEST	49979	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:12.365672112 CEST	443	49979	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:12.465420008 CEST	443	49975	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:12.465940952 CEST	49975	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:12.465970993 CEST	443	49975	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:12.466375113 CEST	49975	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:12.466379881 CEST	443	49975	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:12.569511890 CEST	443	49975	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:12.570272923 CEST	443	49975	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:12.570329905 CEST	49975	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:12.570414066 CEST	49975	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:12.570442915 CEST	443	49975	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:12.570455074 CEST	49975	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:12.570460081 CEST	443	49975	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:12.578031063 CEST	49980	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:12.578063011 CEST	443	49980	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:12.578126907 CEST	49980	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:12.578265905 CEST	49980	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:12.578278065 CEST	443	49980	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:13.160872936 CEST	443	49976	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:13.162075043 CEST	443	49979	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:13.162144899 CEST	443	49977	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:13.162218094 CEST	443	49978	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:13.162396908 CEST	49976	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:13.162476063 CEST	443	49976	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:13.162887096 CEST	49976	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:13.162909031 CEST	443	49976	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:13.163204908 CEST	49979	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:13.163222075 CEST	443	49979	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:13.163626909 CEST	49979	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:13.163638115 CEST	443	49979	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:13.163921118 CEST	49977	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:13.163949013 CEST	443	49977	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:13.164277077 CEST	49977	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:13.164284945 CEST	443	49977	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:13.164551973 CEST	49978	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:13.164572001 CEST	443	49978	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:13.164957047 CEST	49978	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:13.164963007 CEST	443	49978	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:13.270431042 CEST	443	49976	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:13.270518064 CEST	443	49976	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:13.270637035 CEST	443	49978	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:13.270659924 CEST	49976	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:13.270693064 CEST	443	49978	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:13.270742893 CEST	443	49977	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:13.270790100 CEST	49978	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:13.270821095 CEST	443	49977	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:13.270915031 CEST	49976	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:13.270926952 CEST	443	49977	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:13.270935059 CEST	443	49976	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:13.270953894 CEST	49976	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:13.270956993 CEST	49977	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:13.270961046 CEST	443	49976	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:13.270986080 CEST	49977	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:13.272176027 CEST	49978	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:13.272197008 CEST	443	49978	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:13.272208929 CEST	49978	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:13.272208929 CEST	49977	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:13.272218943 CEST	443	49978	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:13.272227049 CEST	443	49977	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:13.272234917 CEST	49977	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:13.272238016 CEST	443	49977	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:13.274492025 CEST	443	49979	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:13.274630070 CEST	49981	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:13.274682999 CEST	443	49981	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:13.275316954 CEST	443	49979	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:13.275579929 CEST	49981	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:13.275582075 CEST	49979	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:13.275753975 CEST	49981	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:13.275777102 CEST	443	49981	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:13.275798082 CEST	49979	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:13.275808096 CEST	443	49979	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:13.275819063 CEST	49979	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:13.275824070 CEST	443	49979	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:13.337833881 CEST	443	49980	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:13.338666916 CEST	49980	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:13.338685036 CEST	443	49980	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:13.339134932 CEST	49980	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:13.339143991 CEST	443	49980	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:13.436825991 CEST	443	49980	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:13.437226057 CEST	443	49980	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:13.437450886 CEST	49980	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:13.437549114 CEST	49980	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:13.437572002 CEST	443	49980	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:13.437601089 CEST	49980	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:13.437609911 CEST	443	49980	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:13.899576902 CEST	443	49981	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:13.909686089 CEST	49981	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:13.909699917 CEST	443	49981	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:13.910186052 CEST	49981	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:13.910191059 CEST	443	49981	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:14.005392075 CEST	443	49981	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:14.005460978 CEST	443	49981	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:14.005525112 CEST	49981	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:14.005726099 CEST	49981	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:14.005745888 CEST	443	49981	13.107.246.45	192.168.2.11
Oct 8, 2024 00:42:14.005757093 CEST	49981	443	192.168.2.11	13.107.246.45
Oct 8, 2024 00:42:14.005762100 CEST	443	49981	13.107.246.45	192.168.2.11

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 8, 2024 00:41:27.969573021 CEST	1.1.1.1	192.168.2.11	0xb15	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 00:41:27.969573021 CEST	1.1.1.1	192.168.2.11	0xb15	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

46.8.231.109

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.11	49713	46.8.231.109	80	7544	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 00:41:29.887499094 CEST	87	OUT	GET / HTTP/1.1 Host: 46.8.231.109 Connection: Keep-Alive Cache-Control: no-cache

Target ID:	0
Start time:	18:41:28
Start date:	07/10/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe"
Imagebase:	0xec0000
File size:	505'344 bytes
MD5 hash:	802FAF03A51FCC731A15541960379D60
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	18:41:28
Start date:	07/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0x110000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	18:41:28
Start date:	07/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0xce0000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000003.00000002.1778918680.00000000012E7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000003.00000002.1778401976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000003.00000002.1778401976.000000000049A000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	18:41:28
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7452 -s 280
Imagebase:	0x4d0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	18:42:12
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7544 -s 1260
Imagebase:	0x4d0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	6.2%
Total number of Nodes:	290
Total number of Limit Nodes:	4

Executed Functions

Function 00EC2021 Relevance: 7.6, APIs: 1, Strings: 3, Instructions: 631
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(00F3A6D8,?,00000040,?), ref: 00EC2738

Strings

S, xrefs: 00EC206A
', xrefs: 00EC2718
a, xrefs: 00EC2296

Memory Dump Source

Source File: 00000000.00000002.1460473272.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1460419523.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460524537.0000000000EE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460614447.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460637460.0000000000F3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460667321.0000000000F3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: '$S$a
API String ID: 544645111-1060379873
Opcode ID: 9f39f503f15ca8fada4268104b375747f5221f963933e8acc39f507e52c59b83
Instruction ID: 1aeb66dd73b517a4414d4d04bac250c15d5262ea7a2a2fc0279b9edf901d9ab0
Opcode Fuzzy Hash: 9f39f503f15ca8fada4268104b375747f5221f963933e8acc39f507e52c59b83
Instruction Fuzzy Hash: DFF1D117934E1B06E70860394E527E5954AD7AA330F91633FBF62BB3F4E36B09439245

Function 00ED6368 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE(?,00ED8F1C,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00ED639C
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00ED8F1C,?,?,00000000,?,00000000), ref: 00ED63BA

Strings

R[, xrefs: 00ED6396

Memory Dump Source

Source File: 00000000.00000002.1460473272.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1460419523.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460524537.0000000000EE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460614447.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460637460.0000000000F3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460667321.0000000000F3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: String
String ID: R[
API String ID: 2568140703-3972925902
Opcode ID: 9e55260f860fa02fd2c195a75c5c4e6eba1323cda7edd84aa37e2f76effc924e
Instruction ID: afd909be6778611ff3529e274dc0d6a0bdc53fcae1a66eacd9c579a136145a55
Opcode Fuzzy Hash: 9e55260f860fa02fd2c195a75c5c4e6eba1323cda7edd84aa37e2f76effc924e
Instruction Fuzzy Hash: 3EF07A3200015ABBCF125FA1DC09DDE3F66EF88360F059011FA186A220C732D976AB90

Function 00ED8E2E Relevance: 4.7, APIs: 3, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__freea.LIBCMT ref: 00ED8FDD

Part of subcall function 00ED3A83: HeapAlloc.KERNEL32(00000000,00EDA1AA,?,?,00EDA1AA,00000220,?,?,?), ref: 00ED3AB5

__freea.LIBCMT ref: 00ED8FF2
__freea.LIBCMT ref: 00ED9002

Memory Dump Source

Source File: 00000000.00000002.1460473272.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1460419523.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460524537.0000000000EE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460614447.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460637460.0000000000F3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460667321.0000000000F3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: __freea$AllocHeap
String ID:
API String ID: 85559729-0
Opcode ID: c6754509f9232021e150629ed8aafd4ff594ad1478cdd526a43aabe8ab5cae3a
Instruction ID: 5f04bf52f453b61b33a271ab43b260c01f4710302eb2ed3a00eb81c618b77146
Opcode Fuzzy Hash: c6754509f9232021e150629ed8aafd4ff594ad1478cdd526a43aabe8ab5cae3a
Instruction Fuzzy Hash: BA51917270021AAFEB219F64CE81EBB77AAEF44754B15112AFD08F6351EB31CC528660

Function 00EDA3A6 Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00ED9ED6: GetOEMCP.KERNEL32(00000000,?,?,?,?), ref: 00ED9F01

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,00EDA1ED,?,00000000,?,?,?), ref: 00EDA407
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,00EDA1ED,?,00000000,?,?,?), ref: 00EDA449

Memory Dump Source

Source File: 00000000.00000002.1460473272.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1460419523.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460524537.0000000000EE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460614447.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460637460.0000000000F3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460667321.0000000000F3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 2ccb3718a5ea153fa484e298fd17724c1120cee4ef2db9d6cb33d77888253341
Instruction ID: 171f2991c73c59931ae8b292428f28f9f08668ebd1ffa84d3d17b50ec3e996ac
Opcode Fuzzy Hash: 2ccb3718a5ea153fa484e298fd17724c1120cee4ef2db9d6cb33d77888253341
Instruction Fuzzy Hash: BF512871A002459FDB21CF75C8456AABBE5EF81308F1C607FD092AB352E7B49A47CB52

Function 00ED9FAA Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(E8458D00,?,00EDA1F9,00EDA1ED,00000000), ref: 00ED9FDC

Memory Dump Source

Source File: 00000000.00000002.1460473272.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1460419523.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460524537.0000000000EE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460614447.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460637460.0000000000F3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460667321.0000000000F3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: 344bdef0a12a514c6f97034786dfde4b19fea322c847f716849bfb51d2c695bb
Instruction ID: c5ab0471b2b429078723320255feadf21b97e7aee5fd45a3ddcfdef1e6d101b3
Opcode Fuzzy Hash: 344bdef0a12a514c6f97034786dfde4b19fea322c847f716849bfb51d2c695bb
Instruction Fuzzy Hash: 2A515D719041589EDB218E28CD80BE67BB8EB45304F2815FEE19AE7282C2759E47DB21

Non-executed Functions

Function 00EDC9E9 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 183
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00ED4EB1: GetLastError.KERNEL32(?,00000008,00ED9482), ref: 00ED4EB5
Part of subcall function 00ED4EB1: SetLastError.KERNEL32(00000000,00EEC480,00000024,00ED0419), ref: 00ED4F57

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 00EDCAF5
IsValidCodePage.KERNEL32(00000000), ref: 00EDCB3E
IsValidLocale.KERNEL32(?,00000001), ref: 00EDCB4D
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00EDCB95
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00EDCBB4

Strings

||, xrefs: 00EDCA4E

Memory Dump Source

Source File: 00000000.00000002.1460473272.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1460419523.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460524537.0000000000EE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460614447.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460637460.0000000000F3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460667321.0000000000F3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID: ||
API String ID: 415426439-2950303532
Opcode ID: fece7ab4aed3dc757b6294947fddf9ffa98311347c633dadb0ea12b79d8efde8
Instruction ID: 6b61c2353dd773ac890e15197373483ed445a3774b79198c89e4e3662681efe7
Opcode Fuzzy Hash: fece7ab4aed3dc757b6294947fddf9ffa98311347c633dadb0ea12b79d8efde8
Instruction Fuzzy Hash: AD517271A0020A9FDB10DFA5CC45AAE77B8FF49784F24546BE911FB290E770D906CB61

Function 00EDD39B Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00EDD57F

Strings

1#INF, xrefs: 00EDD4D1
1#QNAN, xrefs: 00EDD4AE
1#IND, xrefs: 00EDD4A0
1#SNAN, xrefs: 00EDD4A7

Memory Dump Source

Source File: 00000000.00000002.1460473272.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1460419523.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460524537.0000000000EE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460614447.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460637460.0000000000F3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460667321.0000000000F3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 68ed365e4e41049db4c55fc87faea965f34adcb6a8070042ba7cd134f2ff22bc
Instruction ID: 63bb56c8b7b9cd0758e9854dbec1a7da5aa000fffe51977e957cab4854b540a0
Opcode Fuzzy Hash: 68ed365e4e41049db4c55fc87faea965f34adcb6a8070042ba7cd134f2ff22bc
Instruction Fuzzy Hash: FFD2F571E082298FDB659E28DD447EAB7B5EB84309F1451EAD40DF7340E778AE828F41

Function 00EDC085 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00ED4EB1: GetLastError.KERNEL32(?,00000008,00ED9482), ref: 00ED4EB5
Part of subcall function 00ED4EB1: SetLastError.KERNEL32(00000000,00EEC480,00000024,00ED0419), ref: 00ED4F57

GetACP.KERNEL32(?,?,?,?,?,?,00ED1848,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00EDC146
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00ED1848,?,?,?,00000055,?,-00000050,?,?), ref: 00EDC171
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00EDC2D4

Strings

utf8, xrefs: 00EDC243
||, xrefs: 00EDC0C7

Memory Dump Source

Source File: 00000000.00000002.1460473272.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1460419523.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460524537.0000000000EE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460614447.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460637460.0000000000F3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460667321.0000000000F3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8$||
API String ID: 607553120-644368747
Opcode ID: 4f6672bee9cd1ebf4e259a709af4051743ce307fff7a7e0c4b0ef1814e817c5c
Instruction ID: 0cbf5e0fe631ea31635ba3a969cbefbea2789d078eae084615879b40d10befcf
Opcode Fuzzy Hash: 4f6672bee9cd1ebf4e259a709af4051743ce307fff7a7e0c4b0ef1814e817c5c
Instruction Fuzzy Hash: F871E671600607AADB24BB75CC46BAA73E8EF44784F24606BF505F7391E670D942C7A0

Function 00EDC814 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00EDCB32,00000002,00000000,?,?,?,00EDCB32,?,00000000), ref: 00EDC8AD
GetLocaleInfoW.KERNEL32(?,20001004,00EDCB32,00000002,00000000,?,?,?,00EDCB32,?,00000000), ref: 00EDC8D6
GetACP.KERNEL32(?,?,00EDCB32,?,00000000), ref: 00EDC8EB

Strings

ACP, xrefs: 00EDC832
OCP, xrefs: 00EDC868

Memory Dump Source

Source File: 00000000.00000002.1460473272.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1460419523.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460524537.0000000000EE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460614447.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460637460.0000000000F3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460667321.0000000000F3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: f03fa993d7acd41e2f6cf48294bf9c68e4ffef50bd35f5cb00131fdb767b63e4
Instruction ID: c94dab2cd7ad06237558f9edf4e97bad22e469efba67a787982e48340af25935
Opcode Fuzzy Hash: f03fa993d7acd41e2f6cf48294bf9c68e4ffef50bd35f5cb00131fdb767b63e4
Instruction Fuzzy Hash: 6A21953AA00107DADB288F65C941E9773A6EF54BD8B765426E909F7310EB32ED42E350

Function 00ECFEF0 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 449COMMONLIBRARYCODE

Download Yara Rule

Strings

G, xrefs: 00ECFF0B, 00ED008E, 00ED02B7, 00ED0250, 00ED00DD
G, xrefs: 00ED0233, 00ED0211

Memory Dump Source

Source File: 00000000.00000002.1460473272.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1460419523.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460524537.0000000000EE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460614447.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460637460.0000000000F3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460667321.0000000000F3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: G$G
API String ID: 0-3574868976
Opcode ID: b78e9bc5a25061f1abca4818c36b3245c47596756df3441acd3b4668cd2eb70a
Instruction ID: 42bb071ca33cedb590402e8a02130422c30c219355cf9a5a312174aefd535617
Opcode Fuzzy Hash: b78e9bc5a25061f1abca4818c36b3245c47596756df3441acd3b4668cd2eb70a
Instruction Fuzzy Hash: D2F13E71E012199FDF14CFA8C980BADB7B1FF88314F19926AE815BB391D7319D028B90

Function 00ED3C92 Relevance: 6.3, APIs: 4, Instructions: 337COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00ED3D1F

Memory Dump Source

Source File: 00000000.00000002.1460473272.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1460419523.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460524537.0000000000EE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460614447.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460637460.0000000000F3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460667321.0000000000F3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 40f0e063838af908aa0c23a01ee66fead67f3bdac29e3056e6e3dd52480c6ad0
Instruction ID: 1ab1a7f85b930a8aeb28881d2d5021298126f01bf3d218249e48ff5f4aa595d6
Opcode Fuzzy Hash: 40f0e063838af908aa0c23a01ee66fead67f3bdac29e3056e6e3dd52480c6ad0
Instruction Fuzzy Hash: E6B12572E042499FDB158F78C881BEEBBB5EF55304F14516BE804BB381D2359E06CBA2

Function 00EC7922 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00EC792E
IsDebuggerPresent.KERNEL32 ref: 00EC79FA
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00EC7A13
UnhandledExceptionFilter.KERNEL32(?), ref: 00EC7A1D

Memory Dump Source

Source File: 00000000.00000002.1460473272.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1460419523.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460524537.0000000000EE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460614447.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460637460.0000000000F3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460667321.0000000000F3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 96d99cd869398a5b641d89833a8ee8078cefdaf7b8107f97cd79c44632fe3c71
Instruction ID: 19668507028baf66f4d651e777ccfbedc7a8e7b474497391e6bb85af183ddfc2
Opcode Fuzzy Hash: 96d99cd869398a5b641d89833a8ee8078cefdaf7b8107f97cd79c44632fe3c71
Instruction Fuzzy Hash: 4631F975D0521C9BDB20DFA5DA89BCDBBB8AF08304F1051EAE40CAB250EB719B858F45

Function 00EDC498 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00ED4EB1: GetLastError.KERNEL32(?,00000008,00ED9482), ref: 00ED4EB5
Part of subcall function 00ED4EB1: SetLastError.KERNEL32(00000000,00EEC480,00000024,00ED0419), ref: 00ED4F57

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00EDC4EC
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00EDC536
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00EDC5FC

Memory Dump Source

Source File: 00000000.00000002.1460473272.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1460419523.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460524537.0000000000EE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460614447.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460637460.0000000000F3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460667321.0000000000F3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 1a1f1ba36339d63294e8e0e9bbbd406f747fe601be05e6601d8d753eeabbd1bc
Instruction ID: 22034e0115797ec088805d48b57cd277848ba862975e740f9440c8ff8b3c755b
Opcode Fuzzy Hash: 1a1f1ba36339d63294e8e0e9bbbd406f747fe601be05e6601d8d753eeabbd1bc
Instruction Fuzzy Hash: 8261B2725001079FDB28DF24CD82BBA77A8EF04784F20617BE915E6389EB35E942CB50

Function 00ECDA73 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 00ECDB6B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00ECDB75
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 00ECDB82

Memory Dump Source

Source File: 00000000.00000002.1460473272.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1460419523.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460524537.0000000000EE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460614447.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460637460.0000000000F3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460667321.0000000000F3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 01c0fd59a7dcb20f33440275e9b1e1150662ebd24036767fad87c24681b13854
Instruction ID: e853b57eeb1ba8751ca73b1c60191344dd4fb7d29c1e3d0ceb5bbdeb7cabdc16
Opcode Fuzzy Hash: 01c0fd59a7dcb20f33440275e9b1e1150662ebd24036767fad87c24681b13854
Instruction Fuzzy Hash: 9631B27490122CABCB21DF65DD89B8DBBF8AF08310F5051EAE41CA7250EB759F868F44

Function 00ED622B Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00ED23AE,?,20001004,00000000,00000002,?,?,00ED19B0), ref: 00ED625F

Strings

R[, xrefs: 00ED624A

Memory Dump Source

Source File: 00000000.00000002.1460473272.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1460419523.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460524537.0000000000EE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460614447.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460637460.0000000000F3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460667321.0000000000F3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: R[
API String ID: 2299586839-3972925902
Opcode ID: c5d6a76a03ef5465534c51d17bde605ce30c3cca3991bfbf404e33a640c8f7d0
Instruction ID: b219498e45af5676ab7eecdcc12cae99e082186b1aba1c535147c8d9ce4e7853
Opcode Fuzzy Hash: c5d6a76a03ef5465534c51d17bde605ce30c3cca3991bfbf404e33a640c8f7d0
Instruction Fuzzy Hash: A1E04F3250026CBBCF122F61DC08AAE7F6AEF44760F009016FD0576321DB728E26AA91

Function 00ED572C Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00ED5727,?,?,00000008,?,?,00EE15F5,00000000), ref: 00ED5959

Memory Dump Source

Source File: 00000000.00000002.1460473272.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1460419523.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460524537.0000000000EE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460614447.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460637460.0000000000F3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460667321.0000000000F3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 14efc9bb629b25864de14cd1b91916394a1430c3719440b545bb353bfc7faa46
Instruction ID: ae7d386ef3d99ff3a65bfaf9bc6b27190e62f630c5420e915d9a4919eb79f0a9
Opcode Fuzzy Hash: 14efc9bb629b25864de14cd1b91916394a1430c3719440b545bb353bfc7faa46
Instruction Fuzzy Hash: DEB15E36610A04CFD719CF28C496BA47BE0FF45368F25965AE899DF3A1C335E982CB40

Function 00EC729C Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00EC72B2

Memory Dump Source

Source File: 00000000.00000002.1460473272.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1460419523.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460524537.0000000000EE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460614447.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460637460.0000000000F3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460667321.0000000000F3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 76d2db2617c000ce84370efeec04339403764a02b7cc25198a948389820f9f14
Instruction ID: 1f9d3d9abe6c01a411dc4fa9b6fcf8e88fccc306c763a36c22415e761e2e690e
Opcode Fuzzy Hash: 76d2db2617c000ce84370efeec04339403764a02b7cc25198a948389820f9f14
Instruction Fuzzy Hash: 22A17D719182488FDB14CF69DDC2799BBB2FB88324F18912EE459FB2A0C3359946CF50

Function 00ED9ABF Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1460473272.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1460419523.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460524537.0000000000EE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460614447.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460637460.0000000000F3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460667321.0000000000F3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c761b12454707ee31dcf6d7bdefc1476634a1133059bb94c791fbdba71b2faba
Instruction ID: 0f2ff7033ce86d5a967157a239d1d089464fd8a0c54e5a6c1589a4fbbe9e5953
Opcode Fuzzy Hash: c761b12454707ee31dcf6d7bdefc1476634a1133059bb94c791fbdba71b2faba
Instruction Fuzzy Hash: 05310B76900219AFCB20DFB9CCC5EBBB7BDEB84314F14415AF805A7345E630AE418B54

Function 00ECCAF2 Relevance: 1.6, Strings: 1, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00ECCC80

Memory Dump Source

Source File: 00000000.00000002.1460473272.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1460419523.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460524537.0000000000EE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460614447.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460637460.0000000000F3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460667321.0000000000F3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: c334d12d3ceb948ea4bf6cbff0d64099af32e41953097943e9040ca50387c667
Instruction ID: f5dc291be0fcb1d2bf7ae1e58999a017e610305258e71f73267c9209c8772826
Opcode Fuzzy Hash: c334d12d3ceb948ea4bf6cbff0d64099af32e41953097943e9040ca50387c667
Instruction Fuzzy Hash: 92C1AF705006498FCB24CF68C681FBABBB1AB45318F346A5DD45EB7291C732AD47CB51

Function 00EDC6EB Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00ED4EB1: GetLastError.KERNEL32(?,00000008,00ED9482), ref: 00ED4EB5
Part of subcall function 00ED4EB1: SetLastError.KERNEL32(00000000,00EEC480,00000024,00ED0419), ref: 00ED4F57

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00EDC73F

Memory Dump Source

Source File: 00000000.00000002.1460473272.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1460419523.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460524537.0000000000EE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460614447.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460637460.0000000000F3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460667321.0000000000F3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 8b0a8adf4e520302a6026a92e75d78b3ab940b09f8ae1b7293ab810cc8c848b2
Instruction ID: d5b25d90c13093e96fd914f2ffb3c502b3027ec08342a00448594493e2a45aa0
Opcode Fuzzy Hash: 8b0a8adf4e520302a6026a92e75d78b3ab940b09f8ae1b7293ab810cc8c848b2
Instruction Fuzzy Hash: 09217172505207ABEB189E35DC41ABA77E8EF44354B20206BFD05E6281EB34DD46CB50

Function 00EDC372 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00ED4EB1: GetLastError.KERNEL32(?,00000008,00ED9482), ref: 00ED4EB5
Part of subcall function 00ED4EB1: SetLastError.KERNEL32(00000000,00EEC480,00000024,00ED0419), ref: 00ED4F57

EnumSystemLocalesW.KERNEL32(00EDC498,00000001,00000000,?,-00000050,?,00EDCAC9,00000000,?,?,?,00000055,?), ref: 00EDC3E4

Memory Dump Source

Source File: 00000000.00000002.1460473272.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1460419523.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460524537.0000000000EE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460614447.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460637460.0000000000F3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460667321.0000000000F3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: e5724a2a974a18716ef7d8a19a11750e924a26b09ee68abcc0268254ec07d011
Instruction ID: e3d8eebe4eb73f0e227d0ed8299cc6500b1ad11898c91c51b5ad3e172f1fdf6b
Opcode Fuzzy Hash: e5724a2a974a18716ef7d8a19a11750e924a26b09ee68abcc0268254ec07d011
Instruction Fuzzy Hash: B71129362003065FDB189F39C8A15BAB7A1FF803A8B24842EE947A7B40D371A943C740

Function 00EDC91A Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00ED4EB1: GetLastError.KERNEL32(?,00000008,00ED9482), ref: 00ED4EB5
Part of subcall function 00ED4EB1: SetLastError.KERNEL32(00000000,00EEC480,00000024,00ED0419), ref: 00ED4F57

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00EDC6B4,00000000,00000000,?), ref: 00EDC946

Memory Dump Source

Source File: 00000000.00000002.1460473272.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1460419523.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460524537.0000000000EE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460614447.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460637460.0000000000F3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460667321.0000000000F3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 3ff3452e4354468ba0e14e5a6797c47eb9d7bd6fdba3fbf8a3a71d6e7421ffef
Instruction ID: bb656152411eee43d66e778d273d5042d90158f891572e4a2503421193335714
Opcode Fuzzy Hash: 3ff3452e4354468ba0e14e5a6797c47eb9d7bd6fdba3fbf8a3a71d6e7421ffef
Instruction Fuzzy Hash: 3DF0F933500113BBDB245A318815BBA77A8EF80798F24442AEC02B7380EA30FE43C590

Function 00EDC40D Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00ED4EB1: GetLastError.KERNEL32(?,00000008,00ED9482), ref: 00ED4EB5
Part of subcall function 00ED4EB1: SetLastError.KERNEL32(00000000,00EEC480,00000024,00ED0419), ref: 00ED4F57

EnumSystemLocalesW.KERNEL32(00EDC6EB,00000001,?,?,-00000050,?,00EDCA8D,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 00EDC457

Memory Dump Source

Source File: 00000000.00000002.1460473272.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1460419523.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460524537.0000000000EE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460614447.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460637460.0000000000F3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460667321.0000000000F3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 4a8de2f8b49fd99db2263cbcda2901a5760b6d1a3a227ef2c3bd422b82fa9d08
Instruction ID: a7c63b5e5ca999192286e4b1cbb023e63063738ca7cad34ab0fce4daeca9d83f
Opcode Fuzzy Hash: 4a8de2f8b49fd99db2263cbcda2901a5760b6d1a3a227ef2c3bd422b82fa9d08
Instruction Fuzzy Hash: AAF0C2362003056FDB145F79DC91A7ABBA5EB80BACF25842EF9469B790C6B19C43CA50

Function 00ED5D7F Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00ECDDC1: EnterCriticalSection.KERNEL32(?,?,00ED4B89,?,00EEC2E0,00000008,00ED4D4D,?,00ECC446,?), ref: 00ECDDD0

EnumSystemLocalesW.KERNEL32(00ED5D72,00000001,00EEC3A0,0000000C,00ED6127,00000000), ref: 00ED5DB7

Memory Dump Source

Source File: 00000000.00000002.1460473272.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1460419523.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460524537.0000000000EE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460614447.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460637460.0000000000F3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460667321.0000000000F3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: bf7aecb133303ac8182945c2ccf74e69e525992c21017c70a9c02ddc7e70397f
Instruction ID: aa16ace14c3ad7557728e48626125921e44e01663d57618ca8b25a4468c26e0d
Opcode Fuzzy Hash: bf7aecb133303ac8182945c2ccf74e69e525992c21017c70a9c02ddc7e70397f
Instruction Fuzzy Hash: FAF04972A04308EFD700EF99E886B9D7BF1EB44721F20912AF511AB3A0C7B65946CF50

Function 00EDC327 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00ED4EB1: GetLastError.KERNEL32(?,00000008,00ED9482), ref: 00ED4EB5
Part of subcall function 00ED4EB1: SetLastError.KERNEL32(00000000,00EEC480,00000024,00ED0419), ref: 00ED4F57

EnumSystemLocalesW.KERNEL32(00EDC280,00000001,?,?,?,00EDCAEB,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00EDC35E

Memory Dump Source

Source File: 00000000.00000002.1460473272.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1460419523.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460524537.0000000000EE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460614447.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460637460.0000000000F3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460667321.0000000000F3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 636440a8010ebb331a1a6a09eb476caddb275a1b292437c03194ad13400ba789
Instruction ID: ea4ad7676d5e1df6276eb1049c2beda090b1021fd49691ccb6f4afd7d1212a11
Opcode Fuzzy Hash: 636440a8010ebb331a1a6a09eb476caddb275a1b292437c03194ad13400ba789
Instruction Fuzzy Hash: C2F0E53630020667CB149F75D84566ABF94EFC1BA4B16409AEE099F790C6729947C790

Function 00EC7AAF Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00007ABB,00EC6DC9), ref: 00EC7AB4

Memory Dump Source

Source File: 00000000.00000002.1460473272.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1460419523.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460524537.0000000000EE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460614447.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460637460.0000000000F3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460667321.0000000000F3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: f5b996170c7183871d10408e1522c88fa091cd1c3e39145ed22dd5452915309b
Instruction ID: bd491b183be81577c26df94735f19143bf9034497f3b0da1b4369b5775d64a1a
Opcode Fuzzy Hash: f5b996170c7183871d10408e1522c88fa091cd1c3e39145ed22dd5452915309b
Instruction Fuzzy Hash:

Function 00EC1D79 Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

Z81xbyuAua, xrefs: 00EC1E9B

Memory Dump Source

Source File: 00000000.00000002.1460473272.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1460419523.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460524537.0000000000EE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460614447.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460637460.0000000000F3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460667321.0000000000F3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: Z81xbyuAua
API String ID: 0-3121583705
Opcode ID: 356d9eb602d1b056b988e97843185534f1851b5b4d3569c3ccceae12d1651277
Instruction ID: 690ff31bfad8476884ee46426d2084497e0f1b38e89ac4935cdab06fd67ced8b
Opcode Fuzzy Hash: 356d9eb602d1b056b988e97843185534f1851b5b4d3569c3ccceae12d1651277
Instruction Fuzzy Hash: DB412D76E2052B4BCB0CEEB885565EFBB64DB46314B04527EDD11EB3D2E2318A02C6D0

Function 00EDCC4B Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00EDCC4B

Memory Dump Source

Source File: 00000000.00000002.1460473272.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1460419523.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460524537.0000000000EE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460614447.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460637460.0000000000F3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460667321.0000000000F3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 12db137077040e4c5aa48ec8e09566f84f4ff5ee364ffc004b19c7258fd5146b
Instruction ID: 81f958becbdb4069c4fd57a8ceb09aa6f6275458edc11c41cf32132d913cbab4
Opcode Fuzzy Hash: 12db137077040e4c5aa48ec8e09566f84f4ff5ee364ffc004b19c7258fd5146b
Instruction Fuzzy Hash: 07A02430103104CF4300CF355F4D30C37D557C41D0704405C7000C5030D73045407F41

Function 00EDBB36 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1460473272.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1460419523.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460524537.0000000000EE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460614447.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460637460.0000000000F3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460667321.0000000000F3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ErrorLastProcess$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 3471368781-0
Opcode ID: ec825f58c03656e5ab77048c7c1cf2e0912df3393ebc4b0219222b07f62bfcb5
Instruction ID: 4790f783b6dd85fc525c8fb5dc972192ee54811e00b72ccef74b5f082311f098
Opcode Fuzzy Hash: ec825f58c03656e5ab77048c7c1cf2e0912df3393ebc4b0219222b07f62bfcb5
Instruction Fuzzy Hash: 62B1D3355007458BCB389B25CC92ABAB3E9FF44308F15552EE982E6780FB75A987CB10

Function 00EDA64C Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1460473272.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1460419523.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460524537.0000000000EE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460614447.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460637460.0000000000F3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460667321.0000000000F3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d30a52f00f890bd01d6e84b1357bca7669443c8ff688bb46904ed1c21e63159d
Instruction ID: db4760e163c97f1d5ad9a358422b18211d3e4b2c169e126f77e0a437cec9833c
Opcode Fuzzy Hash: d30a52f00f890bd01d6e84b1357bca7669443c8ff688bb46904ed1c21e63159d
Instruction Fuzzy Hash: 30E08C32921238EBCB24DB98C90499AF3ECEB44B04B1904A7B512E3210C270DF01C7D0

Function 00F06628 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1460419523.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460473272.0000000000EC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460524537.0000000000EE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460614447.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460637460.0000000000F3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460667321.0000000000F3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00EC2003 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1460473272.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1460419523.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460524537.0000000000EE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460614447.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460637460.0000000000F3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460667321.0000000000F3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bb51c03439cb7fae2f008cd3f176d3f2c81b2bfb1cd8a69a81c2171d2bbd278
Instruction ID: f2018ddc9465e8f3086f726f39a8b70dcf2c28a593569670b75b1bda9327f386
Opcode Fuzzy Hash: 7bb51c03439cb7fae2f008cd3f176d3f2c81b2bfb1cd8a69a81c2171d2bbd278
Instruction Fuzzy Hash: 23D0923A6119149FC210CF19E440941F7B5FB996307164156E94497720C330FC01CAD0

Function 00ED0F2E Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1460473272.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1460419523.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460524537.0000000000EE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460614447.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460637460.0000000000F3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460667321.0000000000F3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f509db719341cefea6c6c824f556d87c4149af31b656ab04d21882e9f704e7b0
Instruction ID: 8b99bb86bd670c7f6965763986332f6b9cc9501f2d7869ab2da4848372c208ff
Opcode Fuzzy Hash: f509db719341cefea6c6c824f556d87c4149af31b656ab04d21882e9f704e7b0
Instruction Fuzzy Hash: AFC08C34600A00CECE398A1082713A43395E3A2796FAC24CEDC2A1B742C51EDC83DA01

Function 00EC53B1 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 00EC53B8
std::_Lockit::_Lockit.LIBCPMT ref: 00EC53C2
int.LIBCPMT ref: 00EC53D9

Part of subcall function 00EC16B4: std::_Lockit::_Lockit.LIBCPMT ref: 00EC16C5
Part of subcall function 00EC16B4: std::_Lockit::~_Lockit.LIBCPMT ref: 00EC16DF

std::_Facet_Register.LIBCPMT ref: 00EC5413
std::_Lockit::~_Lockit.LIBCPMT ref: 00EC5433
Concurrency::cancel_current_task.LIBCPMT ref: 00EC5440

Strings

R[, xrefs: 00EC5420

Memory Dump Source

Source File: 00000000.00000002.1460473272.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1460419523.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460524537.0000000000EE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460614447.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460637460.0000000000F3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460667321.0000000000F3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID: R[
API String ID: 55977855-3972925902
Opcode ID: f618a502347c85b978bf92fd0cf76733b1e3378dc5a95e1b23b6367f3261ac21
Instruction ID: 1b15b583b0cb2a925ff4c7594ba0623a1998b120157df78f1f2d7da9b6317b22
Opcode Fuzzy Hash: f618a502347c85b978bf92fd0cf76733b1e3378dc5a95e1b23b6367f3261ac21
Instruction Fuzzy Hash: DE1102729106188BCB14EB64CA06FAE77F5BF84321F14114DF845B7291CF72AE428B90

Function 00ECA5C8 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 303
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

type_info::operator==.LIBVCRUNTIME ref: 00ECA6E7
___TypeMatch.LIBVCRUNTIME ref: 00ECA7F5
CallUnexpected.LIBVCRUNTIME ref: 00ECA962

Strings

csm, xrefs: 00ECA71E
csm, xrefs: 00ECA672
csm, xrefs: 00ECA605

Memory Dump Source

Source File: 00000000.00000002.1460473272.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1460419523.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460524537.0000000000EE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460614447.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460637460.0000000000F3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460667321.0000000000F3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 1206542248-393685449
Opcode ID: b0a9eba54ed95bd5013686e1c2bb77fa1e73a7db254de1a8d77fc3dda0adebb3
Instruction ID: 47d9517a02be93c07caadee404cf4fa18dec6e19f246ec4c25658d397eceb83a
Opcode Fuzzy Hash: b0a9eba54ed95bd5013686e1c2bb77fa1e73a7db254de1a8d77fc3dda0adebb3
Instruction Fuzzy Hash: 29B15B3280020DDFCF18DFA4CA45EAEB7B5BF04318B18616EE8117B212D732D952CB92

Function 00ED5F4A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,F8250000,?,53BEE354,?,00ED6057,00ECC446,?,F8250000,00000000), ref: 00ED600B

Strings

ext-ms-, xrefs: 00ED5FB5
api-ms-, xrefs: 00ED5FA1

Memory Dump Source

Source File: 00000000.00000002.1460473272.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1460419523.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460524537.0000000000EE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460614447.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460637460.0000000000F3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460667321.0000000000F3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 4f959ff43d2dc2aa1c503c33e6c68f97db67d7d075cdce38455641cbf7089c27
Instruction ID: d60ba1f8c772ef8e60b05814da3f485d816a20cb8d783691770094d4e76d25fe
Opcode Fuzzy Hash: 4f959ff43d2dc2aa1c503c33e6c68f97db67d7d075cdce38455641cbf7089c27
Instruction Fuzzy Hash: 5021EB32B00654ABC7319B35DC44A5E7768EB417B4B242516F916BF3D1D730EE06C6E0

Function 00EC507A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 00EC5081
std::_Lockit::_Lockit.LIBCPMT ref: 00EC508C
std::locale::_Setgloballocale.LIBCPMT ref: 00EC50A7
_Yarn.LIBCPMT ref: 00EC50BD
std::_Lockit::~_Lockit.LIBCPMT ref: 00EC50FA

Strings

R[, xrefs: 00EC50C9, 00EC50ED

Memory Dump Source

Source File: 00000000.00000002.1460473272.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1460419523.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460524537.0000000000EE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460614447.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460637460.0000000000F3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460667321.0000000000F3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$H_prolog3Lockit::_Lockit::~_SetgloballocaleYarnstd::locale::_
String ID: R[
API String ID: 156189095-3972925902
Opcode ID: feecff1cf7c321603877c408000a54541cf2223aba4d1b40d2e58e68c95c3a51
Instruction ID: 23fa8b817e6ee25e4bf9b6359eff73d7b49359245eadf9db05c064d7e5679334
Opcode Fuzzy Hash: feecff1cf7c321603877c408000a54541cf2223aba4d1b40d2e58e68c95c3a51
Instruction Fuzzy Hash: 43019E72A016588BC706BB209966F7D7BA1BB85350B14500DF94167391CB35AE42DB81

Function 00ED0F50 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,53BEE354,?,?,00000000,00EE1FC8,000000FF,?,00ED0EE0,00ED1010,?,00ED0EB4,00000000), ref: 00ED0F85
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00ED0F97
FreeLibrary.KERNEL32(00000000,?,?,00000000,00EE1FC8,000000FF,?,00ED0EE0,00ED1010,?,00ED0EB4,00000000), ref: 00ED0FB9

Strings

CorExitProcess, xrefs: 00ED0F8F
R[, xrefs: 00ED0FA8
mscoree.dll, xrefs: 00ED0F7E

Memory Dump Source

Source File: 00000000.00000002.1460473272.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1460419523.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460524537.0000000000EE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460614447.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460637460.0000000000F3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460667321.0000000000F3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$R[$mscoree.dll
API String ID: 4061214504-706027784
Opcode ID: 45cfa159e831fa9961edb4e76acfc4a1037262c81d94dab6182decb63c670782
Instruction ID: 5490b868871644aab4132b4a376d722afe8eb096516f3efb8467e04385203221
Opcode Fuzzy Hash: 45cfa159e831fa9961edb4e76acfc4a1037262c81d94dab6182decb63c670782
Instruction Fuzzy Hash: 1C016231A0479DEFDB218B61DC49FAEBBB8FB44B14F04052AF811B66D0DB749A04CA90

Function 00EDF356 Relevance: 9.3, APIs: 6, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1460473272.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1460419523.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460524537.0000000000EE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460614447.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460637460.0000000000F3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460667321.0000000000F3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27269fba15e7c960e9a72a026ca95b9a545a3c28e87c293eaaf45025d8bcd2e4
Instruction ID: 8b28558a300ba87664964405201e047369f0226d782351908debb3fd6a0424f3
Opcode Fuzzy Hash: 27269fba15e7c960e9a72a026ca95b9a545a3c28e87c293eaaf45025d8bcd2e4
Instruction Fuzzy Hash: FCB1B370A042499FDB11DFA9D880BADBBB1EF45314F14516AE512BB3A2C771DD43CBA0

Function 00ED7747 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(53BEE354,00000000,00000000,00000000), ref: 00ED77AA

Part of subcall function 00ED952A: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00ED8FD3,?,00000000,-00000008), ref: 00ED95D6

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00ED7A05
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00ED7A4D
GetLastError.KERNEL32 ref: 00ED7AF0

Strings

v , xrefs: 00ED79CB, 00ED7A13, 00ED7A6E, 00ED793A, 00ED7A83, 00ED78E6

Memory Dump Source

Source File: 00000000.00000002.1460473272.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1460419523.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460524537.0000000000EE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460614447.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460637460.0000000000F3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460667321.0000000000F3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID: v
API String ID: 2112829910-1689364375
Opcode ID: d114476b417ba0207aa831adf718a6c380a016e3975eb24166f61ab3dd39e9de
Instruction ID: fc4a390e9323deffa69d6b06ef6d4fbae3b66418dacfba0404c3194908b7ca6a
Opcode Fuzzy Hash: d114476b417ba0207aa831adf718a6c380a016e3975eb24166f61ab3dd39e9de
Instruction Fuzzy Hash: 06D157B5D042589FCB15CFA8D8809ADFBB5FF49314F18426AE8A5FB351E730A942CB50

Function 00ECA25A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00ECA251,00EC8978,00EC7AFF), ref: 00ECA268
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00ECA276
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00ECA28F
SetLastError.KERNEL32(00000000,00ECA251,00EC8978,00EC7AFF), ref: 00ECA2E1

Memory Dump Source

Source File: 00000000.00000002.1460473272.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1460419523.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460524537.0000000000EE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460614447.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460637460.0000000000F3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460667321.0000000000F3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: cb58c3b3ca0a1702fd6cdfe9c1fbc95515a45c5694e67699c892e221c2754c91
Instruction ID: 8b8f68d1a4c60dbc6afae9fe357206483b5a67353269126ae70a549cb99d58cb
Opcode Fuzzy Hash: cb58c3b3ca0a1702fd6cdfe9c1fbc95515a45c5694e67699c892e221c2754c91
Instruction Fuzzy Hash: F201D23250C3696EA6382775BE86F6A278AEB0277CB28123DF010790F1FB134D0B5142

Function 00ECA371 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00ECA438
___AdjustPointer.LIBCMT ref: 00ECA45B
___AdjustPointer.LIBCMT ref: 00ECA4F7

Strings

R[, xrefs: 00ECA3D0

Memory Dump Source

Source File: 00000000.00000002.1460473272.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1460419523.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460524537.0000000000EE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460614447.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460637460.0000000000F3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460667321.0000000000F3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID: R[
API String ID: 1740715915-3972925902
Opcode ID: b8b05760779b19d5c6d7cfdffffc901065e5b0969f9b4aecd36f337adad52e9e
Instruction ID: 581567bbd22efdcfa8f5a4739fa44ccd4a95cf6130929dc5f8c8ce075f96d792
Opcode Fuzzy Hash: b8b05760779b19d5c6d7cfdffffc901065e5b0969f9b4aecd36f337adad52e9e
Instruction Fuzzy Hash: 1C51027260031A9FDB298F54DA45FBA73A5FF00318F18503DE821A7291E773AC52CB92

Function 00EC4436 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00EC4442
int.LIBCPMT ref: 00EC4455

Part of subcall function 00EC16B4: std::_Lockit::_Lockit.LIBCPMT ref: 00EC16C5
Part of subcall function 00EC16B4: std::_Lockit::~_Lockit.LIBCPMT ref: 00EC16DF

std::_Facet_Register.LIBCPMT ref: 00EC4488
std::_Lockit::~_Lockit.LIBCPMT ref: 00EC449E
Concurrency::cancel_current_task.LIBCPMT ref: 00EC44A9

Memory Dump Source

Source File: 00000000.00000002.1460473272.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1460419523.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460524537.0000000000EE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460614447.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460637460.0000000000F3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460667321.0000000000F3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 03b04ff2d49f74d7a7bfe524cb117e88b85963c8ede53d7c6e510a24ba1ce39a
Instruction ID: 124a7c955d7bbca41e8aa959ae29d460c7cdbebabcc6fd8ee52f78442336038d
Opcode Fuzzy Hash: 03b04ff2d49f74d7a7bfe524cb117e88b85963c8ede53d7c6e510a24ba1ce39a
Instruction Fuzzy Hash: C101FCB2500114ABCB18EB64D925FAD7BA8EF81370B20114DF915772D1DB319E43D780

Function 00EC3DB1 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00EC3DBD
int.LIBCPMT ref: 00EC3DD0

Part of subcall function 00EC16B4: std::_Lockit::_Lockit.LIBCPMT ref: 00EC16C5
Part of subcall function 00EC16B4: std::_Lockit::~_Lockit.LIBCPMT ref: 00EC16DF

std::_Facet_Register.LIBCPMT ref: 00EC3E03
std::_Lockit::~_Lockit.LIBCPMT ref: 00EC3E19
Concurrency::cancel_current_task.LIBCPMT ref: 00EC3E24

Memory Dump Source

Source File: 00000000.00000002.1460473272.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1460419523.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460524537.0000000000EE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460614447.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460637460.0000000000F3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460667321.0000000000F3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 6f2935da9e5ef82bc4c841e35c5872c18328757857fd910d0f39fe4c0b4a5283
Instruction ID: a7b8ce0a1de72e9589cf3ad4b5c6dcbc634d58da8108dd9725d08e2653e0bdce
Opcode Fuzzy Hash: 6f2935da9e5ef82bc4c841e35c5872c18328757857fd910d0f39fe4c0b4a5283
Instruction Fuzzy Hash: DE01AC72500214ABCB25AB74DD55E9D7BA8DF41364B10614DF90577292DB329F03DB80

Function 00EC4308 Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00EC4315
int.LIBCPMT ref: 00EC4328

Part of subcall function 00EC16B4: std::_Lockit::_Lockit.LIBCPMT ref: 00EC16C5
Part of subcall function 00EC16B4: std::_Lockit::~_Lockit.LIBCPMT ref: 00EC16DF

std::_Facet_Register.LIBCPMT ref: 00EC435B
std::_Lockit::~_Lockit.LIBCPMT ref: 00EC4371
Concurrency::cancel_current_task.LIBCPMT ref: 00EC437C

Memory Dump Source

Source File: 00000000.00000002.1460473272.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1460419523.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460524537.0000000000EE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460614447.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460637460.0000000000F3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460667321.0000000000F3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: e89c6051e3bc1a5aa527d583f7221c192a663945b9d1706d32e93740c9ba2c2f
Instruction ID: cebdd24229d315432aa20e9fabb10e64dead962c36eaf018efd263837d4221c8
Opcode Fuzzy Hash: e89c6051e3bc1a5aa527d583f7221c192a663945b9d1706d32e93740c9ba2c2f
Instruction Fuzzy Hash: 5F01F772900518A7CB10BBA8DA21EDD7BA4AFC1324B10215CF905BB2D1DB31DE03CBC0

Function 00F0961A Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00F09626

Part of subcall function 00F08E77: __getptd_noexit.LIBCMT ref: 00F08E7A
Part of subcall function 00F08E77: __amsg_exit.LIBCMT ref: 00F08E87

__getptd.LIBCMT ref: 00F0963D
__amsg_exit.LIBCMT ref: 00F0964B
__lock.LIBCMT ref: 00F0965B
__updatetlocinfoEx_nolock.LIBCMT ref: 00F0966F

Memory Dump Source

Source File: 00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1460419523.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460473272.0000000000EC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460524537.0000000000EE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460614447.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460637460.0000000000F3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460667321.0000000000F3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: d724d9d4d980fd5611dec467c746fa333166a6991964497677ff17d61b2cffb3
Instruction ID: 14d9617788ae089d319b0bfaf600d007b1e38c172f7d4a0dadf1899c9b5df36a
Opcode Fuzzy Hash: d724d9d4d980fd5611dec467c746fa333166a6991964497677ff17d61b2cffb3
Instruction Fuzzy Hash: 36F09632E09710DBDA217BA8DC02B1D3390AF00764F550149F444961D3DF696941FA96

Function 00ECA060 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00ECA09F
__IsNonwritableInCurrentImage.LIBCMT ref: 00ECA153

Strings

csm, xrefs: 00ECA13D
R[, xrefs: 00ECA16C

Memory Dump Source

Source File: 00000000.00000002.1460473272.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1460419523.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460524537.0000000000EE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460614447.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460637460.0000000000F3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460667321.0000000000F3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: R[$csm
API String ID: 3480331319-1515388219
Opcode ID: 9d91c8b6e7b6bd60077203e2cff5198376260fcec42cfab9d4ded893bfd55c42
Instruction ID: 6c058a368a76c2dba7e9227ca93e5f05acfd47ca0946a73946e2358a738dbb86
Opcode Fuzzy Hash: 9d91c8b6e7b6bd60077203e2cff5198376260fcec42cfab9d4ded893bfd55c42
Instruction Fuzzy Hash: C441A470A0124C9FCF10DF69C981F9EBBE5AF45318F189169E814BB351C7329E46CB92

Function 00ECB3A2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00ECB353,00000000,?,00F3B6CC,?,?,?,00ECB4F6,00000004,InitializeCriticalSectionEx,00EE4BD8,InitializeCriticalSectionEx), ref: 00ECB3AF
GetLastError.KERNEL32(?,00ECB353,00000000,?,00F3B6CC,?,?,?,00ECB4F6,00000004,InitializeCriticalSectionEx,00EE4BD8,InitializeCriticalSectionEx,00000000,?,00ECB2AD), ref: 00ECB3B9
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00ECB3E1

Strings

api-ms-, xrefs: 00ECB3C6

Memory Dump Source

Source File: 00000000.00000002.1460473272.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1460419523.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460524537.0000000000EE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460614447.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460637460.0000000000F3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460667321.0000000000F3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: b4e7673223455bed37201a2f6dd9b9a3c58798056fd3665498f5efbb45f3b8f7
Instruction ID: 4595e874f6c9f4fc542f4953e0a4440b0a2cccce676f22fb2bc3e8eead08457e
Opcode Fuzzy Hash: b4e7673223455bed37201a2f6dd9b9a3c58798056fd3665498f5efbb45f3b8f7
Instruction Fuzzy Hash: 12E048302402C8BBEF211B72ED8FF1D3E559B10B55F101025FA0CF80E1D7B2DA558684

Function 00EE06EF Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,00000000,?,00EDF713,00000000,00000001,00000000,00000000,?,00ED7B44,00000000,00000000,00000000), ref: 00EE0706
GetLastError.KERNEL32(?,00EDF713,00000000,00000001,00000000,00000000,?,00ED7B44,00000000,00000000,00000000,00000000,00000000,?,00ED80CB,00000000), ref: 00EE0712

Part of subcall function 00EE06D8: CloseHandle.KERNEL32(FFFFFFFE,00EE0722,?,00EDF713,00000000,00000001,00000000,00000000,?,00ED7B44,00000000,00000000,00000000,00000000,00000000), ref: 00EE06E8

___initconout.LIBCMT ref: 00EE0722

Part of subcall function 00EE069A: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00EE06C9,00EDF700,00000000,?,00ED7B44,00000000,00000000,00000000,00000000), ref: 00EE06AD

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,?,00EDF713,00000000,00000001,00000000,00000000,?,00ED7B44,00000000,00000000,00000000,00000000), ref: 00EE0737

Memory Dump Source

Source File: 00000000.00000002.1460473272.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1460419523.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460524537.0000000000EE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460614447.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460637460.0000000000F3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460667321.0000000000F3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 3f33261ac39601d8d161968a50fd177ff88c688734a9532bc095fe8e05f16207
Instruction ID: 456d6d2ec4bfc72d9e7a1dced5325d749c31971f2b68086ada43c0666c47ad1b
Opcode Fuzzy Hash: 3f33261ac39601d8d161968a50fd177ff88c688734a9532bc095fe8e05f16207
Instruction Fuzzy Hash: 3DF012360011DDBFCF222FA6DC48A893FA5FB493A1B004010F91DBA520D6718960DF90

Function 00EE1093 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,00EE09EF), ref: 00EE10AC

Strings

R[, xrefs: 00EE1176, 00EE1220, 00EE1266
Li, xrefs: 00EE1241

Memory Dump Source

Source File: 00000000.00000002.1460473272.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1460419523.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460524537.0000000000EE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460614447.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460637460.0000000000F3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460667321.0000000000F3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: DecodePointer
String ID: Li$R[
API String ID: 3527080286-2265778396
Opcode ID: cd10cf0d06edc07f98315b6b85ca3505b04ce916e7c13449956d7ad01088e974
Instruction ID: 41d8fb97da237c4a6eb6109c241a40c6b67022546696838cea58b215400aa6c4
Opcode Fuzzy Hash: cd10cf0d06edc07f98315b6b85ca3505b04ce916e7c13449956d7ad01088e974
Instruction Fuzzy Hash: 7651BD7090058ECBCF108FABD84C1FD7BB4FF89318F106185E681BB225CB718AA99B54

Function 00EC5F4D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

_Fputc.LIBCPMT ref: 00EC6026

Strings

R[, xrefs: 00EC6005

Memory Dump Source

Source File: 00000000.00000002.1460473272.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1460419523.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460524537.0000000000EE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460614447.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460637460.0000000000F3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460667321.0000000000F3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Fputc
String ID: R[
API String ID: 3078413507-3972925902
Opcode ID: c90d563abb79d72a8e3624871354ca4b59ad4f89b6ebb942410682bd00f4a45d
Instruction ID: 2bc4036ad8c1fffcaee3be04cf51328706ec940927a636f8cb4da927e207891a
Opcode Fuzzy Hash: c90d563abb79d72a8e3624871354ca4b59ad4f89b6ebb942410682bd00f4a45d
Instruction Fuzzy Hash: 50416032A1065AABCB28DF64C640EEDB7B9FF08354B14502EE541B7650E732FD92CB90

Function 00ECA96D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 00ECA992

Strings

MOC, xrefs: 00ECA9A4
RCC, xrefs: 00ECA9AC

Memory Dump Source

Source File: 00000000.00000002.1460473272.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1460419523.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460524537.0000000000EE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460614447.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460637460.0000000000F3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460667321.0000000000F3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: f5878ca0c8dadf3c1abf36add785c79908cdc095b21db2220f13c21f1570ccee
Instruction ID: d419f75c356c4dece85425a3159d4b3bd5c6402ad2db5a8929b028e3899598f3
Opcode Fuzzy Hash: f5878ca0c8dadf3c1abf36add785c79908cdc095b21db2220f13c21f1570ccee
Instruction Fuzzy Hash: D441177190020DAFCF16DF98CA81FEEBBB5BF48308F195069FA14B6211D3369952DB52

Function 00F04FD8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00F0504A
__aulldiv.LIBCMT ref: 00F05058

Strings

@, xrefs: 00F05025

Memory Dump Source

Source File: 00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1460419523.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460473272.0000000000EC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460524537.0000000000EE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460614447.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460637460.0000000000F3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460667321.0000000000F3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: __aulldiv
String ID: @
API String ID: 3732870572-2766056989
Opcode ID: 7e71b2cf3ab39a96845f2c5ec6281b05558ac3270fef8c112806fab1e15290c3
Instruction ID: afaafe4a998981f016c968fa73ce98e28819eaadb2a5e72e21a760682cdc6f1f
Opcode Fuzzy Hash: 7e71b2cf3ab39a96845f2c5ec6281b05558ac3270fef8c112806fab1e15290c3
Instruction Fuzzy Hash: CC214AB1E44208ABDB10DFD4CC49FAEB7B9FB45B10F104609F605BB2C0C7B869019BA5

Function 00EC5107 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00EC5113
std::_Lockit::~_Lockit.LIBCPMT ref: 00EC516F

Strings

R[, xrefs: 00EC513A, 00EC5154

Memory Dump Source

Source File: 00000000.00000002.1460473272.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1460419523.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460524537.0000000000EE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460614447.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460637460.0000000000F3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460667321.0000000000F3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID: R[
API String ID: 593203224-3972925902
Opcode ID: e94325590718319949582d583e50540059c6e184871fe33fe6ef3db7b911cd5d
Instruction ID: 747265c09892a603ae732b671a757273fd0932a970fce2b6cf951af448690db1
Opcode Fuzzy Hash: e94325590718319949582d583e50540059c6e184871fe33fe6ef3db7b911cd5d
Instruction Fuzzy Hash: 26018C71600918AFCB10EB25C999F9D7BB9EF85714B08009DE802AB3A1DF71FE46CB50

Function 00EEE0F8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00EEE130
__aulldiv.LIBCMT ref: 00EEE13E

Strings

@, xrefs: 00EEE10B

Memory Dump Source

Source File: 00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1460419523.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460473272.0000000000EC1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460524537.0000000000EE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460614447.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460637460.0000000000F3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460667321.0000000000F3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: __aulldiv
String ID: @
API String ID: 3732870572-2766056989
Opcode ID: e3d9931386e0fa91028f4e7641da7fda79c4023127bcc5196728e9d9e144d5c4
Instruction ID: b898a090aa148404bad9541f6bd704d6d51a3b9a14298192f7e3e9aafa7fef6d
Opcode Fuzzy Hash: e3d9931386e0fa91028f4e7641da7fda79c4023127bcc5196728e9d9e144d5c4
Instruction Fuzzy Hash: 3F014FB094130CFAEB10DBD1CC45B9DBBB8EB01705F208058E604763C0D6B455869B56

Function 00EC15DF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00EC15E6
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00EC161E

Part of subcall function 00EC5178: _Yarn.LIBCPMT ref: 00EC5197
Part of subcall function 00EC5178: _Yarn.LIBCPMT ref: 00EC51BB

Strings

bad locale name, xrefs: 00EC162C

Memory Dump Source

Source File: 00000000.00000002.1460473272.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1460419523.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460524537.0000000000EE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460614447.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460637460.0000000000F3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460667321.0000000000F3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: ae4f28add717a7d93c58d78244ece8afff70605a3a86e623b34642e9bb16cf6d
Instruction ID: d54d03a0e15d512d9b1bc40c236651c12f6224b212b9942c3a7fa84711145c9c
Opcode Fuzzy Hash: ae4f28add717a7d93c58d78244ece8afff70605a3a86e623b34642e9bb16cf6d
Instruction Fuzzy Hash: 49F01DB1505B909E83319F7A8581947FBE4BE293103949E6EE0DED3A11D731A405CB6A

Function 00ED62A6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?), ref: 00ED62E6

Strings

InitializeCriticalSectionEx, xrefs: 00ED62B6
R[, xrefs: 00ED62D6

Memory Dump Source

Source File: 00000000.00000002.1460473272.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1460419523.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460524537.0000000000EE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460614447.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460637460.0000000000F3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460667321.0000000000F3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx$R[
API String ID: 2593887523-432795312
Opcode ID: 5b90d349bfab390199f5e726a8e4592a25a4213a4aca2edcb16e3941bdc6cc43
Instruction ID: 6199133fe87fc65e2d596330dbd7986195c8f17aae46e8fc2c925517386e1b2e
Opcode Fuzzy Hash: 5b90d349bfab390199f5e726a8e4592a25a4213a4aca2edcb16e3941bdc6cc43
Instruction Fuzzy Hash: BEE09B3264025CBBCF112F62EC06E9E7F15DB447A1B005011FD1839261C772D921D6C4

Function 00ED612C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 00ED6160

Strings

R[, xrefs: 00ED6156
FlsAlloc, xrefs: 00ED613C

Memory Dump Source

Source File: 00000000.00000002.1460473272.0000000000EC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000000.00000002.1460419523.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460524537.0000000000EE3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460544148.0000000000EED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460614447.0000000000F3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460637460.0000000000F3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1460667321.0000000000F3C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Alloc
String ID: FlsAlloc$R[
API String ID: 2773662609-3428055260
Opcode ID: ad449e461f156a611e0408f184a34fb7df0229cb3ec23c1ebf106eeebb7373e7
Instruction ID: df7d8db74fec565629d959f44dddc4536de54f3da7b24cb0cafb13eddd5d3164
Opcode Fuzzy Hash: ad449e461f156a611e0408f184a34fb7df0229cb3ec23c1ebf106eeebb7373e7
Instruction Fuzzy Hash: 2BE0C2366857AC77C33126B3AC0AE9E7A14CB44B61B002022FA087A3C2DAA59E0192D5

Analysis Process: MSBuild.exePID: 7544, Parent PID: 7452COMMON

Execution Graph

Execution Coverage:	19%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.2%
Total number of Nodes:	1598
Total number of Limit Nodes:	4

Executed Functions

Function 004045C0 Relevance: 112.1, APIs: 34, Strings: 30, Instructions: 114
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045CC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045D7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045E2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045ED
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045F8
GetProcessHeap.KERNEL32(00000000,?,?,0000000F,?,004169FB), ref: 00404607
RtlAllocateHeap.NTDLL(00000000,?,0000000F,?,004169FB), ref: 0040460E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040461C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404627
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404632
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040463D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404648
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040465C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404667
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404672
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040467D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404688
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046B1
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046BC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046C7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046D2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046DD
strlen.MSVCRT ref: 004046F0
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404718
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404723
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040472E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404739
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404744
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404754
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040475F
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040476A
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404775
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404780
VirtualProtect.KERNELBASE(?,00000004,00000100,00000000), ref: 0040479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046B7

Memory Dump Source

Source File: 00000003.00000002.1778401976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrlen$Heap$AllocateProcessProtectVirtualstrlen
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 2127927946-2218711628
Opcode ID: 5acfa23b78d647d16e3131d476f18804c650b7bf61bc6c67ff7474173f5a2b8f
Instruction ID: d74624c404fea8bc3833097cd15bfd8a5e03d1640ee24043f2693d34696df282
Opcode Fuzzy Hash: 5acfa23b78d647d16e3131d476f18804c650b7bf61bc6c67ff7474173f5a2b8f
Instruction Fuzzy Hash: DF41A979740624EBC71C9FE5EC89B997F60AB8C712BA0C062F90299190C7FAD5119B3D

Function 00418680 Relevance: 6.1, APIs: 4, Instructions: 77
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,004205B7), ref: 004186CA
Process32First.KERNEL32(?,00000128), ref: 004186DE
Process32Next.KERNEL32(?,00000128), ref: 004186F3
CloseHandle.KERNELBASE(?), ref: 00418761

Memory Dump Source

Source File: 00000003.00000002.1778401976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: a565577679dd8a0504a1d15f914896fe3659e154cb8e13ffca774fc0674d62c6
Instruction ID: 8f5abf7c5654a811b9b3f094c7d3948ba22bca0c3321aba4e2188e2e86b1b5ea
Opcode Fuzzy Hash: a565577679dd8a0504a1d15f914896fe3659e154cb8e13ffca774fc0674d62c6
Instruction Fuzzy Hash: F7315E71902218ABCB24EF95DC45FEEB778EF45714F10419EF10AA21A0DF386A85CFA5

Function 00417B90 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNELBASE(?,00000002,?,00000200), ref: 00417C62

Strings

/ , xrefs: 00417C7F

Memory Dump Source

Source File: 00000003.00000002.1778401976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: /
API String ID: 2299586839-4001269591
Opcode ID: 08381a4b7f1aa01ac9a5d03d4b0a0666cc02ab67458fdc9de76e0bd8478d1419
Instruction ID: 4337a3d4516c1007e731de4e6e4702528bfdb1ea37c67bd3aa396c5a1b158d15
Opcode Fuzzy Hash: 08381a4b7f1aa01ac9a5d03d4b0a0666cc02ab67458fdc9de76e0bd8478d1419
Instruction Fuzzy Hash: 6B415E71941118ABDB24DB94DC99FEEB378FF44714F20419AE10962281DB382FC6CFA5

Function 00417A30 Relevance: 1.5, APIs: 1, Instructions: 49timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNELBASE(?,?,?,?,00000000,00000000,?,?,00000000,?,00420E10,00000000,?,00000000,00000000,?), ref: 00417A7D

Memory Dump Source

Source File: 00000003.00000002.1778401976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID:
API String ID: 565725191-0
Opcode ID: b881c6b0ead1d296197200307cca27ecd4ed8ab0e7bcc50e28ea7705d7869b14
Instruction ID: 8af700d3b0e32b47e9d6ddd9198ddf9a5cfc8e3ba9127fd648bfb7377b14e362
Opcode Fuzzy Hash: b881c6b0ead1d296197200307cca27ecd4ed8ab0e7bcc50e28ea7705d7869b14
Instruction Fuzzy Hash: 461152B1A45228EFEB108B54DC45F9AB7B8FB05711F10439AE516932C0D7785A40CF55

Function 00417850 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041789F

Memory Dump Source

Source File: 00000003.00000002.1778401976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 98be1400a0f13b17dcfec3579e84c662f1c1c1bd9e35413721d24a5daf15813c
Instruction ID: ff9f3fb77af2488786a742b30a7a77c7a6675fe12b7944dcc27658a291e6e945
Opcode Fuzzy Hash: 98be1400a0f13b17dcfec3579e84c662f1c1c1bd9e35413721d24a5daf15813c
Instruction Fuzzy Hash: 08F04FB5D44208AFC710DFD8DD49BAEBBB8EB05711F10025AFA05A2680C77815448BA2

Function 00401160 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,?,00416A17,00420AEF), ref: 0040116A

Memory Dump Source

Source File: 00000003.00000002.1778401976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 5e169adc815d3d5e963ffc5450d2c06f987a57c1971b55ed15331b47ed99491e
Instruction ID: a8b5f4e8781596c88644d8aa2969b9d6e82c50da38cf1cac8898b5ca04c80d98
Opcode Fuzzy Hash: 5e169adc815d3d5e963ffc5450d2c06f987a57c1971b55ed15331b47ed99491e
Instruction Fuzzy Hash: F4D05E7C94030CEBCB14EFE0D9496DDBB79FB0D311F001559ED0572340EA306481CAA6

Function 00419C10 Relevance: 18.2, APIs: 8, Strings: 2, Instructions: 684
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A03D
LoadLibraryA.KERNELBASE(?,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A04E
LoadLibraryA.KERNELBASE(?,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A060
LoadLibraryA.KERNELBASE(?,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A072
LoadLibraryA.KERNELBASE(?,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A083
LoadLibraryA.KERNELBASE(?,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A095
LoadLibraryA.KERNELBASE(?,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A0A7
LoadLibraryA.KERNELBASE(?,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A0B8

Strings

InternetSetOptionA, xrefs: 0041A5E5
HttpQueryInfoA, xrefs: 0041A5FC

Memory Dump Source

Source File: 00000003.00000002.1778401976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 1029625771-1775429166
Opcode ID: 62050089a8b8835eafd1d37742ef1b979ae5b20786234f8d6d940be7715c0619
Instruction ID: b148544ec257a615b167952e2e9b89b3667e8f5620887ecf26b211dda149ff7d
Opcode Fuzzy Hash: 62050089a8b8835eafd1d37742ef1b979ae5b20786234f8d6d940be7715c0619
Instruction Fuzzy Hash: 02621DBD5C0200BFD364DFE8EE889A63BFBF74E701714A61AE609C3264D6399441DB52

Function 00405100 Relevance: 17.1, APIs: 3, Strings: 8, Instructions: 569
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

memcpy.MSVCRT(?,00000000,00000000), ref: 0040578F
memcpy.MSVCRT(?), ref: 004057B6
memcpy.MSVCRT(?), ref: 004057F1

Strings

------, xrefs: 004054F9
------, xrefs: 004053B7
", xrefs: 004055C4
------, xrefs: 0040563B
", xrefs: 00405482
--, xrefs: 00405280
------, xrefs: 00405297
", xrefs: 00405706

Memory Dump Source

Source File: 00000003.00000002.1778401976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ??2@memcpy$CrackInternet
String ID: ------$"$"$"$--$------$------$------
API String ID: 2445727885-2774362122
Opcode ID: 8235bc1225a5e175669867b2abb12fe628427973e28784d23146d92d1409c7f3
Instruction ID: d07ba18edd097c444f0f2b194d739d2ed1db848351cdebbd5bd0839dcb06e227
Opcode Fuzzy Hash: 8235bc1225a5e175669867b2abb12fe628427973e28784d23146d92d1409c7f3
Instruction Fuzzy Hash: DA3262B1921118ABDB14FBA1DC91FEE7378BF14714F40415EF10662092DF782A9ACF69

Function 00418320 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 196
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00020019,00000000,004205B6), ref: 004183A4
RegEnumKeyExA.KERNELBASE(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00418426
RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00020019,00000000), ref: 0041847B

Strings

- , xrefs: 004185A3
%s\%s, xrefs: 0041844D
?, xrefs: 0041837A

Memory Dump Source

Source File: 00000003.00000002.1778401976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Open$Enum
String ID: - $%s\%s$?
API String ID: 462099255-3278919252
Opcode ID: dd6617512d8e06e62f9c4619fa979c9d7048b8557595c82cd813ea9da7bb7c9e
Instruction ID: f03ee3f6de4a678c4a24becac03c3675d5d4362b87af83515ad79f9b006405b7
Opcode Fuzzy Hash: dd6617512d8e06e62f9c4619fa979c9d7048b8557595c82cd813ea9da7bb7c9e
Instruction Fuzzy Hash: B4813E75911118ABEB24DF50CD81FEAB7B9FF08714F008299E109A6180DF756BC6CFA5

Function 00406280 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 191
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

InternetOpenA.WININET(00420DFE,00000001,00000000,00000000,00000000,00420DFB), ref: 004062E1
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406335
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004063D1

Strings

GET, xrefs: 0040637C
ERROR, xrefs: 00406407
ERROR, xrefs: 004064C9

Memory Dump Source

Source File: 00000003.00000002.1778401976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ??2@Internet$ConnectCrackHttpOpenRequestSend
String ID: ERROR$ERROR$GET
API String ID: 3905982082-2509457195
Opcode ID: 460f558118b4083d41359c156125f26ce9f22fb94ebe107836e013dd45d71b95
Instruction ID: 4c22ad93782da972e928cd377ef6cc95e5ae9f8df18decad01f21c65d1bf8a87
Opcode Fuzzy Hash: 460f558118b4083d41359c156125f26ce9f22fb94ebe107836e013dd45d71b95
Instruction Fuzzy Hash: C1718075A00218ABDB24EFE0DC49BEE7775FB44700F10816AF50A6B1D0DBB86A85CF56

Function 00418100 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE(00000040,00000040,00000000), ref: 00418158
__aulldiv.LIBCMT ref: 00418172
__aulldiv.LIBCMT ref: 00418180

Strings

%d MB, xrefs: 004181A3
@, xrefs: 0041814D

Memory Dump Source

Source File: 00000003.00000002.1778401976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: __aulldiv$GlobalMemoryStatus
String ID: %d MB$@
API String ID: 2185283323-3474575989
Opcode ID: 7e71b2cf3ab39a96845f2c5ec6281b05558ac3270fef8c112806fab1e15290c3
Instruction ID: 96825d9750bf8db03c9b3ba7d6dfdbb869a7567600a83181e99cf30d3b71d0f4
Opcode Fuzzy Hash: 7e71b2cf3ab39a96845f2c5ec6281b05558ac3270fef8c112806fab1e15290c3
Instruction Fuzzy Hash: CD210BB1E44218BBDB00DFD5CC49FAEB7B9FB45B14F104609F605BB280D77869018BA9

Function 004047B0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

Strings

<, xrefs: 004047C9

Memory Dump Source

Source File: 00000003.00000002.1778401976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ??2@$CrackInternet
String ID: <
API String ID: 676793843-4251816714
Opcode ID: c386c9d0d73067ea41f4377aeaa2fd448281082c22fa9440fc98d6664c6993a8
Instruction ID: 59ffd934fb977a93d501bba2862ecb1df6a0defd032b503e5e890a78b3955a81
Opcode Fuzzy Hash: c386c9d0d73067ea41f4377aeaa2fd448281082c22fa9440fc98d6664c6993a8
Instruction Fuzzy Hash: 712149B5D00219ABDF10DFA5E849BDD7B74FF04320F008229F925A7290EB706A15CF95

Function 00419860 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 212
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?,?,00416A00), ref: 00419A9A
LoadLibraryA.KERNELBASE(?,?,00416A00), ref: 00419AAB
LoadLibraryA.KERNELBASE(?,?,00416A00), ref: 00419ACF

Strings

NtQueryInformationProcess, xrefs: 00419BAA

Memory Dump Source

Source File: 00000003.00000002.1778401976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 1029625771-2781105232
Opcode ID: 5241b63200b37b02610696a8d235fc94b134fee8225fd0051d7d8784b632fee7
Instruction ID: 20ebc6b46c949eaa7f25e90fb8197bb2e58582eade08509f86bd82c1d7e4afd5
Opcode Fuzzy Hash: 5241b63200b37b02610696a8d235fc94b134fee8225fd0051d7d8784b632fee7
Instruction Fuzzy Hash: 55A14DBD5C4240BFE354EFE8ED889963BFBF74E301704661AE605C3264D639A841DB12

Function 00417500 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 106
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041757F

Strings

C, xrefs: 0041754C
\, xrefs: 00417560
:, xrefs: 0041755C

Memory Dump Source

Source File: 00000003.00000002.1778401976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: InformationVolume
String ID: :$C$\
API String ID: 2039140958-3809124531
Opcode ID: ed3ca360dd794ca93df171aa1d69aa55e8069c6d35c7c4129d84d5da30dc5272
Instruction ID: 2fa5a76c25c4840d12821100fc964cf287d391274576238511e757cc0c078ff1
Opcode Fuzzy Hash: ed3ca360dd794ca93df171aa1d69aa55e8069c6d35c7c4129d84d5da30dc5272
Instruction Fuzzy Hash: BF41A2B5D44248ABDB10DF94DC45BEEBBB9EF08714F10019DF50967280D778AA84CBA9

Function 00401220 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE(00000040,?,00000000,00000040), ref: 0040123E
__aulldiv.LIBCMT ref: 00401258
__aulldiv.LIBCMT ref: 00401266

Strings

@, xrefs: 00401233

Memory Dump Source

Source File: 00000003.00000002.1778401976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: __aulldiv$GlobalMemoryStatus
String ID: @
API String ID: 2185283323-2766056989
Opcode ID: e3d9931386e0fa91028f4e7641da7fda79c4023127bcc5196728e9d9e144d5c4
Instruction ID: f2ded3d157cb35307e0b39d430c96622be3dd75f8d5744ac0086d878f352425a
Opcode Fuzzy Hash: e3d9931386e0fa91028f4e7641da7fda79c4023127bcc5196728e9d9e144d5c4
Instruction Fuzzy Hash: 5901FBB0D84308BAEB10DBE4DC49B9EBB78AB15705F20809EE705B62D0D6785585879D

Function 004183DC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNELBASE(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00418426
RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00020019,00000000), ref: 0041847B
RegQueryValueExA.KERNELBASE(00000000,?,00000000,000F003F,?,00000400), ref: 004184EC
RegQueryValueExA.KERNELBASE(00000000,?,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00420B34), ref: 00418599
RegCloseKey.KERNELBASE(00000000), ref: 00418608

Strings

%s\%s, xrefs: 0041844D

Memory Dump Source

Source File: 00000003.00000002.1778401976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseEnumOpen
String ID: %s\%s
API String ID: 2041898428-4073750446
Opcode ID: 2745a0ba8eb15d3c1f0b65b5c657a669296e82b89610ecc7bb468d10700aed3a
Instruction ID: cdbcbf4b9f8a1ecee5159c9abe2ba9d8dffcfa3e02281556f53420590b8fae77
Opcode Fuzzy Hash: 2745a0ba8eb15d3c1f0b65b5c657a669296e82b89610ecc7bb468d10700aed3a
Instruction Fuzzy Hash: 7B210A75940218AFDB24DB54DC85FE9B3B9FB48704F00C199E60996140DF756A85CFD4

Function 00417690 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000002,?,00000000,00020119,00000000), ref: 004176DD
RegQueryValueExA.KERNELBASE(00000000,?,00000000,00000000,?,000000FF), ref: 004176FE

Strings

Windows 11, xrefs: 004176BD

Memory Dump Source

Source File: 00000003.00000002.1778401976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: OpenQueryValue
String ID: Windows 11
API String ID: 4153817207-2517555085
Opcode ID: 31b5ee67880bd1f967030e6ea3d78f3b54130d435c20b4c8c69cbeacade70eac
Instruction ID: 0438ef7ee9a5fbee92b010be2e89678c99e6505f2a73f727aa840deaa157456b
Opcode Fuzzy Hash: 31b5ee67880bd1f967030e6ea3d78f3b54130d435c20b4c8c69cbeacade70eac
Instruction Fuzzy Hash: E0018FBDA80204BFE700DBE0DD49FAEB7BDEB09700F004055FA05D7290E674A9408B55

Function 00417720 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000002,?,00000000,00020119,004176B9), ref: 0041775B
RegQueryValueExA.KERNELBASE(004176B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0041777A

Strings

CurrentBuildNumber, xrefs: 00417771

Memory Dump Source

Source File: 00000003.00000002.1778401976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: OpenQueryValue
String ID: CurrentBuildNumber
API String ID: 4153817207-1022791448
Opcode ID: 43a46ff31c4728249bb55ffe5b6c0263db84e810ad24588de6037cbf7116cf65
Instruction ID: 98fe8272c38af2577472084bebc30d651685970d5c5bfe2bd2220dad028592af
Opcode Fuzzy Hash: 43a46ff31c4728249bb55ffe5b6c0263db84e810ad24588de6037cbf7116cf65
Instruction Fuzzy Hash: 0F0144BDA80308BFE710DFE0DC49FAEB7B9EB44704F104159FA05A7281DA7455408F51

Function 00404FB0 Relevance: 3.1, APIs: 2, Instructions: 82memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00404FD1
KiUserExceptionDispatcher.NTDLL(00000000,?,00000001), ref: 0040508A

Memory Dump Source

Source File: 00000003.00000002.1778401976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AllocateDispatcherExceptionHeapUser
String ID:
API String ID: 3515689010-0
Opcode ID: 6cf967ef785bb23c697623f5c6a033393d0fc44cd8035483208646c558320f55
Instruction ID: cb0899809939a0b3ab7ef321ba077ef70f04c27eec1e373fde9f1e9505320bf0
Opcode Fuzzy Hash: 6cf967ef785bb23c697623f5c6a033393d0fc44cd8035483208646c558320f55
Instruction Fuzzy Hash: 2A3108B8A40218ABDB20CF94DC85BDDB7B5EB48704F1081E9F709B7281C7746AC58F99

Function 00417E00 Relevance: 3.1, APIs: 2, Instructions: 58registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000002,?,00000000,00020119,?), ref: 00417E5E
RegQueryValueExA.KERNELBASE(?,?,00000000,00000000,000000FF,000000FF), ref: 00417E7F

Memory Dump Source

Source File: 00000003.00000002.1778401976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: OpenQueryValue
String ID:
API String ID: 4153817207-0
Opcode ID: f2207629c624761bbe8885f03498d73c435f9e088398b1cc221a346ec08661e3
Instruction ID: f35b37edc560d93cca1bbeb044924e1a71a0ba88b9c12cde0d27c4035fcf8d53
Opcode Fuzzy Hash: f2207629c624761bbe8885f03498d73c435f9e088398b1cc221a346ec08661e3
Instruction Fuzzy Hash: 01114CB5A84205FFD710CFD4DD4AFBBBBB9EB09B10F10425AF605A7280D77858018BA6

Function 004169F0 Relevance: 1.6, APIs: 1, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00401160: GetSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,?,00416A17,00420AEF), ref: 0040116A

Part of subcall function 00401110: VirtualAllocExNuma.KERNELBASE(00000000,?,?,00416A1C), ref: 00401132

Part of subcall function 00401220: GlobalMemoryStatusEx.KERNELBASE(00000040,?,00000000,00000040), ref: 0040123E
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401258
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401266

GetUserDefaultLCID.KERNELBASE ref: 00416A26

Part of subcall function 00417850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041789F

Part of subcall function 004178E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0041792F

Memory Dump Source

Source File: 00000003.00000002.1778401976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: NameUser__aulldiv$AllocComputerDefaultGlobalInfoMemoryNumaStatusSystemVirtual
String ID:
API String ID: 3178950686-0
Opcode ID: 89bd8792c9ea463fe5cd0678b04f38b1ba409c67d9b77676339e57910a337a73
Instruction ID: 00249ead6714b3af85de48d5768f0cff66b99727dd84f15ff7ce73ce32af2852
Opcode Fuzzy Hash: 89bd8792c9ea463fe5cd0678b04f38b1ba409c67d9b77676339e57910a337a73
Instruction Fuzzy Hash: 63316175940208AADB04FBF2DC56BEE7339AF04354F10452EF102A61D2DF7C6996C6AE

Function 004178E0 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

GetComputerNameA.KERNEL32(?,00000104), ref: 0041792F

Memory Dump Source

Source File: 00000003.00000002.1778401976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: 655548885853275668edecfa1cfdfba2d4285fba1d09bdc7eb36c2d1d55ec877
Instruction ID: 452d18c19ae851532a1d010ea63a4611fd0250a2e86211d30d2d96ca9096ca29
Opcode Fuzzy Hash: 655548885853275668edecfa1cfdfba2d4285fba1d09bdc7eb36c2d1d55ec877
Instruction Fuzzy Hash: 220186F1A48204EFD700DF94DD45BAABBB8FB05B11F10425AF545E3280C37859448BA6

Function 00417ED0 Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(00420E2C), ref: 00417F00

Memory Dump Source

Source File: 00000003.00000002.1778401976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 6e48eb6c373aebad151474fa646ebf8a74f2430de7cecad2b643f906b25ca64a
Instruction ID: 2fbe6902627a031950d7a3fa851ef95510e90209490a35db063d7eb50f57f6da
Opcode Fuzzy Hash: 6e48eb6c373aebad151474fa646ebf8a74f2430de7cecad2b643f906b25ca64a
Instruction Fuzzy Hash: 53F0F6B5A44218FBC710CF84DC45FEAF7BCF744710F50066AF50592280D37929408BD5

Function 00419470 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 004194A5

Memory Dump Source

Source File: 00000003.00000002.1778401976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: FileModuleName
String ID:
API String ID: 514040917-0
Opcode ID: 5dd3e3c532ac976404615b3816d87456bc90bb789159ce0b3212725986e21d85
Instruction ID: 2eda5d4ec063f04fe8048fb8b0a850fc323e1bbd58c3ab932ea79d0f281d5f74
Opcode Fuzzy Hash: 5dd3e3c532ac976404615b3816d87456bc90bb789159ce0b3212725986e21d85
Instruction Fuzzy Hash: BEF03A7994020CFBDB15DFA4DC4AFEA7778EB08310F004498BA1997290D6B4AE85CB95

Function 00401110 Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualAllocExNuma.KERNELBASE(00000000,?,?,00416A1C), ref: 00401132

Memory Dump Source

Source File: 00000003.00000002.1778401976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AllocNumaVirtual
String ID:
API String ID: 4233825816-0
Opcode ID: 3cbd8cc13bf7dc70ab035dff78f9dd202cda3002ce084c09b8f89ce2de56700b
Instruction ID: 516f97497d3ee46bc55051264f2a31c9d8efacdbd59bd60d04d859dfb32d17c4
Opcode Fuzzy Hash: 3cbd8cc13bf7dc70ab035dff78f9dd202cda3002ce084c09b8f89ce2de56700b
Instruction Fuzzy Hash: 76E08674985308FFE7106BE09C0AB0976B9EB05B05F101055F7087A1D0C6B826009699

Function 004010A0 Relevance: 1.3, APIs: 1, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,17C841C0,00003000,00000004,?,?,?,0040114E,?,?,00416A1C), ref: 004010B3

Memory Dump Source

Source File: 00000003.00000002.1778401976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8ce35272a596f1cdf5aa55b7e6bb44489e409ba54c945097ad2cb9ba566d6231
Instruction ID: e05e9ea69c75ff17789b13d2c0695db9e8f3777892ad192db41722de5b6306ee
Opcode Fuzzy Hash: 8ce35272a596f1cdf5aa55b7e6bb44489e409ba54c945097ad2cb9ba566d6231
Instruction Fuzzy Hash: F2F052B1681208BBE7109BA4AC49FABB3E8E305B14F301408F500E3380C5319E00CAA4

Non-executed Functions

Function 0041B33A Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0041BBA2
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0041BBB7
UnhandledExceptionFilter.KERNEL32(0041F2A8), ref: 0041BBC2
GetCurrentProcess.KERNEL32(C0000409), ref: 0041BBDE
TerminateProcess.KERNEL32(00000000), ref: 0041BBE5

Memory Dump Source

Source File: 00000003.00000002.1778401976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 1cd9910441f070b69687b64f652d04a4c8002016f1137d447a2cc91201b04508
Instruction ID: 2759986af63cf1bc905e0f8428f5e2b998159022a12c47e0d709fe691c65c3be
Opcode Fuzzy Hash: 1cd9910441f070b69687b64f652d04a4c8002016f1137d447a2cc91201b04508
Instruction Fuzzy Hash: E921A3BC9002059FDB10DF69FD89A963BE4FB0A314F50403AE90A87264DBB45981EF4D

Function 00410250 Relevance: 26.6, APIs: 3, Strings: 12, Instructions: 363stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 0041031B
memset.MSVCRT ref: 004106DD

Part of subcall function 004188E0: malloc.MSVCRT ref: 004188E8
Part of subcall function 004188E0: strncpy.MSVCRT ref: 00418903

strtok_s.MSVCRT ref: 00410679

Strings

NA, xrefs: 0041072E, 004106AF, 004106B2
profile: null, xrefs: 00410568
url: , xrefs: 00410577
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 004102A4
<Port>, xrefs: 004103C6
browser: FileZilla, xrefs: 00410559
NA, xrefs: 004102CC, 004102F2, 004102CF, 004102F5
<User>, xrefs: 00410410
<Pass encoding="base64">, xrefs: 0041045A
<Host>, xrefs: 0041037C
login: , xrefs: 004105CA
password: , xrefs: 004105FB

Memory Dump Source

Source File: 00000003.00000002.1778401976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: strtok_s$mallocmemsetstrncpy
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$NA$NA$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 2676359353-514892060
Opcode ID: 5617bd6bc83757f25327082bfbfb60fa8d0a6348b7b524702c500f70768eef60
Instruction ID: d15eb70b6d553ab1cc94bc99ca27928082ec116ada4a7d19c18b432e65637ade
Opcode Fuzzy Hash: 5617bd6bc83757f25327082bfbfb60fa8d0a6348b7b524702c500f70768eef60
Instruction Fuzzy Hash: 86D16D75A41208ABCB04FBF1DD86EEE7379FF14314F50441EF102A6091DE78AA96CB69

Function 00410A60 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 205stringprocesssynchronizationCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00410C1C
lstrcatA.KERNEL32(?,00000000), ref: 00410C35
lstrcatA.KERNEL32(?,00420D7C), ref: 00410C47
lstrcatA.KERNEL32(?,00000000), ref: 00410C5D
lstrcatA.KERNEL32(?,00420D80), ref: 00410C6F
lstrcatA.KERNEL32(?,00000000), ref: 00410C88
lstrcatA.KERNEL32(?,00420D84), ref: 00410C9A
lstrlenA.KERNEL32(?), ref: 00410CA7
memset.MSVCRT ref: 00410CCD
memset.MSVCRT ref: 00410CE1
CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000020,00000000,00000000,?,?,00000000,?,00420D88,?,00000000), ref: 00410D5A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00410D66

Strings

.exe, xrefs: 00410A95

Memory Dump Source

Source File: 00000003.00000002.1778401976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$memset$CreateObjectProcessSingleWaitlstrlen
String ID: .exe
API String ID: 2214552867-4119554291
Opcode ID: 6364e5e739fe9739766a1ce8d8c7e5a183e8e2bdcb2e6e6671a0d6d634042010
Instruction ID: 8c4414bd7b792449c86a3c64e171a12ac7102eaeec46e1acf96b3d3d4dd6cf75
Opcode Fuzzy Hash: 6364e5e739fe9739766a1ce8d8c7e5a183e8e2bdcb2e6e6671a0d6d634042010
Instruction Fuzzy Hash: A78194B55111186BCB14FBA1CD52FEE7338AF44308F40419EB30A66082DE786AD9CF6E

Function 00414D70 Relevance: 21.1, APIs: 4, Strings: 10, Instructions: 119COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00414D87
memset.MSVCRT ref: 00414E13
memset.MSVCRT ref: 00414E9F
memset.MSVCRT ref: 00414F2B

Strings

*.*, xrefs: 00414DD8
msal.cache, xrefs: 00414EF0
Azure\.IdentityService, xrefs: 00414EEB
\.azure\, xrefs: 00414DC1
Azure\.azure, xrefs: 00414DD3
*.*, xrefs: 00414E64
zaA, xrefs: 00414DF1, 00414E7D, 00414F09, 00414F34, 00414DF4, 00414E80, 00414F0C
\.IdentityService\, xrefs: 00414ED9
\.aws\, xrefs: 00414E4D
Azure\.aws, xrefs: 00414E5F

Memory Dump Source

Source File: 00000003.00000002.1778401976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: memset
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache$zaA
API String ID: 2221118986-156832076
Opcode ID: 63500b277e5d8c6ba40ed9413d1edfa83572fad66260e383529a6b6b95d2c298
Instruction ID: 18812f4626155d1e2a42465cb68794f5c6847905bec5d07e7ac1139e0e5490f3
Opcode Fuzzy Hash: 63500b277e5d8c6ba40ed9413d1edfa83572fad66260e383529a6b6b95d2c298
Instruction Fuzzy Hash: 3141D6B9A4031467C710F7B0EC47FDD3738AB64704F404459B645660C2EEB897D98B9A

Function 004170D0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 136COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00064000), ref: 004170DE
OpenProcess.KERNEL32(001FFFFF,00000000,0041730D,004205BD), ref: 0041711C
memset.MSVCRT ref: 0041716A
??_V@YAXPAX@Z.MSVCRT(?), ref: 004172BE

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0041718C
sA, xrefs: 00417111
sA, xrefs: 004172AE, 00417179, 0041717C

Memory Dump Source

Source File: 00000003.00000002.1778401976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: OpenProcessmemset
String ID: sA$sA$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 1606381396-2614523144
Opcode ID: a73ac6e1bb2c91b578430d02177e5a2f8beb51943881740cc90b8311f986bdaf
Instruction ID: ffe5c4151d56689e238fca5affca6521033e0b5082b25a646ea50ffb364ad3ac
Opcode Fuzzy Hash: a73ac6e1bb2c91b578430d02177e5a2f8beb51943881740cc90b8311f986bdaf
Instruction Fuzzy Hash: 71515FB0D04218ABDB14EB91DD85BEEB774AF04304F1040AEE61576281EB786AC9CF5D

Function 004138B0 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 250COMMON

Download Yara Rule

Strings

%s\%s\%s, xrefs: 00413A4A
%s%s, xrefs: 00413AAD
%s\*, xrefs: 004138C0
%s\%s, xrefs: 0041397A
!=A, xrefs: 00413C82, 00413C45, 00413B69, 00413909, 00413B6C, 00413C48
%s\%s, xrefs: 00413A6F

Memory Dump Source

Source File: 00000003.00000002.1778401976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID:
String ID: !=A$%s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 0-817767981
Opcode ID: c3ad0e5f37a6afd264e19c98f003c489031be70fef7a74d9d5741692706db697
Instruction ID: 6b32dcbabd2ae606338a05af88a65253e6d0136fcb4401239c8972690a9ca057
Opcode Fuzzy Hash: c3ad0e5f37a6afd264e19c98f003c489031be70fef7a74d9d5741692706db697
Instruction Fuzzy Hash: 45A182B5A40218ABDB20DFA4DC85FEA7379BF45301F04458DB50D96181EB789B84CF66

Function 00405960 Relevance: 11.0, APIs: 2, Strings: 5, Instructions: 493COMMON

Download Yara Rule

APIs

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

memcpy.MSVCRT(?,00000000,00000000), ref: 00405EC6
memcpy.MSVCRT(?), ref: 00405EFE

Strings

------, xrefs: 00405A96
", xrefs: 00405CD5
", xrefs: 00405E16
------, xrefs: 00405C0B
------, xrefs: 00405D4C

Memory Dump Source

Source File: 00000003.00000002.1778401976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ??2@$memcpy$CrackInternet
String ID: "$"$------$------$------
API String ID: 4271525049-2180234286
Opcode ID: 4205a6c64491eede6f2c0190817c01b6d1188d899bee5cc8d5380a99dbe7c93c
Instruction ID: 7b5b204680124ce1d4beb717fdfef1c68a0c63715f2d18b0248442adb904f056
Opcode Fuzzy Hash: 4205a6c64491eede6f2c0190817c01b6d1188d899bee5cc8d5380a99dbe7c93c
Instruction Fuzzy Hash: 20124071821118ABCB15FBA1DC95FEEB378BF14314F50419EB10A62091DF782B9ACF69

Function 00409E10 Relevance: 10.7, APIs: 3, Strings: 4, Instructions: 167COMMON

Download Yara Rule

APIs

memcmp.MSVCRT(?,v20,00000003), ref: 00409E2D

Part of subcall function 00410A60: memset.MSVCRT ref: 00410C1C
Part of subcall function 00410A60: lstrcatA.KERNEL32(?,00000000), ref: 00410C35
Part of subcall function 00410A60: lstrcatA.KERNEL32(?,00420D7C), ref: 00410C47
Part of subcall function 00410A60: lstrcatA.KERNEL32(?,00000000), ref: 00410C5D
Part of subcall function 00410A60: lstrcatA.KERNEL32(?,00420D80), ref: 00410C6F

memcmp.MSVCRT(?,v10,00000003), ref: 00409EAF
memset.MSVCRT ref: 00409EE8

Strings

ERROR_RUN_EXTRACTOR, xrefs: 00409E67
@, xrefs: 00409EF1
v10, xrefs: 00409EA3
v20, xrefs: 00409E21

Memory Dump Source

Source File: 00000003.00000002.1778401976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$memcmpmemset
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 1976689032-1096346117
Opcode ID: cf3bd8b6a91d7380b4fcfdc4a2eaf8d3038d72e2fe7c69aa23c32b41aba9b41f
Instruction ID: cfc602575c7eb8b90e75612a825b183f0a0020e5ceb1952e76b28d7f8d83ce04
Opcode Fuzzy Hash: cf3bd8b6a91d7380b4fcfdc4a2eaf8d3038d72e2fe7c69aa23c32b41aba9b41f
Instruction Fuzzy Hash: C9615F30A00248EBCB24EFA5DD96FED7775AF44304F408029F90A6F1D1DB786A56CB5A

Function 00401310 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 139COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00401327
memset.MSVCRT ref: 00401516

Strings

SOFTWARE\monero-project\monero-core, xrefs: 00401335
wallet_path, xrefs: 00401330
.keys, xrefs: 0040136B
\Monero\wallet.keys, xrefs: 0040138D

Memory Dump Source

Source File: 00000003.00000002.1778401976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: memset
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 2221118986-218353709
Opcode ID: cf61a2f323856c46ff2e2e2879a4bb7527e8331aca03d31e6698724a443a2e3c
Instruction ID: 2d64d6a561879fca44fb71c04a0a84c7ebf7a9ed2d970630d286a4d87e6dc5bb
Opcode Fuzzy Hash: cf61a2f323856c46ff2e2e2879a4bb7527e8331aca03d31e6698724a443a2e3c
Instruction Fuzzy Hash: 955165B1D5011897CB15FB61DD91FED733CAF54304F4041ADB60A62092EE385BDACBAA

Function 004152C0 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 138stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406280: InternetOpenA.WININET(00420DFE,00000001,00000000,00000000,00000000,00420DFB), ref: 004062E1
Part of subcall function 00406280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406335
Part of subcall function 00406280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004063D1

strtok.MSVCRT(00000000,?), ref: 0041539E

Strings

ERROR, xrefs: 0041546F
ERROR, xrefs: 0041530A
ERROR, xrefs: 00415432
ERROR, xrefs: 004153B9
ERROR, xrefs: 004154A9

Memory Dump Source

Source File: 00000003.00000002.1778401976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internet$ConnectHttpOpenRequestSendstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 632984754-1526165396
Opcode ID: 4a2ea036609cd15b672270c35ab07a18dfd7f62b3a06473966441f12aab465d2
Instruction ID: 2e955e57ea7f1c083e6e45f715f374ff83ee784ca3e0e9be4ff8c8b21657e330
Opcode Fuzzy Hash: 4a2ea036609cd15b672270c35ab07a18dfd7f62b3a06473966441f12aab465d2
Instruction Fuzzy Hash: 1A514130911108EBCB14FF61CD92AED7779AF50358F50402EF80A6B591DF386B96CB6A

Function 0041B38C Relevance: 9.1, APIs: 6, Instructions: 98COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 0041B39A

Part of subcall function 0041AFAC: __mtinitlocknum.LIBCMT ref: 0041AFC2
Part of subcall function 0041AFAC: __amsg_exit.LIBCMT ref: 0041AFCE
Part of subcall function 0041AFAC: EnterCriticalSection.KERNEL32(?,?,?,0041AC60,0000000E,0042A0E0,0000000C,0041AC2A), ref: 0041AFD6

DecodePointer.KERNEL32(0042A120,00000020,0041B4DD,?,00000001,00000000,?,0041B4FF,000000FF,?,0041AFD3,00000011,?,?,0041AC60,0000000E), ref: 0041B3D6
DecodePointer.KERNEL32(?,0041B4FF,000000FF,?,0041AFD3,00000011,?,?,0041AC60,0000000E,0042A0E0,0000000C,0041AC2A), ref: 0041B3E7

Part of subcall function 0041BE35: EncodePointer.KERNEL32(00000000,0041C063,004495B8,00000314,00000000,?,?,?,?,?,0041B707,004495B8,Microsoft Visual C++ Runtime Library,00012010), ref: 0041BE37

DecodePointer.KERNEL32(-00000004,?,0041B4FF,000000FF,?,0041AFD3,00000011,?,?,0041AC60,0000000E,0042A0E0,0000000C,0041AC2A), ref: 0041B40D
DecodePointer.KERNEL32(?,0041B4FF,000000FF,?,0041AFD3,00000011,?,?,0041AC60,0000000E,0042A0E0,0000000C,0041AC2A), ref: 0041B420
DecodePointer.KERNEL32(?,0041B4FF,000000FF,?,0041AFD3,00000011,?,?,0041AC60,0000000E,0042A0E0,0000000C,0041AC2A), ref: 0041B42A

Memory Dump Source

Source File: 00000003.00000002.1778401976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$CriticalEncodeEnterSection__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2005412495-0
Opcode ID: 0b0bc3cab5f7049983f26cd80e00dd0aa4f75dbf31a2a29bc74296bdc4549019
Instruction ID: 13f01492c0df899e955246e6d1acdef18d299a0ed6057d30a0a2a93d2b0efa88
Opcode Fuzzy Hash: 0b0bc3cab5f7049983f26cd80e00dd0aa4f75dbf31a2a29bc74296bdc4549019
Instruction Fuzzy Hash: D6312874901349DFDF109FA9C9452DEBAF1FF48314F14802BE414A6262CBB94895DFAE

Function 0041C9DE Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041C9EA

Part of subcall function 0041BF9F: __getptd_noexit.LIBCMT ref: 0041BFA2
Part of subcall function 0041BF9F: __amsg_exit.LIBCMT ref: 0041BFAF

__amsg_exit.LIBCMT ref: 0041CA0A
__lock.LIBCMT ref: 0041CA1A
InterlockedDecrement.KERNEL32(?), ref: 0041CA37
free.MSVCRT ref: 0041CA4A
InterlockedIncrement.KERNEL32(0042B558), ref: 0041CA62

Memory Dump Source

Source File: 00000003.00000002.1778401976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lockfree
String ID:
API String ID: 634100517-0
Opcode ID: 8fe1d07e46c7f7a05b9aade772f191e19f6fe2cab31bcbc29ba7bdc60f9379df
Instruction ID: 83df0cd24f2ef528265bdd767f82c36d0b02d0b672a998c6c347af455cc5eb0e
Opcode Fuzzy Hash: 8fe1d07e46c7f7a05b9aade772f191e19f6fe2cab31bcbc29ba7bdc60f9379df
Instruction Fuzzy Hash: DF01C431A817299BC722EB669C857DE77A0BF04794F01811BE80467390C72C69D2CBDD

Function 00416F00 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00416F1F
??_U@YAPAXI@Z.MSVCRT(00000000,?,?,?,?,?,?,?,?,0041719A,00000000,65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30,00000000,00000000), ref: 00416F4D

Part of subcall function 00416BD0: strlen.MSVCRT ref: 00416BE1
Part of subcall function 00416BD0: strlen.MSVCRT ref: 00416C05

VirtualQueryEx.KERNEL32(?,00000000,?,0000001C), ref: 00416F92
??_V@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041719A), ref: 004170B3

Part of subcall function 00416DE0: ReadProcessMemory.KERNEL32(00000000,00000000,?,?,00000000,00064000,00064000,00000000,00000004), ref: 00416DF8

Strings

@, xrefs: 00416FA6

Memory Dump Source

Source File: 00000003.00000002.1778401976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: strlen$MemoryProcessQueryReadVirtual
String ID: @
API String ID: 2950663791-2766056989
Opcode ID: 0d89010186691ec5492239175b82a1a91f8bc2a2393b87c9978cf9f8736f9be8
Instruction ID: da6ee04ed372484ea639f8c5ae6d2cf8ded6d6947598eb42fecba3fc0a9bdd2e
Opcode Fuzzy Hash: 0d89010186691ec5492239175b82a1a91f8bc2a2393b87c9978cf9f8736f9be8
Instruction Fuzzy Hash: 27511CB5E041099BDB04CF98D981AEFBBB5FF88304F108559F919A7340D738EA51CBA5

Function 0041C742 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041C74E

Part of subcall function 0041BF9F: __getptd_noexit.LIBCMT ref: 0041BFA2
Part of subcall function 0041BF9F: __amsg_exit.LIBCMT ref: 0041BFAF

__getptd.LIBCMT ref: 0041C765
__amsg_exit.LIBCMT ref: 0041C773
__lock.LIBCMT ref: 0041C783
__updatetlocinfoEx_nolock.LIBCMT ref: 0041C797

Memory Dump Source

Source File: 00000003.00000002.1778401976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 3d7c1e79db36087730c99ab0a6624c72b46b4ffdd1162626bf4921dca9482436
Instruction ID: 8b8854a621eee9d40ba0401ebc9f05e8605540fb6beb74f1d93a4957509c98f2
Opcode Fuzzy Hash: 3d7c1e79db36087730c99ab0a6624c72b46b4ffdd1162626bf4921dca9482436
Instruction Fuzzy Hash: 1AF09632A817119BD7207BB95C867DE33A09F00728F24414FF414A62D2CBAC59D28E9E

Function 00409CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

memcmp.MSVCRT(?,DPAPI,00000005), ref: 00409D92

Part of subcall function 00409B60: memcpy.MSVCRT(?,?,?), ref: 00409BC6

Strings

"encrypted_key":", xrefs: 00409D30
, xrefs: 00409DC1
DPAPI, xrefs: 00409D89

Memory Dump Source

Source File: 00000003.00000002.1778401976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: memcmpmemcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 1784268899-738592651
Opcode ID: 858bb5d36e7e37b9704747d5b8cf33c67ecf781cccc3ca8f5e8d480075c2e052
Instruction ID: 5ad523267ed72994677b79ea1d9dce7d7822fbf486e040e59600fa97cf483dfd
Opcode Fuzzy Hash: 858bb5d36e7e37b9704747d5b8cf33c67ecf781cccc3ca8f5e8d480075c2e052
Instruction Fuzzy Hash: D53155B5D10109ABCB04EBE4DC85AEF77B8BF44304F14452AE915B7282E7389E04CBA5

Function 004117A0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 160stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 004117E8
strtok_s.MSVCRT ref: 004119A8

Strings

block, xrefs: 004117B7

Memory Dump Source

Source File: 00000003.00000002.1778401976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: strtok_s
String ID: block
API String ID: 3330995566-2199623458
Opcode ID: 04f02f922f7740013fe83ed2a8f854d15328f230cbde421a22dc870209397cee
Instruction ID: 00bb13bb87ecd4f31d5cbb7361e66ee12f2c4d363b15aa8138e6c51e0cba8311
Opcode Fuzzy Hash: 04f02f922f7740013fe83ed2a8f854d15328f230cbde421a22dc870209397cee
Instruction Fuzzy Hash: AC517DB4A10209EFCB04DFA1D954BFE77B6BF44304F10804AE516A7361D778E992CB6A

Function 004072D0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 149COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00407314
task.LIBCPMTD ref: 00407555

Part of subcall function 00409240: vsprintf_s.MSVCRT ref: 0040925B

Strings

Password, xrefs: 00407401

Memory Dump Source

Source File: 00000003.00000002.1778401976.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: memsettaskvsprintf_s
String ID: Password
API String ID: 2675463923-3434357891
Opcode ID: 5be579466c40cef3c45c052574d28d43fb537906c51874de2e9a9a2bc2377bc3
Instruction ID: ef12ebdd473109685825b75701b45193a1214ac884297e43e73859b9717fa869
Opcode Fuzzy Hash: 5be579466c40cef3c45c052574d28d43fb537906c51874de2e9a9a2bc2377bc3
Instruction Fuzzy Hash: B8614DB5D0416C9BDB24DB50CD41BDAB7B8BF44304F0081EAE689A6281DB746FC9CFA5

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MSBuild.exe_faac6578d9eb4145cf24c623c8a7076a595e99_473dd2bc_52b31ccd-8eba-4a37-807f-7573b8398155\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_ae274dd2d8e175c4221032451d263566c21c18b0_6b0bd2f1_d1b59c26-6c33-478e-ad15-96ff249114f2\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5B74.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5E54.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5E74.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAED9.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAFC4.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAFF4.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Windows Analysis Report
SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe

Function 00EC2021 Relevance: 7.6, APIs: 1, Strings: 3, Instructions: 631
memoryCOMMON

Function 00ED6368 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34
COMMONLIBRARYCODE

Function 00ED8E2E Relevance: 4.7, APIs: 3, Instructions: 202
COMMON

Function 00EDA3A6 Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Function 00ED9FAA Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Function 00EDC9E9 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 183
COMMONLIBRARYCODE