Edit tour

Windows Analysis Report
SKGOzZRZGX.exe

Overview

General Information

Sample name:	SKGOzZRZGX.exe renamed because original name is a hash value
Original sample name:	02d84538a17b96afc0845fb922645888.exe
Analysis ID:	1528623
MD5:	02d84538a17b96afc0845fb922645888
SHA1:	b3e5cc09fa25bac90a091b24222113476a18f91d
SHA256:	0cfea23100355dbb358f9355abe9acc2c93042e29027c9f547fab0c0084d6d63
Tags:	32exetrojan
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for sample

Sigma detected: Silenttrinity Stager Msbuild Activity

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

One or more processes crash

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

SKGOzZRZGX.exe (PID: 5636 cmdline: "C:\Users\user\Desktop\SKGOzZRZGX.exe" MD5: 02D84538A17B96AFC0845FB922645888)

MSBuild.exe (PID: 5624 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

MSBuild.exe (PID: 6544 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

WerFault.exe (PID: 4052 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6544 -s 1232 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 2316 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5636 -s 268 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://46.8.231.109/c4754d4f680ead72.php", "Botnet": "default"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.2474401417.0000000000488000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000002.00000002.2474401417.0000000000462000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000002.00000002.2474401417.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000002.00000002.2474955101.0000000000D57000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2154849305.000000000096D000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000002.00000002.2474401417.000000000049A000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: SKGOzZRZGX.exe PID: 5636	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: MSBuild.exe PID: 6544	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: MSBuild.exe PID: 6544	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.SKGOzZRZGX.exe.940000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.SKGOzZRZGX.exe.96dad8.2.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.SKGOzZRZGX.exe.96dad8.2.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
2.2.MSBuild.exe.400000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
2.2.MSBuild.exe.400000.0.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Sigma Signatures

System Summary

Sigma detected: Silenttrinity Stager Msbuild Activity

Source: Network Connection

Author: Kiran kumar s, oscd.community: Data: DestinationIp: 46.8.231.109, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 6544, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49704

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: SKGOzZRZGX.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://46.8.231.109/c4754d4f680ead72.php	URL Reputation: Label: malware
Source: http://46.8.231.109	URL Reputation: Label: malware
Source: http://46.8.231.109/	URL Reputation: Label: malware

Found malware configuration

Source: 0.2.SKGOzZRZGX.exe.96dad8.2.raw.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://46.8.231.109/c4754d4f680ead72.php", "Botnet": "default"}

Multi AV Scanner detection for domain / URL

Source: http://46.8.231.109/o	Virustotal: Detection: 16%	Perma Link
Source: http://46.8.231.109/T	Virustotal: Detection: 16%	Perma Link
Source: http://46.8.231.109/7	Virustotal: Detection: 16%	Perma Link

Multi AV Scanner detection for submitted file

Source: SKGOzZRZGX.exe	ReversingLabs: Detection: 44%
Source: SKGOzZRZGX.exe	Virustotal: Detection: 43%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: SKGOzZRZGX.exe

Joe Sandbox ML: detected

Source: SKGOzZRZGX.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49721 version: TLS 1.0

Source: unknown

HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.5:49722 version: TLS 1.2

Source: SKGOzZRZGX.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\SKGOzZRZGX.exe

Code function: 0_2_00959ABF FindFirstFileExW,

0_2_00959ABF

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://46.8.231.109/c4754d4f680ead72.php

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 46.8.231.109Connection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View

IP Address: 46.8.231.109 46.8.231.109

Source: Joe Sandbox View

ASN Name: FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49721 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 46.8.231.109Connection: Keep-AliveCache-Control: no-cache

Source: MSBuild.exe, 00000002.00000002.2474955101.0000000000D57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109
Source: MSBuild.exe, 00000002.00000002.2474955101.0000000000D9E000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2474955101.0000000000D57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/
Source: MSBuild.exe, 00000002.00000002.2474955101.0000000000D9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/7
Source: MSBuild.exe, 00000002.00000002.2474955101.0000000000D9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/T
Source: MSBuild.exe, 00000002.00000002.2474955101.0000000000D57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/nOXu
Source: MSBuild.exe, 00000002.00000002.2474955101.0000000000D9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/o
Source: MSBuild.exe, 00000002.00000002.2474955101.0000000000D57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109=
Source: Amcache.hve.6.dr	String found in binary or memory: http://upx.sf.net

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443

Source: unknown

HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.5:49722 version: TLS 1.2

Source: C:\Users\user\Desktop\SKGOzZRZGX.exe	Code function: 0_2_00942021	0_2_00942021
Source: C:\Users\user\Desktop\SKGOzZRZGX.exe	Code function: 0_2_0094729C	0_2_0094729C
Source: C:\Users\user\Desktop\SKGOzZRZGX.exe	Code function: 0_2_0095D39B	0_2_0095D39B
Source: C:\Users\user\Desktop\SKGOzZRZGX.exe	Code function: 0_2_0095572C	0_2_0095572C
Source: C:\Users\user\Desktop\SKGOzZRZGX.exe	Code function: 0_2_0094CAF2	0_2_0094CAF2
Source: C:\Users\user\Desktop\SKGOzZRZGX.exe	Code function: 0_2_0095BB36	0_2_0095BB36
Source: C:\Users\user\Desktop\SKGOzZRZGX.exe	Code function: 0_2_00953C92	0_2_00953C92
Source: C:\Users\user\Desktop\SKGOzZRZGX.exe	Code function: 0_2_00941D79	0_2_00941D79
Source: C:\Users\user\Desktop\SKGOzZRZGX.exe	Code function: 0_2_0094FEF0	0_2_0094FEF0
Source: C:\Users\user\Desktop\SKGOzZRZGX.exe	Code function: 0_2_00990F98	0_2_00990F98

Source: C:\Users\user\Desktop\SKGOzZRZGX.exe	Code function: String function: 00947B80 appears 49 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 004045C0 appears 317 times

Source: C:\Users\user\Desktop\SKGOzZRZGX.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5636 -s 268

Source: SKGOzZRZGX.exe, 00000000.00000002.2154950176.00000000009BC000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameproquota.exej% vs SKGOzZRZGX.exe
Source: SKGOzZRZGX.exe	Binary or memory string: OriginalFilenameproquota.exej% vs SKGOzZRZGX.exe

Source: SKGOzZRZGX.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: SKGOzZRZGX.exe

Static PE information: Section: .data ZLIB complexity 0.98994375

Source: classification engine

Classification label: mal100.troj.evad.winEXE@7/9@0/1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_00418680 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

2_2_00418680

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6544
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5636

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\a21b55c8-1c98-4424-bfd8-96ac479528d5

Jump to behavior

Source: SKGOzZRZGX.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SKGOzZRZGX.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SKGOzZRZGX.exe	ReversingLabs: Detection: 44%
Source: SKGOzZRZGX.exe	Virustotal: Detection: 43%

Source: unknown	Process created: C:\Users\user\Desktop\SKGOzZRZGX.exe "C:\Users\user\Desktop\SKGOzZRZGX.exe"
Source: C:\Users\user\Desktop\SKGOzZRZGX.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\SKGOzZRZGX.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\SKGOzZRZGX.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5636 -s 268
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6544 -s 1232
Source: C:\Users\user\Desktop\SKGOzZRZGX.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SKGOzZRZGX.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior

Source: C:\Users\user\Desktop\SKGOzZRZGX.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: SKGOzZRZGX.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: SKGOzZRZGX.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: SKGOzZRZGX.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: SKGOzZRZGX.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: SKGOzZRZGX.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: SKGOzZRZGX.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: SKGOzZRZGX.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: SKGOzZRZGX.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: SKGOzZRZGX.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: SKGOzZRZGX.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: SKGOzZRZGX.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: SKGOzZRZGX.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: SKGOzZRZGX.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_0041C03D LoadLibraryW,GetProcAddress,GetProcAddress,EncodePointer,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

2_2_0041C03D

Source: C:\Users\user\Desktop\SKGOzZRZGX.exe	Code function: 0_2_009471AD push ecx; ret	0_2_009471C0
Source: C:\Users\user\Desktop\SKGOzZRZGX.exe	Code function: 0_2_00987F0D push ecx; ret	0_2_00987F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0041B035 push ecx; ret	2_2_0041B048

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\SKGOzZRZGX.exe

API coverage: 4.2 %

Source: C:\Users\user\Desktop\SKGOzZRZGX.exe

Code function: 0_2_00959ABF FindFirstFileExW,

0_2_00959ABF

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_00401160 GetSystemInfo,

2_2_00401160

Source: Amcache.hve.6.dr	Binary or memory string: VMware
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.6.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.6.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.6.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: MSBuild.exe, 00000002.00000002.2474955101.0000000000DB2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2474955101.0000000000D57000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.6.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.6.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.6.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: MSBuild.exe, 00000002.00000002.2474955101.0000000000D57000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwarer?
Source: Amcache.hve.6.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.6.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: MSBuild.exe, 00000002.00000002.2474955101.0000000000D57000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Amcache.hve.6.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.6.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.6.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.6.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.6.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\SKGOzZRZGX.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\SKGOzZRZGX.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\SKGOzZRZGX.exe

Code function: 0_2_00947922 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00947922

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_004045C0 VirtualProtect ?,00000004,00000100,00000000

2_2_004045C0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

2_2_0041C03D

Source: C:\Users\user\Desktop\SKGOzZRZGX.exe	Code function: 0_2_00942003 mov edi, dword ptr fs:[00000030h]	0_2_00942003
Source: C:\Users\user\Desktop\SKGOzZRZGX.exe	Code function: 0_2_00986628 mov eax, dword ptr fs:[00000030h]	0_2_00986628
Source: C:\Users\user\Desktop\SKGOzZRZGX.exe	Code function: 0_2_0095A64C mov eax, dword ptr fs:[00000030h]	0_2_0095A64C
Source: C:\Users\user\Desktop\SKGOzZRZGX.exe	Code function: 0_2_00950F2E mov ecx, dword ptr fs:[00000030h]	0_2_00950F2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00419750 mov eax, dword ptr fs:[00000030h]	2_2_00419750

Source: C:\Users\user\Desktop\SKGOzZRZGX.exe

Code function: 0_2_0095CC4B GetProcessHeap,

0_2_0095CC4B

Source: C:\Users\user\Desktop\SKGOzZRZGX.exe	Code function: 0_2_00947610 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00947610
Source: C:\Users\user\Desktop\SKGOzZRZGX.exe	Code function: 0_2_00947922 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00947922
Source: C:\Users\user\Desktop\SKGOzZRZGX.exe	Code function: 0_2_00947AAF SetUnhandledExceptionFilter,	0_2_00947AAF
Source: C:\Users\user\Desktop\SKGOzZRZGX.exe	Code function: 0_2_0094DA73 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0094DA73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0041AD48 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_0041AD48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0041CEEA SetUnhandledExceptionFilter,	2_2_0041CEEA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0041B33A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_0041B33A

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: SKGOzZRZGX.exe PID: 5636, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6544, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\SKGOzZRZGX.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\SKGOzZRZGX.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\SKGOzZRZGX.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\SKGOzZRZGX.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\SKGOzZRZGX.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 41E000	Jump to behavior
Source: C:\Users\user\Desktop\SKGOzZRZGX.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 42B000	Jump to behavior
Source: C:\Users\user\Desktop\SKGOzZRZGX.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 65C000	Jump to behavior
Source: C:\Users\user\Desktop\SKGOzZRZGX.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: A2A008	Jump to behavior

Source: C:\Users\user\Desktop\SKGOzZRZGX.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"			Jump to behavior
Source: C:\Users\user\Desktop\SKGOzZRZGX.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"			Jump to behavior

Source: C:\Users\user\Desktop\SKGOzZRZGX.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_0095C085
Source: C:\Users\user\Desktop\SKGOzZRZGX.exe	Code function: GetLocaleInfoW,	0_2_0095622B
Source: C:\Users\user\Desktop\SKGOzZRZGX.exe	Code function: EnumSystemLocalesW,	0_2_0095C327
Source: C:\Users\user\Desktop\SKGOzZRZGX.exe	Code function: EnumSystemLocalesW,	0_2_0095C372
Source: C:\Users\user\Desktop\SKGOzZRZGX.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_0095C498
Source: C:\Users\user\Desktop\SKGOzZRZGX.exe	Code function: EnumSystemLocalesW,	0_2_0095C40D
Source: C:\Users\user\Desktop\SKGOzZRZGX.exe	Code function: GetLocaleInfoW,	0_2_0095C6EB
Source: C:\Users\user\Desktop\SKGOzZRZGX.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_0095C814
Source: C:\Users\user\Desktop\SKGOzZRZGX.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_0095C9E9
Source: C:\Users\user\Desktop\SKGOzZRZGX.exe	Code function: GetLocaleInfoW,	0_2_0095C91A
Source: C:\Users\user\Desktop\SKGOzZRZGX.exe	Code function: EnumSystemLocalesW,	0_2_00955D7F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetLocaleInfoA,	2_2_00417B90

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\SKGOzZRZGX.exe

Code function: 0_2_00947815 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00947815

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_00417850 GetUserNameA,

2_2_00417850

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 2_2_00417A30 GetTimeZoneInformation,

2_2_00417A30

Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.SKGOzZRZGX.exe.940000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SKGOzZRZGX.exe.96dad8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SKGOzZRZGX.exe.96dad8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2474401417.0000000000488000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2474401417.0000000000462000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2474401417.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2474955101.0000000000D57000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2154849305.000000000096D000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2474401417.000000000049A000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6544, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.SKGOzZRZGX.exe.940000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SKGOzZRZGX.exe.96dad8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SKGOzZRZGX.exe.96dad8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2474401417.0000000000488000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2474401417.0000000000462000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2474401417.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2474955101.0000000000D57000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2154849305.000000000096D000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2474401417.000000000049A000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6544, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	311 Process Injection	1 Virtualization/Sandbox Evasion	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Disable or Modify Tools	LSASS Memory	41 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	311 Process Injection	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	33 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
SKGOzZRZGX.exe	45%	ReversingLabs	Win32.Trojan.Mikey
SKGOzZRZGX.exe	44%	Virustotal		Browse
SKGOzZRZGX.exe	100%	Avira	HEUR/AGEN.1310458
SKGOzZRZGX.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
bg.microsoft.map.fastly.net	0%	Virustotal	Browse
fp2e7a.wpc.phicdn.net	0%	Virustotal	Browse
s-part-0032.t-0009.t-msedge.net	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe
http://46.8.231.109/c4754d4f680ead72.php	100%	URL Reputation	malware
http://46.8.231.109	100%	URL Reputation	malware
http://46.8.231.109/	100%	URL Reputation	malware
http://46.8.231.109/o	17%	Virustotal		Browse
http://46.8.231.109/T	17%	Virustotal		Browse
http://46.8.231.109/7	17%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	0%, Virustotal, Browse	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	0%, Virustotal, Browse	unknown
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://46.8.231.109/c4754d4f680ead72.php	true	URL Reputation: malware	unknown
http://46.8.231.109/	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://46.8.231.109/7	MSBuild.exe, 00000002.00000002.2474955101.0000000000D9E000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://upx.sf.net	Amcache.hve.6.dr	false	URL Reputation: safe	unknown
http://46.8.231.109/T	MSBuild.exe, 00000002.00000002.2474955101.0000000000D9E000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://46.8.231.109/o	MSBuild.exe, 00000002.00000002.2474955101.0000000000D9E000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://46.8.231.109/nOXu	MSBuild.exe, 00000002.00000002.2474955101.0000000000D57000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://46.8.231.109=	MSBuild.exe, 00000002.00000002.2474955101.0000000000D57000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://46.8.231.109	MSBuild.exe, 00000002.00000002.2474955101.0000000000D57000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
46.8.231.109	unknown	Russian Federation		28917	FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528623
Start date and time:	2024-10-08 05:03:04 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SKGOzZRZGX.exe renamed because original name is a hash value
Original Sample Name:	02d84538a17b96afc0845fb922645888.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@7/9@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 31 Number of non-executed functions: 66
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.190.159.4, 40.126.31.67, 40.126.31.73, 20.190.159.0, 20.190.159.71, 40.126.31.71, 20.190.159.75, 20.190.159.64, 199.232.214.172, 192.229.221.95, 20.42.65.92, 172.202.163.200, 40.69.42.241, 13.85.23.206, 20.189.173.20
Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, ctldl.windowsupdate.com.delivery.microsoft.com, slscr.update.microsoft.com, otelrules.azureedge.net, www.tm.v4.a.prd.aadg.akadns.net, otelrules.afd.azureedge.net, onedsblobprdwus15.westus.cloudapp.azure.com, ctldl.windowsupdate.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, onedsblobprdeus17.eastus.cloudapp.azure.com, ocsp.digicert.com, login.live.com, ocsp.edge.digicert.com, blobcollector.events.data.trafficmanager.net, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, azureedge-t-prod.trafficmanager.net, umwatson.events.data.microsoft.com, wu-b-net.trafficmanager.net, www.tm.lg.prod.aadmsa.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
23:04:06	API Interceptor	2x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
46.8.231.109	SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Get hash	malicious	Stealc	Browse	46.8.231.109/
	lihZ6gUU7V.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	FdjDPFGTZS.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	45Ywq5ad5H.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	NdSXVNeoET.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	fe6yqly1Xh.exe	Get hash	malicious	Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	CR0QGWXdDl.exe	Get hash	malicious	Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	E7Bu6a7eve.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0032.t-0009.t-msedge.net	VmRHSCaiyc.exe	Get hash	malicious	LummaC, Vidar	Browse	13.107.246.60
	MmcJhaiYNh.exe	Get hash	malicious	Stealc	Browse	13.107.246.60
	https://starylasfe.com.de/6SZZr/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	SecuriteInfo.com.Trojan.DownLoader47.43340.9153.30810.exe	Get hash	malicious	LummaC	Browse	13.107.246.60
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.60
	http://hans.uniformeslaamistad.com/prog/66ce237125ba7_vjrew2ge.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://url.avanan.click/v2/r01/___https://www.tiktok.com/qnspdA7?fni=6cbb&qfsl=js&xhjsj=gnt_zwq&yfwljy=myyux:ddBBB.lttlqj.ht.zpdzwq?v=frudxdBjlfmjfqymhfwj.ht.pjd.kwjsy___.YXAzOnNvdXRoZXJua2l0Y2hlbmFuZGdyaWxsOmE6bzpiNGZlZGFhNjcxOTBhYjU4MTE5MjBlZTRiYTAxZmUwMTo3OmIxYWM6MDg1ODNlNjljZDkwNThkM2ZiM2RjYTI4MzFjZGY4NGFmMTYyZTlhYmVjYWYxY2Q4MmNkZDhiNmFmOWVkOWUxOTpoOlQ6VA#Sm9hbi5LbmlwcGVuQEVsa2F5LkNvbQ==	Get hash	malicious	Unknown	Browse	13.107.246.60
	utmggBCMML.exe	Get hash	malicious	LummaC	Browse	13.107.246.60
	lihZ6gUU7V.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	13.107.246.60
	Bn7LPdQA1s.exe	Get hash	malicious	LummaC, Vidar	Browse	13.107.246.60
fp2e7a.wpc.phicdn.net	j8zJ5Jwja4.exe	Get hash	malicious	LummaC	Browse	192.229.221.95
	SecuriteInfo.com.Trojan.DownLoader47.43340.27469.30352.exe	Get hash	malicious	LummaC	Browse	192.229.221.95
	ctMI3TYXpX.exe	Get hash	malicious	SmokeLoader	Browse	192.229.221.95
	https://starylasfe.com.de/6SZZr/	Get hash	malicious	HTMLPhisher	Browse	192.229.221.95
	T2bmenoX1o.exe	Get hash	malicious	LummaC, Vidar	Browse	192.229.221.95
	DocuSign2.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	SecuriteInfo.com.Trojan.DownLoader47.43340.9153.30810.exe	Get hash	malicious	LummaC	Browse	192.229.221.95
	http://hans.uniformeslaamistad.com/prog/66ce237125ba7_vjrew2ge.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	http://hans.uniformeslaamistad.com/prog/66f5db9e54794_vfkagks.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	ylVAEHbMLf.exe	Get hash	malicious	Xmrig	Browse	192.229.221.95
bg.microsoft.map.fastly.net	MmcJhaiYNh.exe	Get hash	malicious	Stealc	Browse	199.232.214.172
	ctMI3TYXpX.exe	Get hash	malicious	SmokeLoader	Browse	199.232.214.172
	https://starylasfe.com.de/6SZZr/	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172
	T2bmenoX1o.exe	Get hash	malicious	LummaC, Vidar	Browse	199.232.210.172
	SecuriteInfo.com.Trojan.DownLoader47.43340.9153.30810.exe	Get hash	malicious	LummaC	Browse	199.232.210.172
	http://pay.christinagstewart.com/	Get hash	malicious	Unknown	Browse	199.232.214.172
	http://hans.uniformeslaamistad.com/prog/66ce237125ba7_vjrew2ge.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	http://hans.uniformeslaamistad.com/prog/66f5db9e54794_vfkagks.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	h2qWqtD73F.exe	Get hash	malicious	Xmrig	Browse	199.232.214.172
	SecuriteInfo.com.Win32.PWSX-gen.27846.23954.exe	Get hash	malicious	LummaC	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics	SecuriteInfo.com.Trojan.DownLoader47.43340.12576.1316.exe	Get hash	malicious	Stealc	Browse	46.8.231.109
	lihZ6gUU7V.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	FdjDPFGTZS.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	45Ywq5ad5H.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	NdSXVNeoET.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	46.8.231.109
	fe6yqly1Xh.exe	Get hash	malicious	Stealc, Vidar	Browse	46.8.231.109
	CR0QGWXdDl.exe	Get hash	malicious	Stealc, Vidar	Browse	46.8.231.109
	E7Bu6a7eve.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	http://hans.uniformeslaamistad.com/yuop/66e6ea133c92f_crypted.exe#xin	Get hash	malicious	PureLog Stealer, RedLine, zgRAT	Browse	23.1.237.91
	Audio_Msg..00293614554893Transcript.html	Get hash	malicious	Unknown	Browse	23.1.237.91
	http://hans.uniformeslaamistad.com/prog/66f5db9e54794_vfkagks.exe	Get hash	malicious	Unknown	Browse	23.1.237.91
	RemittanceDetails(Rjackson)CQDM.html	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	https://url.avanan.click/v2/r01/___https://www.tiktok.com/qnspdA7?fni=6cbb&qfsl=js&xhjsj=gnt_zwq&yfwljy=myyux:ddBBB.lttlqj.ht.zpdzwq?v=frudxdBjlfmjfqymhfwj.ht.pjd.kwjsy___.YXAzOnNvdXRoZXJua2l0Y2hlbmFuZGdyaWxsOmE6bzpiNGZlZGFhNjcxOTBhYjU4MTE5MjBlZTRiYTAxZmUwMTo3OmIxYWM6MDg1ODNlNjljZDkwNThkM2ZiM2RjYTI4MzFjZGY4NGFmMTYyZTlhYmVjYWYxY2Q4MmNkZDhiNmFmOWVkOWUxOTpoOlQ6VA#Sm9hbi5LbmlwcGVuQEVsa2F5LkNvbQ==	Get hash	malicious	Unknown	Browse	23.1.237.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	23.1.237.91
	L-tron_Payroll.docx	Get hash	malicious	Unknown	Browse	23.1.237.91
	WiTqtf1aiE.exe	Get hash	malicious	LummaC, Vidar	Browse	23.1.237.91
	https://ipp.safetyworksolutions.com/	Get hash	malicious	Unknown	Browse	23.1.237.91
	FdjDPFGTZS.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	23.1.237.91
28a2c9bd18a11de089ef85a160da29e4	VmRHSCaiyc.exe	Get hash	malicious	LummaC, Vidar	Browse	13.107.246.60
	MmcJhaiYNh.exe	Get hash	malicious	Stealc	Browse	13.107.246.60
	https://starylasfe.com.de/6SZZr/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	T2bmenoX1o.exe	Get hash	malicious	LummaC, Vidar	Browse	13.107.246.60
	SecuriteInfo.com.Trojan.DownLoader47.43340.9153.30810.exe	Get hash	malicious	LummaC	Browse	13.107.246.60
	https://Vv.ndlevesio.com/vrbU/	Get hash	malicious	Unknown	Browse	13.107.246.60
	http://hans.uniformeslaamistad.com/yuop/66e6ea133c92f_crypted.exe#xin	Get hash	malicious	PureLog Stealer, RedLine, zgRAT	Browse	13.107.246.60
	http://pay.christinagstewart.com/	Get hash	malicious	Unknown	Browse	13.107.246.60
	http://hans.uniformeslaamistad.com/prog/66ce237125ba7_vjrew2ge.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	Audio_Msg..00293614554893Transcript.html	Get hash	malicious	Unknown	Browse	13.107.246.60

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MSBuild.exe_faac6578d9eb4145cf24c623c8a7076a595e99_473dd2bc_25526f99-51e3-4fed-be84-a8b4399a509e\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9524165065673046
Encrypted:	false
SSDEEP:	192:6jmcODKfE0BU/gju0ZrVZazuiFCZ24IO8qu:e2Of/BU/gjPEzuiFCY4IO8q
MD5:	CCDEEF3CCBCEADC32200450D93B9C3BB
SHA1:	F6399865B67B0DAFC03107B399D82DBE135D60BC
SHA-256:	07624EC01FE2E07190F7A76114E9AEDE868A4BDA4BB6BA335CDD97381A2AAB54
SHA-512:	419464A98BD48FA9F5BB8F78E824C77A7A279F414357F0462A07ACFFB43318D4F1780075E2F09AE9FF17503F2612CE7B6D65AE2DD5419DEC871E2331B695FE31
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.8.3.0.2.7.5.6.6.3.3.2.0.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.8.3.0.2.7.6.0.2.2.6.9.9.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.5.5.2.6.f.9.9.-.5.1.e.3.-.4.f.e.d.-.b.e.8.4.-.a.8.b.4.3.9.9.a.5.0.9.e.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.0.5.d.b.b.d.f.-.2.7.3.9.-.4.f.2.e.-.a.7.2.b.-.6.b.d.e.a.4.c.3.6.5.3.d.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.S.B.u.i.l.d...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.M.S.B.u.i.l.d...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.9.0.-.0.0.0.1.-.0.0.1.4.-.a.3.4.1.-.8.b.b.4.2.e.1.9.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.e.6.2.5.6.a.0.1.5.9.6.8.8.f.0.5.6.0.b.0.1.5.d.a.4.d.9.6.7.f.4.1.c.b.f.8.c.9.b.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SKGOzZRZGX.exe_e684d2ca82731b98552a3bb17475e5bde46424c_43b18d07_41c4bfc4-9f02-41b8-a05b-620d2eae153a\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6561561988037393
Encrypted:	false
SSDEEP:	96:Z8Fpe80QFcfosKytQAgf5QXIDcQvc6QcEVcw3cE/n+HbHg/5hZAX/d5FMT2SlPkA:eb1LFcfoI0BU/gjhzuiFdZ24IO8h
MD5:	D7C67BDB57F2B90E4096C1C0FD9C60B3
SHA1:	CF06EAEF90C0BECA547CC98202AAC9B3549B2A95
SHA-256:	F50CE1B98ECE49275F5C17699C9C6D9514CB1EA16A63BF57549C868074FBDB79
SHA-512:	6BAE9DE58B1EC8F5F0BBF38A641E11A64FF8810E32E8D93E36AC9E5BA2C05D2413120A1CBBBDA9C9EC8CA04BE10788133F104E55136EFC7E9718760AE9255655
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.8.3.0.2.3.3.0.3.9.0.4.6.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.8.3.0.2.3.3.3.8.2.7.9.0.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.1.c.4.b.f.c.4.-.9.f.0.2.-.4.1.b.8.-.a.0.5.b.-.6.2.0.d.2.e.a.e.1.5.3.a.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.c.3.c.3.7.9.f.-.8.d.1.3.-.4.e.3.2.-.b.e.a.3.-.2.5.3.5.8.8.4.a.d.4.5.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.S.K.G.O.z.Z.R.Z.G.X...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.p.r.o.q.u.o.t.a...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.6.0.4.-.0.0.0.1.-.0.0.1.4.-.4.7.7.4.-.7.1.b.4.2.e.1.9.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.7.d.0.3.f.6.a.1.a.a.4.5.0.5.0.f.7.b.e.5.5.f.8.7.6.f.e.a.2.d.c.0.0.0.0.0.9.0.4.!.0.0.0.0.b.3.e.5.c.c.0.9.f.a.2.5.b.a.c.9.0.a.0.9.1.b.2.4.2.2.2.1.1.3.4.7.6.a.1.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER54A4.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Oct 8 03:03:53 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	33150
Entropy (8bit):	1.7787618018490243
Encrypted:	false
SSDEEP:	96:5Q8QEWkAzFzxhdxxli77avDTozKRH2y/bCZe7egcsHaDhdcrUeuF/xOQXzWIkWIo:FibOeNexUwhW+p4m23HduUz3
MD5:	2A2F5E9F4C0E0628BBE5A93E607C737D
SHA1:	B122B15AEBEACB8226F99D3406510A23351C6762
SHA-256:	53FAB7B5C75B34099D644E135CF44D2B41EAD0CC3C169BACE0C4675E540580B7
SHA-512:	18CAB375BC2F3836FF7E8F0A658FEFC4ECD44E055CB664A3F157DA8E70D241C9C1A72D7616604CC6D7A5B1114788F767B5A1676827FF43228A1DF20053748A8A
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ..........g........................d...........................T.......8...........T...............~v......................................................................................................eJ..............GenuineIntel............T..............g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5512.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8328
Entropy (8bit):	3.707426025596397
Encrypted:	false
SSDEEP:	192:R6l7wVeJA2626YEIsSUPkYgmfGnFOprp89b5Rsfrzm:R6lXJ5626YEzSUPkYgmfGnFN5Kfu
MD5:	0CE018EF636F6990E014776A29639B13
SHA1:	66128A54C8EAA5ECD1FE195BF0E44CB22758B00C
SHA-256:	87A3E403BA3EFDDD879252DC81FF5DB1157FE8D7290EFE54E117BD70263145A5
SHA-512:	F9EA9AD3A7A6A9951892692F09A03E2496CD5AD346D4839351B4F5FB420D9FF2D0E28F2C6F8B30FD6E1E17D81355DDE9C9CDD7864B8964F1D0B39ADF81112B84
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.6.3.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5571.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4678
Entropy (8bit):	4.517632900119493
Encrypted:	false
SSDEEP:	48:cvIwWl8zsfJg77aI9HMWpW8VYLYm8M4J5HFa6j+q88daFEDwMfd:uIjfBI7Fl7VjJO2raFELfd
MD5:	4865947D571219DB7AB860D62FD69B10
SHA1:	96B3A3DB710230C9CBFF865208A821E335B83CEA
SHA-256:	9448222C200C660F978147A86FB95EC9BEF339BE7BB0B22EA340442BB8C2B0BA
SHA-512:	A42C5E840B4BA1C9D451DC5DEC00B776107A0DF51A571B275EBEBC8BE7BFCC9BDB53D0E864BABE4440F5B9C7F083AB392562A9E6E81F2BD3B046A50F654EB421
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="533886" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFB25.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Oct 8 03:04:35 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	109420
Entropy (8bit):	1.6001467124292126
Encrypted:	false
SSDEEP:	384:8cR7qBTz9rSEH5zj8Qj/tMk2KHrzjwCdZ:dR7qt9rSEH5rtMkdzjh
MD5:	5A09D90183FA235C65E073609C4F5B67
SHA1:	5D88F69296A174DA995D985A150CFCACEA4A4F60
SHA-256:	7D48559DA512B09CDE37615B441CBC701895E47EB20937CC3958AB4D0D23784E
SHA-512:	BBBE88B6BD0AD626EDB03DF50377B184F4BDE678819647A0A06C7C06584BFAB501EFC8F40AEF9DD56412399ED54E070615937C8E518DD846DB273A8C7BEC1E87
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .......C..g....................................D....>..........T.......8...........T............0...z..........<...........(...............................................................................eJ..............GenuineIntel............T..............g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFC00.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6322
Entropy (8bit):	3.7217224804471924
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbyC6oYsQE/X365aM4UP89bOWsfF6m:R6l7wVeJyC6oYsOprP89bOWsfF6m
MD5:	65E9D010602AA01C903B1F15045FE320
SHA1:	0F05B9C107353BADD01C106B50D20978EC755559
SHA-256:	4A3301E55F931EBA7CF47CA46F16799D87A709671ABB1550B847048F76B41A4D
SHA-512:	B667123279C1EBECBBA0F8E3453115B745311BD5C80A525323A2F6F98BC21A5F3A188660DD9DFA3A4293D7E679F8A37AC72E833A6CFCA61E51A0787F16846B8C
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.5.4.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFC21.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4640
Entropy (8bit):	4.466571690787392
Encrypted:	false
SSDEEP:	48:cvIwWl8zsWrJg77aI9HMWpW8VY2Ym8M4JXpeF6+q88iG4mLyd:uIjf2I7Fl7VWJDOmLyd
MD5:	B7E8B0EFDBC26C72307FFA710114A2CC
SHA1:	B30C960489CBEB07A95F698B107A2B2C5C758AD8
SHA-256:	C2DF8D903AC58D5E4DEAE864492400515148A021E7513BF712C1DBF0B4CE2DA3
SHA-512:	44AAB4CCE2DF8E09CC92D6209BDE47BBE4EF4BD40744214F9C3251B8D895C6AC9BAAC9E605023C3BB8A543F05C5A44F637026AE56F5F7D0441FFCCCF443368C5
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="533887" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.425777117172474
Encrypted:	false
SSDEEP:	6144:pSvfpi6ceLP/9skLmb0OTbWSPHaJG8nAgeMZMMhA2fX4WABlEnNa0uhiTw:gvloTbW+EZMM6DFys03w
MD5:	A2EB4C2ABC7504338CD5F506A3087A16
SHA1:	E09ABE1EFFF2D5401CB43ACD8F6ED05661A33D92
SHA-256:	542F45A9BAF5268CB5237B1B6B59C2F19FF63DA97A5F606918C243E3BE9369E0
SHA-512:	D334CB0567010A899880845A736A2ACB42F192889437A0A5523D814E0FADB2281F8DF698B65631F8445ECBDE55E6D4370098659F25B953C9E7B09E89E8DBF90D
Malicious:	false
Preview:	regf?...?....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmj...................................................................................................................................................................................................................................................................................................................................................e.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.682943614836316
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SKGOzZRZGX.exe
File size:	505'344 bytes
MD5:	02d84538a17b96afc0845fb922645888
SHA1:	b3e5cc09fa25bac90a091b24222113476a18f91d
SHA256:	0cfea23100355dbb358f9355abe9acc2c93042e29027c9f547fab0c0084d6d63
SHA512:	779f9966af0d7b152e30613fb3256b55dc5a95c584fe52ddbc0d0b4f35bd491b8b56cb9301f58b6fe8488e843ac9872c96a9f744ed0b2b022a59bf2ac23fbd4d
SSDEEP:	12288:FpBE8S9QVKBi/sril/g0nuqBVUhi9Cgu72HFQjX3axo3rK4S:FvS9+nuqfbPWX3axo3rL
TLSH:	9FB4F11675C18032C57726324AF5DBB55A7DB8B00E619EDF6B840B7E0F30681EB22A67
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=.9.y.WUy.WUy.WU..TTu.WU..RT..WU..STl.WU..VTz.WUy.VU!.WUilTTm.WUilSTk.WUilRT4.WU1m^Tx.WU1m.Ux.WU1mUTx.WURichy.WU...............

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x406f52
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x67049DA8 [Tue Oct 8 02:49:12 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	d10af643340e1121562abe3e6bd5b0e1

Entrypoint Preview

Instruction
call 00007F69C525A1C0h
jmp 00007F69C525972Fh
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
cmp edx, esi
je 00007F69C52598CBh
mov ecx, dword ptr [ebp+0Ch]
cmp ecx, dword ptr [edx+0Ch]
jc 00007F69C52598BCh
mov eax, dword ptr [edx+08h]
add eax, dword ptr [edx+0Ch]
cmp ecx, eax
jc 00007F69C52598BEh
add edx, 28h
cmp edx, esi
jne 00007F69C525989Ch
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 00007F69C52598ABh
push esi
call 00007F69C525A4D4h
test eax, eax
je 00007F69C52598D2h
mov eax, dword ptr fs:[00000018h]
mov esi, 0047B354h
mov edx, dword ptr [eax+04h]
jmp 00007F69C52598B6h
cmp edx, eax
je 00007F69C52598C2h
xor eax, eax
mov ecx, edx
lock cmpxchg dword ptr [esi], ecx
test eax, eax
jne 00007F69C52598A2h
xor al, al
pop esi
ret
mov al, 01h
pop esi
ret
push ebp
mov ebp, esp
cmp dword ptr [ebp+08h], 00000000h
jne 00007F69C52598B9h
mov byte ptr [0047B358h], 00000001h
call 00007F69C5259B6Ah
call 00007F69C525CA87h
test al, al
jne 00007F69C52598B6h
xor al, al
pop ebp
ret
call 00007F69C52654E9h
test al, al
jne 00007F69C52598BCh
push 00000000h
call 00007F69C525CA8Eh
pop ecx
jmp 00007F69C525989Bh
mov al, 01h
pop ebp
ret
push ebp
mov ebp, esp
cmp byte ptr [0047B359h], 00000000h
je 00007F69C52598B6h
mov al, 01h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2c6c0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x7c000	0x3d8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7d000	0x1ad4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2abc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2ab00	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x23000	0x12c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x210f0	0x21200	abc809dfa2f63d65dcfee8d0199d2113	False	0.5865639740566038	data	6.669510848280047	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x23000	0x9d78	0x9e00	01ed32e78e64e4e0d1a93ccfef6fb559	False	0.43515130537974683	data	4.9595302793820855	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2d000	0x4ef80	0x4e200	5f7c3c65fbbd6eb0dc2430721b54aa17	False	0.98994375	DOS executable (block device driver \377\377\377\377,32-bit sector-support)	7.990468804053453	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x7c000	0x3d8	0x400	5584c2fd2a321b3ff4d89d84727643be	False	0.4404296875	data	3.290569201128903	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x7d000	0x1ad4	0x1c00	d484cb3459fafe97b27216243a8f9a25	False	0.7269810267857143	data	6.393810321461398	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x7c058	0x380	data	English	United States	0.46205357142857145

Imports

DLL

Import

KERNEL32.dll

AttachConsole, MultiByteToWideChar, GetStringTypeW, WideCharToMultiByte, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, LCMapStringEx, GetCPInfo, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, CreateFileW, RaiseException, RtlUnwind, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, HeapAlloc, HeapFree, GetFileType, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileSizeEx, SetFilePointerEx, CloseHandle, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, GetProcessHeap, ReadConsoleW, HeapSize, WriteConsoleW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 05:03:50.094765902 CEST	49675	443	192.168.2.5	23.1.237.91
Oct 8, 2024 05:03:50.094768047 CEST	49674	443	192.168.2.5	23.1.237.91
Oct 8, 2024 05:03:50.204103947 CEST	49673	443	192.168.2.5	23.1.237.91
Oct 8, 2024 05:03:53.601603985 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 8, 2024 05:03:53.607012033 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 8, 2024 05:03:53.607120037 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 8, 2024 05:03:53.607753992 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 8, 2024 05:03:53.612678051 CEST	80	49704	46.8.231.109	192.168.2.5
Oct 8, 2024 05:03:59.704022884 CEST	49675	443	192.168.2.5	23.1.237.91
Oct 8, 2024 05:03:59.704062939 CEST	49674	443	192.168.2.5	23.1.237.91
Oct 8, 2024 05:03:59.813580990 CEST	49673	443	192.168.2.5	23.1.237.91
Oct 8, 2024 05:04:01.456947088 CEST	443	49703	23.1.237.91	192.168.2.5
Oct 8, 2024 05:04:01.457093954 CEST	49703	443	192.168.2.5	23.1.237.91
Oct 8, 2024 05:04:11.557511091 CEST	49703	443	192.168.2.5	23.1.237.91
Oct 8, 2024 05:04:11.558487892 CEST	49703	443	192.168.2.5	23.1.237.91
Oct 8, 2024 05:04:11.558872938 CEST	49721	443	192.168.2.5	23.1.237.91
Oct 8, 2024 05:04:11.558933973 CEST	443	49721	23.1.237.91	192.168.2.5
Oct 8, 2024 05:04:11.559010983 CEST	49721	443	192.168.2.5	23.1.237.91
Oct 8, 2024 05:04:11.562376976 CEST	443	49703	23.1.237.91	192.168.2.5
Oct 8, 2024 05:04:11.563257933 CEST	443	49703	23.1.237.91	192.168.2.5
Oct 8, 2024 05:04:11.578879118 CEST	49721	443	192.168.2.5	23.1.237.91
Oct 8, 2024 05:04:11.578903913 CEST	443	49721	23.1.237.91	192.168.2.5
Oct 8, 2024 05:04:12.181003094 CEST	443	49721	23.1.237.91	192.168.2.5
Oct 8, 2024 05:04:12.181221962 CEST	49721	443	192.168.2.5	23.1.237.91
Oct 8, 2024 05:04:13.435553074 CEST	49722	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:13.435590982 CEST	443	49722	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:13.435656071 CEST	49722	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:13.435959101 CEST	49722	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:13.435972929 CEST	443	49722	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:14.089282990 CEST	443	49722	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:14.089483023 CEST	49722	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:14.090842962 CEST	49722	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:14.090854883 CEST	443	49722	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:14.091346025 CEST	443	49722	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:14.099726915 CEST	49722	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:14.147409916 CEST	443	49722	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:14.198935032 CEST	443	49722	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:14.198997974 CEST	443	49722	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:14.199042082 CEST	443	49722	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:14.199101925 CEST	49722	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:14.199112892 CEST	443	49722	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:14.199172020 CEST	49722	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:14.199317932 CEST	49722	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:14.285677910 CEST	443	49722	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:14.285744905 CEST	443	49722	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:14.285785913 CEST	49722	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:14.285794020 CEST	443	49722	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:14.285828114 CEST	49722	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:14.285922050 CEST	49722	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:14.287209034 CEST	443	49722	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:14.287256002 CEST	443	49722	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:14.287292957 CEST	49722	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:14.287298918 CEST	443	49722	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:14.287338972 CEST	49722	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:14.287386894 CEST	49722	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:14.371325016 CEST	443	49722	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:14.371364117 CEST	443	49722	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:14.371427059 CEST	49722	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:14.371452093 CEST	443	49722	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:14.371475935 CEST	49722	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:14.371771097 CEST	49722	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:14.372410059 CEST	443	49722	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:14.372431993 CEST	443	49722	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:14.372512102 CEST	49722	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:14.372512102 CEST	49722	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:14.372519970 CEST	443	49722	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:14.373929024 CEST	443	49722	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:14.373955011 CEST	443	49722	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:14.374037027 CEST	49722	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:14.374037027 CEST	49722	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:14.374043941 CEST	443	49722	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:14.374445915 CEST	49722	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:14.374789000 CEST	443	49722	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:14.374808073 CEST	443	49722	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:14.375133991 CEST	49722	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:14.375142097 CEST	443	49722	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:14.376853943 CEST	49722	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:14.459054947 CEST	443	49722	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:14.459117889 CEST	443	49722	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:14.459157944 CEST	49722	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:14.459178925 CEST	443	49722	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:14.459208012 CEST	49722	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:14.459368944 CEST	49722	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:14.459697962 CEST	443	49722	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:14.459752083 CEST	443	49722	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:14.459789991 CEST	49722	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:14.459796906 CEST	443	49722	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:14.459893942 CEST	49722	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:14.460117102 CEST	49722	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:14.460431099 CEST	443	49722	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:14.460479975 CEST	443	49722	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:14.460516930 CEST	49722	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:14.460522890 CEST	443	49722	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:14.460549116 CEST	49722	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:14.460628033 CEST	49722	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:14.461299896 CEST	443	49722	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:14.461339951 CEST	443	49722	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:14.461374044 CEST	49722	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:14.461380959 CEST	443	49722	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:14.461431026 CEST	49722	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:14.461431026 CEST	49722	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:14.462265015 CEST	443	49722	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:14.462313890 CEST	443	49722	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:14.462357998 CEST	49722	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:14.462372065 CEST	443	49722	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:14.462403059 CEST	49722	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:14.462564945 CEST	49722	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:14.463170052 CEST	443	49722	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:14.463212967 CEST	443	49722	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:14.463236094 CEST	49722	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:14.463244915 CEST	443	49722	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:14.463270903 CEST	49722	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:14.463341951 CEST	49722	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:14.463877916 CEST	443	49722	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:14.463962078 CEST	49722	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:14.463968039 CEST	443	49722	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:14.464004993 CEST	49722	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:14.464004993 CEST	49722	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:14.464010954 CEST	443	49722	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:14.464031935 CEST	443	49722	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:14.504766941 CEST	49723	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:14.504779100 CEST	443	49723	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:14.504899025 CEST	49724	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:14.504920959 CEST	443	49724	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:14.505017042 CEST	49723	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:14.505064011 CEST	49724	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:14.505372047 CEST	49723	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:14.505381107 CEST	443	49723	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:14.505409956 CEST	49724	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:14.505420923 CEST	443	49724	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:14.507914066 CEST	49726	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:14.507915020 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:14.507978916 CEST	443	49726	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:14.508008003 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:14.508042097 CEST	49726	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:14.508106947 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:14.508404016 CEST	49726	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:14.508404970 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:14.508439064 CEST	443	49726	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:14.508476019 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:14.509064913 CEST	49727	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:14.509079933 CEST	443	49727	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:14.510135889 CEST	49727	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:14.511418104 CEST	49727	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:14.511426926 CEST	443	49727	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.149874926 CEST	443	49724	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.150362968 CEST	49724	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:15.150376081 CEST	443	49724	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.150767088 CEST	49724	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:15.150773048 CEST	443	49724	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.162375927 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.162777901 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:15.162838936 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.163125992 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:15.163139105 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.170412064 CEST	443	49727	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.170686007 CEST	49727	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:15.170692921 CEST	443	49727	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.171019077 CEST	49727	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:15.171021938 CEST	443	49727	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.172919035 CEST	443	49726	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.173330069 CEST	49726	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:15.173343897 CEST	443	49726	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.173918009 CEST	49726	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:15.173928022 CEST	443	49726	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.176052094 CEST	443	49723	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.176338911 CEST	49723	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:15.176347971 CEST	443	49723	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.176724911 CEST	49723	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:15.176729918 CEST	443	49723	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.250746965 CEST	443	49724	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.250885963 CEST	443	49724	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.250962019 CEST	49724	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:15.251060009 CEST	49724	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:15.251075983 CEST	443	49724	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.251113892 CEST	49724	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:15.251121044 CEST	443	49724	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.253351927 CEST	49728	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:15.253372908 CEST	443	49728	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.253458977 CEST	49728	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:15.253704071 CEST	49728	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:15.253714085 CEST	443	49728	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.264584064 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.264638901 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.264709949 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:15.264739037 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.264771938 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.264800072 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:15.264827013 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:15.264868021 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.264897108 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:15.264897108 CEST	49725	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:15.264918089 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.264935970 CEST	443	49725	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.266498089 CEST	49729	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:15.266526937 CEST	443	49729	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.266586065 CEST	49729	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:15.266697884 CEST	49729	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:15.266711950 CEST	443	49729	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.274370909 CEST	443	49727	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.274388075 CEST	443	49727	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.274441004 CEST	49727	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:15.274452925 CEST	443	49727	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.274498940 CEST	443	49727	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.274539948 CEST	49727	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:15.274563074 CEST	49727	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:15.274569035 CEST	443	49727	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.274579048 CEST	49727	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:15.274581909 CEST	443	49727	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.276191950 CEST	49730	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:15.276201010 CEST	443	49730	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.276268959 CEST	49730	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:15.276365042 CEST	49730	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:15.276376963 CEST	443	49730	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.277393103 CEST	443	49726	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.277456045 CEST	443	49726	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.277498960 CEST	49726	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:15.277554989 CEST	49726	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:15.277554989 CEST	49726	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:15.277570963 CEST	443	49726	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.277594090 CEST	443	49726	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.278999090 CEST	49731	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:15.279007912 CEST	443	49731	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.279069901 CEST	49731	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:15.279164076 CEST	49731	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:15.279171944 CEST	443	49731	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.280875921 CEST	443	49723	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.280935049 CEST	443	49723	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.280991077 CEST	49723	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:15.280997038 CEST	443	49723	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.281039000 CEST	49723	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:15.281099081 CEST	49723	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:15.281101942 CEST	443	49723	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.281114101 CEST	49723	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:15.281413078 CEST	443	49723	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.281482935 CEST	443	49723	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.281527996 CEST	49723	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:15.282728910 CEST	49732	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:15.282749891 CEST	443	49732	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.282814026 CEST	49732	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:15.282907963 CEST	49732	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:15.282917976 CEST	443	49732	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.900316954 CEST	443	49728	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.901015043 CEST	49728	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:15.901032925 CEST	443	49728	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.901588917 CEST	49728	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:15.901593924 CEST	443	49728	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.917403936 CEST	443	49730	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.917797089 CEST	49730	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:15.917810917 CEST	443	49730	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.918324947 CEST	49730	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:15.918329954 CEST	443	49730	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.922044992 CEST	443	49731	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.922360897 CEST	49731	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:15.922369003 CEST	443	49731	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.922732115 CEST	49731	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:15.922735929 CEST	443	49731	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.936764956 CEST	443	49732	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.937359095 CEST	49732	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:15.937387943 CEST	443	49732	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.937987089 CEST	49732	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:15.937992096 CEST	443	49732	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.947161913 CEST	443	49729	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.947588921 CEST	49729	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:15.947597980 CEST	443	49729	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.948277950 CEST	49729	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:15.948282957 CEST	443	49729	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.999433041 CEST	443	49728	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.999579906 CEST	443	49728	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.999650002 CEST	49728	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:15.999775887 CEST	49728	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:15.999792099 CEST	443	49728	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:15.999802113 CEST	49728	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:15.999805927 CEST	443	49728	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.002635002 CEST	49733	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.002676010 CEST	443	49733	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.002746105 CEST	49733	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.002840996 CEST	49733	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.002850056 CEST	443	49733	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.016859055 CEST	443	49730	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.016901016 CEST	443	49730	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.016942024 CEST	49730	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.017111063 CEST	49730	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.017122984 CEST	443	49730	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.017132998 CEST	49730	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.017138004 CEST	443	49730	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.019521952 CEST	49734	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.019539118 CEST	443	49734	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.019608974 CEST	49734	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.019726992 CEST	49734	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.019740105 CEST	443	49734	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.036192894 CEST	443	49732	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.036331892 CEST	443	49732	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.036395073 CEST	49732	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.036415100 CEST	49732	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.036426067 CEST	443	49732	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.036432981 CEST	49732	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.036437035 CEST	443	49732	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.038456917 CEST	49735	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.038474083 CEST	443	49735	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.038541079 CEST	49735	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.038649082 CEST	49735	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.038659096 CEST	443	49735	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.049881935 CEST	443	49729	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.049937963 CEST	443	49729	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.049984932 CEST	49729	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.050061941 CEST	49729	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.050065041 CEST	443	49729	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.050074100 CEST	49729	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.050076962 CEST	443	49729	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.052038908 CEST	49736	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.052063942 CEST	443	49736	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.052131891 CEST	49736	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.052239895 CEST	49736	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.052253962 CEST	443	49736	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.061042070 CEST	443	49731	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.061193943 CEST	443	49731	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.061252117 CEST	49731	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.061278105 CEST	49731	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.061281919 CEST	443	49731	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.061290979 CEST	49731	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.061294079 CEST	443	49731	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.063324928 CEST	49737	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.063347101 CEST	443	49737	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.063452959 CEST	49737	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.063580990 CEST	49737	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.063605070 CEST	443	49737	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.646536112 CEST	443	49733	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.647145987 CEST	49733	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.647209883 CEST	443	49733	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.647742987 CEST	49733	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.647758007 CEST	443	49733	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.666269064 CEST	443	49734	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.666675091 CEST	49734	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.666688919 CEST	443	49734	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.667210102 CEST	49734	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.667220116 CEST	443	49734	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.676971912 CEST	443	49735	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.677254915 CEST	49735	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.677268982 CEST	443	49735	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.677728891 CEST	49735	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.677732944 CEST	443	49735	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.700587034 CEST	443	49737	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.700829983 CEST	49737	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.700848103 CEST	443	49737	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.701282024 CEST	49737	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.701292038 CEST	443	49737	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.701761961 CEST	443	49736	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.701988935 CEST	49736	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.702007055 CEST	443	49736	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.702420950 CEST	49736	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.702428102 CEST	443	49736	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.745332003 CEST	443	49733	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.745475054 CEST	443	49733	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.745553017 CEST	49733	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.745654106 CEST	49733	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.745687962 CEST	443	49733	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.745717049 CEST	49733	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.745732069 CEST	443	49733	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.748727083 CEST	49738	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.748822927 CEST	443	49738	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.748991013 CEST	49738	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.749128103 CEST	49738	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.749160051 CEST	443	49738	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.767254114 CEST	443	49734	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.767299891 CEST	443	49734	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.767458916 CEST	49734	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.767597914 CEST	49734	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.767616034 CEST	443	49734	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.767640114 CEST	49734	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.767649889 CEST	443	49734	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.769953012 CEST	49739	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.769973993 CEST	443	49739	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.770052910 CEST	49739	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.770174980 CEST	49739	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.770189047 CEST	443	49739	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.774188042 CEST	443	49735	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.774336100 CEST	443	49735	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.774462938 CEST	49735	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.774745941 CEST	49735	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.774760962 CEST	443	49735	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.774771929 CEST	49735	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.774776936 CEST	443	49735	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.777771950 CEST	49740	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.777816057 CEST	443	49740	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.778130054 CEST	49740	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.778130054 CEST	49740	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.778167963 CEST	443	49740	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.799473047 CEST	443	49737	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.799530983 CEST	443	49737	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.799597025 CEST	49737	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.799774885 CEST	49737	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.799793005 CEST	443	49737	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.799814939 CEST	49737	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.799829006 CEST	443	49737	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.807483912 CEST	443	49736	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.807621956 CEST	443	49736	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.807687044 CEST	49736	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.809031963 CEST	49736	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.809047937 CEST	443	49736	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.809058905 CEST	49736	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.809063911 CEST	443	49736	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.810539007 CEST	49741	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.810547113 CEST	443	49741	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.810606003 CEST	49741	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.810750008 CEST	49741	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.810759068 CEST	443	49741	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.811033010 CEST	49742	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.811038971 CEST	443	49742	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:16.811100006 CEST	49742	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.811191082 CEST	49742	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:16.811198950 CEST	443	49742	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:17.399614096 CEST	443	49738	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:17.400553942 CEST	49738	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:17.400640965 CEST	443	49738	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:17.400924921 CEST	49738	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:17.400942087 CEST	443	49738	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:17.402180910 CEST	443	49739	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:17.402709007 CEST	49739	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:17.402709007 CEST	49739	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:17.402736902 CEST	443	49739	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:17.402751923 CEST	443	49739	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:17.450965881 CEST	443	49741	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:17.451342106 CEST	49741	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:17.451353073 CEST	443	49741	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:17.451766968 CEST	49741	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:17.451771021 CEST	443	49741	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:17.453408957 CEST	443	49742	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:17.453655958 CEST	49742	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:17.453666925 CEST	443	49742	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:17.453989029 CEST	49742	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:17.453991890 CEST	443	49742	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:17.461299896 CEST	443	49740	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:17.461529970 CEST	49740	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:17.461565018 CEST	443	49740	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:17.461802959 CEST	49740	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:17.461817980 CEST	443	49740	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:17.499643087 CEST	443	49738	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:17.499774933 CEST	443	49738	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:17.499936104 CEST	49738	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:17.499979019 CEST	49738	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:17.499979019 CEST	49738	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:17.499999046 CEST	443	49738	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:17.500014067 CEST	443	49738	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:17.501327991 CEST	443	49739	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:17.501378059 CEST	443	49739	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:17.501486063 CEST	49739	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:17.502012014 CEST	49739	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:17.502042055 CEST	443	49739	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:17.502157927 CEST	49739	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:17.502167940 CEST	443	49739	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:17.503516912 CEST	49743	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:17.503618956 CEST	443	49743	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:17.503724098 CEST	49743	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:17.509181023 CEST	49744	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:17.509254932 CEST	443	49744	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:17.509324074 CEST	49744	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:17.509525061 CEST	49743	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:17.509566069 CEST	443	49743	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:17.509691000 CEST	49744	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:17.509725094 CEST	443	49744	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:17.555294037 CEST	443	49741	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:17.555464029 CEST	443	49741	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:17.555536032 CEST	49741	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:17.555748940 CEST	49741	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:17.555756092 CEST	443	49741	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:17.555766106 CEST	49741	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:17.555769920 CEST	443	49741	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:17.559360027 CEST	49745	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:17.559386969 CEST	443	49745	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:17.559458017 CEST	49745	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:17.559593916 CEST	49745	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:17.559604883 CEST	443	49745	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:17.560827017 CEST	443	49742	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:17.560966015 CEST	443	49742	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:17.561023951 CEST	49742	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:17.561113119 CEST	49742	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:17.561116934 CEST	443	49742	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:17.561132908 CEST	49742	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:17.561136007 CEST	443	49742	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:17.563649893 CEST	49746	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:17.563657999 CEST	443	49746	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:17.563724995 CEST	49746	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:17.564088106 CEST	49746	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:17.564096928 CEST	443	49746	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:17.571820021 CEST	443	49740	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:17.571878910 CEST	443	49740	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:17.572154045 CEST	49740	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:17.572154045 CEST	49740	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:17.572191000 CEST	49740	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:17.572205067 CEST	443	49740	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:17.578706980 CEST	49747	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:17.578743935 CEST	443	49747	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:17.578880072 CEST	49747	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:17.579009056 CEST	49747	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:17.579036951 CEST	443	49747	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:18.175312996 CEST	443	49744	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:18.178364992 CEST	49744	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:18.178431034 CEST	443	49744	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:18.179019928 CEST	49744	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:18.179035902 CEST	443	49744	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:18.190448999 CEST	443	49743	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:18.191076994 CEST	49743	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:18.191147089 CEST	443	49743	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:18.191519976 CEST	49743	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:18.191536903 CEST	443	49743	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:18.200195074 CEST	443	49745	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:18.200658083 CEST	49745	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:18.200670004 CEST	443	49745	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:18.201064110 CEST	49745	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:18.201067924 CEST	443	49745	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:18.203072071 CEST	443	49746	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:18.203437090 CEST	49746	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:18.203447104 CEST	443	49746	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:18.203804016 CEST	49746	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:18.203807116 CEST	443	49746	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:18.217644930 CEST	443	49747	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:18.218125105 CEST	49747	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:18.218153000 CEST	443	49747	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:18.218758106 CEST	49747	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:18.218764067 CEST	443	49747	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:18.292978048 CEST	443	49744	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:18.293020010 CEST	443	49744	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:18.293214083 CEST	49744	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:18.293529987 CEST	49744	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:18.293555021 CEST	443	49744	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:18.293565989 CEST	49744	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:18.293571949 CEST	443	49744	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:18.296906948 CEST	49748	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:18.296957970 CEST	443	49748	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:18.297048092 CEST	49748	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:18.297185898 CEST	49748	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:18.297202110 CEST	443	49748	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:18.298343897 CEST	443	49745	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:18.298484087 CEST	443	49745	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:18.298537016 CEST	49745	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:18.298564911 CEST	49745	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:18.298564911 CEST	49745	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:18.298582077 CEST	443	49745	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:18.298589945 CEST	443	49745	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:18.298801899 CEST	443	49743	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:18.298928976 CEST	443	49743	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:18.299011946 CEST	49743	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:18.299011946 CEST	49743	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:18.299011946 CEST	49743	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:18.301040888 CEST	443	49746	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:18.301182985 CEST	443	49746	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:18.301249027 CEST	49746	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:18.301274061 CEST	49746	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:18.301278114 CEST	443	49746	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:18.301332951 CEST	49746	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:18.301337957 CEST	443	49746	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:18.301368952 CEST	49750	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:18.301399946 CEST	443	49750	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:18.301460981 CEST	49750	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:18.301640034 CEST	49750	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:18.301651001 CEST	443	49750	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:18.301677942 CEST	49749	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:18.301683903 CEST	443	49749	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:18.301748037 CEST	49749	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:18.301934004 CEST	49749	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:18.301945925 CEST	443	49749	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:18.303451061 CEST	49751	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:18.303493977 CEST	443	49751	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:18.303600073 CEST	49751	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:18.303714991 CEST	49751	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:18.303730965 CEST	443	49751	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:18.318345070 CEST	443	49747	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:18.318490028 CEST	443	49747	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:18.318566084 CEST	49747	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:18.318665981 CEST	49747	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:18.318681002 CEST	443	49747	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:18.318691015 CEST	49747	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:18.318695068 CEST	443	49747	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:18.321528912 CEST	49752	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:18.321547985 CEST	443	49752	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:18.321639061 CEST	49752	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:18.321770906 CEST	49752	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:18.321780920 CEST	443	49752	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:18.610519886 CEST	49743	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:18.610590935 CEST	443	49743	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:18.942138910 CEST	443	49748	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:18.942596912 CEST	443	49749	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:18.955961943 CEST	443	49751	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:18.958836079 CEST	49748	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:18.958868980 CEST	443	49748	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:18.959745884 CEST	49748	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:18.959752083 CEST	443	49748	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:18.960432053 CEST	443	49752	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:18.961920977 CEST	49749	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:18.961942911 CEST	443	49749	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:18.963210106 CEST	49749	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:18.963213921 CEST	443	49749	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:18.963491917 CEST	49752	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:18.963505983 CEST	443	49752	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:18.964624882 CEST	49752	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:18.964629889 CEST	443	49752	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:18.966350079 CEST	49751	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:18.966357946 CEST	443	49751	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:18.968647003 CEST	443	49750	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:18.977431059 CEST	49751	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:18.977440119 CEST	443	49751	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:18.977891922 CEST	49750	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:18.977905035 CEST	443	49750	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:18.978456020 CEST	49750	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:18.978460073 CEST	443	49750	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.056765079 CEST	443	49748	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.056802034 CEST	443	49748	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.056921005 CEST	49748	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.057759047 CEST	49748	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.057799101 CEST	443	49748	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.057820082 CEST	49748	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.057831049 CEST	443	49748	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.059112072 CEST	443	49749	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.059242010 CEST	443	49749	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.059305906 CEST	49749	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.060853958 CEST	443	49752	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.060992956 CEST	443	49752	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.061059952 CEST	49752	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.074292898 CEST	443	49751	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.074429989 CEST	443	49751	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.074526072 CEST	49751	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.079083920 CEST	443	49750	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.079225063 CEST	443	49750	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.079308987 CEST	49750	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.081995010 CEST	49752	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.082006931 CEST	443	49752	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.082016945 CEST	49752	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.082021952 CEST	443	49752	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.082953930 CEST	49751	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.082997084 CEST	443	49751	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.083036900 CEST	49751	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.083048105 CEST	443	49751	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.083602905 CEST	49750	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.083614111 CEST	443	49750	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.083622932 CEST	49750	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.083626986 CEST	443	49750	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.084223986 CEST	49749	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.084228039 CEST	443	49749	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.084256887 CEST	49749	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.084259987 CEST	443	49749	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.086545944 CEST	49753	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.086606979 CEST	443	49753	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.087518930 CEST	49754	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.087538958 CEST	443	49754	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.087565899 CEST	49753	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.087630033 CEST	49754	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.088267088 CEST	49755	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.088282108 CEST	443	49755	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.088339090 CEST	49755	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.088490963 CEST	49753	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.088521004 CEST	443	49753	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.088567972 CEST	49754	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.088594913 CEST	443	49754	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.088728905 CEST	49755	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.088740110 CEST	443	49755	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.089632034 CEST	49756	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.089674950 CEST	443	49756	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.090161085 CEST	49757	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.090198040 CEST	443	49757	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.090202093 CEST	49756	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.090255976 CEST	49757	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.090306997 CEST	49756	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.090342045 CEST	443	49756	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.090368986 CEST	49757	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.090389013 CEST	443	49757	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.746330976 CEST	443	49753	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.747040987 CEST	443	49757	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.747088909 CEST	49753	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.747114897 CEST	443	49753	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.747325897 CEST	49757	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.747339010 CEST	443	49757	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.747648954 CEST	49753	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.747653961 CEST	443	49753	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.747767925 CEST	49757	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.747773886 CEST	443	49757	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.751470089 CEST	443	49755	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.751801968 CEST	49755	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.751816034 CEST	443	49755	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.752144098 CEST	49755	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.752149105 CEST	443	49755	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.762981892 CEST	443	49754	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.763272047 CEST	49754	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.763281107 CEST	443	49754	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.763626099 CEST	49754	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.763629913 CEST	443	49754	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.777000904 CEST	443	49756	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.777358055 CEST	49756	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.777420044 CEST	443	49756	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.777707100 CEST	49756	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.777723074 CEST	443	49756	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.844772100 CEST	443	49753	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.844815016 CEST	443	49753	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.844943047 CEST	49753	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.845185041 CEST	49753	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.845185041 CEST	49753	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.845201015 CEST	443	49753	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.845210075 CEST	443	49753	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.849317074 CEST	443	49757	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.849359035 CEST	443	49757	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.849447966 CEST	49757	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.849601030 CEST	49757	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.849615097 CEST	443	49757	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.849625111 CEST	49757	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.849630117 CEST	443	49757	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.849729061 CEST	49758	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.849749088 CEST	443	49758	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.849819899 CEST	49758	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.849934101 CEST	49758	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.849939108 CEST	443	49758	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.851634979 CEST	49759	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.851684093 CEST	443	49759	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.851763964 CEST	49759	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.851875067 CEST	49759	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.851891994 CEST	443	49759	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.857193947 CEST	443	49755	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.857325077 CEST	443	49755	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.857392073 CEST	49755	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.857412100 CEST	49755	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.857419968 CEST	443	49755	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.857434034 CEST	49755	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.857438087 CEST	443	49755	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.859075069 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.859100103 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.859169006 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.859267950 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.859292984 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.871284962 CEST	443	49754	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.871449947 CEST	443	49754	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.871514082 CEST	49754	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.871541977 CEST	49754	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.871547937 CEST	443	49754	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.871557951 CEST	49754	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.871563911 CEST	443	49754	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.873313904 CEST	49761	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.873323917 CEST	443	49761	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.873389959 CEST	49761	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.873492956 CEST	49761	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.873506069 CEST	443	49761	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.880176067 CEST	443	49756	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.880218983 CEST	443	49756	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.880383968 CEST	49756	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.880465984 CEST	49756	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.880465984 CEST	49756	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.880510092 CEST	443	49756	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.880539894 CEST	443	49756	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.882100105 CEST	49762	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.882106066 CEST	443	49762	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:19.882172108 CEST	49762	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.882281065 CEST	49762	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:19.882292986 CEST	443	49762	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:20.496963024 CEST	443	49758	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:20.497725010 CEST	49758	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:20.497755051 CEST	443	49758	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:20.498217106 CEST	49758	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:20.498224020 CEST	443	49758	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:20.512114048 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:20.512660980 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:20.512692928 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:20.512914896 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:20.512923002 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:20.513286114 CEST	443	49759	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:20.513649940 CEST	49759	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:20.513664961 CEST	443	49759	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:20.514223099 CEST	49759	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:20.514241934 CEST	443	49759	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:20.516050100 CEST	443	49762	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:20.516371012 CEST	49762	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:20.516393900 CEST	443	49762	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:20.516920090 CEST	49762	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:20.516927958 CEST	443	49762	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:20.569377899 CEST	443	49761	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:20.569926977 CEST	49761	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:20.569952011 CEST	443	49761	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:20.570463896 CEST	49761	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:20.570477009 CEST	443	49761	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:20.598679066 CEST	443	49758	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:20.598720074 CEST	443	49758	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:20.598767042 CEST	49758	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:20.599023104 CEST	49758	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:20.599035025 CEST	443	49758	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:20.599047899 CEST	49758	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:20.599051952 CEST	443	49758	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:20.602531910 CEST	49763	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:20.602623940 CEST	443	49763	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:20.602732897 CEST	49763	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:20.602945089 CEST	49763	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:20.602977991 CEST	443	49763	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:20.612349033 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:20.612489939 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:20.612572908 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:20.612572908 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:20.612616062 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:20.612633944 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:20.616166115 CEST	443	49762	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:20.616206884 CEST	443	49762	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:20.616261959 CEST	49762	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:20.616342068 CEST	49762	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:20.616353989 CEST	443	49762	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:20.616381884 CEST	49762	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:20.616386890 CEST	443	49762	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:20.616656065 CEST	443	49759	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:20.616700888 CEST	443	49759	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:20.616758108 CEST	49759	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:20.616933107 CEST	49759	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:20.616945028 CEST	443	49759	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:20.616972923 CEST	49759	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:20.616986036 CEST	443	49759	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:20.626431942 CEST	49764	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:20.626455069 CEST	443	49764	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:20.626518965 CEST	49764	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:20.630017042 CEST	49765	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:20.630115986 CEST	443	49765	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:20.630218029 CEST	49765	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:20.634139061 CEST	49764	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:20.634149075 CEST	443	49764	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:20.635981083 CEST	49766	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:20.636008024 CEST	443	49766	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:20.636085033 CEST	49766	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:20.636265993 CEST	49766	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:20.636303902 CEST	443	49766	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:20.636526108 CEST	49765	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:20.636553049 CEST	443	49765	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:20.673779011 CEST	443	49761	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:20.673921108 CEST	443	49761	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:20.673990965 CEST	49761	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:20.674833059 CEST	49761	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:20.674851894 CEST	443	49761	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:20.674865007 CEST	49761	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:20.674870968 CEST	443	49761	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:20.678714037 CEST	49767	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:20.678726912 CEST	443	49767	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:20.678795099 CEST	49767	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:20.678991079 CEST	49767	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:20.679001093 CEST	443	49767	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:21.251596928 CEST	443	49763	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:21.252410889 CEST	49763	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:21.252444029 CEST	443	49763	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:21.252979994 CEST	49763	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:21.252994061 CEST	443	49763	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:21.274090052 CEST	443	49765	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:21.274513006 CEST	49765	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:21.274580002 CEST	443	49765	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:21.274755955 CEST	49765	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:21.274771929 CEST	443	49765	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:21.278501034 CEST	443	49764	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:21.278765917 CEST	49764	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:21.278788090 CEST	443	49764	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:21.279145956 CEST	49764	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:21.279150009 CEST	443	49764	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:21.294977903 CEST	443	49766	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:21.295433044 CEST	49766	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:21.295468092 CEST	443	49766	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:21.296109915 CEST	49766	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:21.296166897 CEST	443	49766	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:21.320949078 CEST	443	49767	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:21.321269035 CEST	49767	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:21.321290016 CEST	443	49767	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:21.321743011 CEST	49767	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:21.321748018 CEST	443	49767	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:21.352252007 CEST	443	49763	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:21.352391005 CEST	443	49763	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:21.352585077 CEST	49763	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:21.352585077 CEST	49763	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:21.352672100 CEST	49763	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:21.352715015 CEST	443	49763	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:21.355550051 CEST	49768	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:21.355591059 CEST	443	49768	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:21.355679989 CEST	49768	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:21.355827093 CEST	49768	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:21.355842113 CEST	443	49768	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:21.372312069 CEST	443	49765	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:21.372431040 CEST	443	49765	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:21.372597933 CEST	49765	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:21.372720957 CEST	49765	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:21.372746944 CEST	443	49765	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:21.372762918 CEST	49765	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:21.372771025 CEST	443	49765	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:21.375547886 CEST	49769	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:21.375581980 CEST	443	49769	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:21.375658035 CEST	49769	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:21.375799894 CEST	49769	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:21.375807047 CEST	443	49769	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:21.377737045 CEST	443	49764	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:21.377882957 CEST	443	49764	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:21.377935886 CEST	49764	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:21.377958059 CEST	49764	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:21.377974033 CEST	443	49764	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:21.377984047 CEST	49764	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:21.377989054 CEST	443	49764	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:21.380137920 CEST	49770	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:21.380146027 CEST	443	49770	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:21.380239964 CEST	49770	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:21.380362034 CEST	49770	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:21.380371094 CEST	443	49770	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:21.401185036 CEST	443	49766	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:21.401221037 CEST	443	49766	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:21.401385069 CEST	49766	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:21.401385069 CEST	49766	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:21.403342962 CEST	49771	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:21.403352976 CEST	49766	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:21.403354883 CEST	443	49771	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:21.403402090 CEST	443	49766	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:21.403420925 CEST	49771	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:21.403594971 CEST	49771	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:21.403608084 CEST	443	49771	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:21.421173096 CEST	443	49767	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:21.421209097 CEST	443	49767	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:21.421250105 CEST	49767	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:21.421360970 CEST	49767	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:21.421370983 CEST	443	49767	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:21.421380043 CEST	49767	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:21.421384096 CEST	443	49767	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:21.423341990 CEST	49772	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:21.423414946 CEST	443	49772	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:21.423496962 CEST	49772	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:21.423607111 CEST	49772	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:21.423638105 CEST	443	49772	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:21.999289989 CEST	443	49768	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.014704943 CEST	49768	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.014714003 CEST	443	49768	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.015095949 CEST	49768	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.015100956 CEST	443	49768	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.031013012 CEST	443	49770	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.031843901 CEST	49770	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.031864882 CEST	443	49770	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.044673920 CEST	443	49769	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.067095041 CEST	443	49771	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.068160057 CEST	49770	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.068177938 CEST	443	49770	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.073513985 CEST	443	49772	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.076461077 CEST	49772	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.076500893 CEST	443	49772	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.076824903 CEST	49772	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.076838970 CEST	443	49772	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.077053070 CEST	49769	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.077065945 CEST	443	49769	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.077358961 CEST	49769	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.077363968 CEST	443	49769	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.077543974 CEST	49771	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.077552080 CEST	443	49771	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.077840090 CEST	49771	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.077845097 CEST	443	49771	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.110774994 CEST	443	49768	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.110903978 CEST	443	49768	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.110964060 CEST	49768	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.122349977 CEST	49768	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.122364044 CEST	443	49768	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.122374058 CEST	49768	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.122379065 CEST	443	49768	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.139123917 CEST	49773	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.139154911 CEST	443	49773	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.139220953 CEST	49773	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.139600039 CEST	49773	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.139616013 CEST	443	49773	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.163556099 CEST	443	49770	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.163702965 CEST	443	49770	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.163763046 CEST	49770	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.163794041 CEST	49770	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.163794041 CEST	49770	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.163813114 CEST	443	49770	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.163824081 CEST	443	49770	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.175132990 CEST	443	49772	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.175277948 CEST	443	49772	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.175343990 CEST	49772	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.176004887 CEST	49772	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.176028013 CEST	443	49772	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.176887035 CEST	443	49769	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.177023888 CEST	443	49769	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.177076101 CEST	49769	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.177925110 CEST	443	49771	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.177969933 CEST	443	49771	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.178025007 CEST	49771	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.179193974 CEST	49774	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.179208040 CEST	443	49774	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.179260015 CEST	49774	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.179490089 CEST	49774	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.179502010 CEST	443	49774	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.179902077 CEST	49769	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.179908991 CEST	443	49769	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.179922104 CEST	49769	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.179928064 CEST	443	49769	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.182363987 CEST	49771	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.182370901 CEST	443	49771	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.182380915 CEST	49771	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.182384014 CEST	443	49771	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.187997103 CEST	49775	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.188044071 CEST	443	49775	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.188117981 CEST	49775	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.188317060 CEST	49775	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.188348055 CEST	443	49775	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.195566893 CEST	49776	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.195616007 CEST	443	49776	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.195677042 CEST	49776	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.199340105 CEST	49776	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.199362040 CEST	443	49776	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.205662012 CEST	49777	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.205686092 CEST	443	49777	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.205734015 CEST	49777	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.205977917 CEST	49777	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.205985069 CEST	443	49777	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.807557106 CEST	443	49773	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.808171988 CEST	49773	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.808191061 CEST	443	49773	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.808712959 CEST	49773	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.808720112 CEST	443	49773	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.846739054 CEST	443	49776	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.847155094 CEST	49776	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.847186089 CEST	443	49776	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.847765923 CEST	49776	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.847774982 CEST	443	49776	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.862561941 CEST	443	49774	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.862885952 CEST	49774	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.862914085 CEST	443	49774	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.863078117 CEST	443	49775	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.863320112 CEST	49775	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.863347054 CEST	443	49775	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.863432884 CEST	49774	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.863440037 CEST	443	49774	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.863725901 CEST	49775	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.863737106 CEST	443	49775	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.874043941 CEST	443	49777	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.874341011 CEST	49777	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.874352932 CEST	443	49777	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.874835968 CEST	49777	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.874840021 CEST	443	49777	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.909581900 CEST	443	49773	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.909708023 CEST	443	49773	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.909862041 CEST	49773	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.909862041 CEST	49773	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.909862041 CEST	49773	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.912360907 CEST	49778	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.912388086 CEST	443	49778	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.912599087 CEST	49778	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.912743092 CEST	49778	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.912750006 CEST	443	49778	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.950501919 CEST	443	49776	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.950680971 CEST	443	49776	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.950781107 CEST	49776	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.950781107 CEST	49776	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.950781107 CEST	49776	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.953676939 CEST	49779	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.953747034 CEST	443	49779	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.953819990 CEST	49779	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.954246998 CEST	49779	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.954282045 CEST	443	49779	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.967204094 CEST	443	49775	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.967339039 CEST	443	49775	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.967422962 CEST	49775	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.967463017 CEST	49775	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.967463017 CEST	49775	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.967475891 CEST	443	49774	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.967504978 CEST	443	49775	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.967518091 CEST	443	49775	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.967684031 CEST	443	49774	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.967735052 CEST	49774	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.967835903 CEST	49774	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.967859030 CEST	443	49774	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.967875957 CEST	49774	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.967883110 CEST	443	49774	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.970272064 CEST	49780	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.970309973 CEST	443	49780	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.970365047 CEST	49780	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.970638037 CEST	49780	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.970658064 CEST	443	49780	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.970777035 CEST	49781	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.970844030 CEST	443	49781	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.970905066 CEST	49781	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.971004009 CEST	49781	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.971023083 CEST	443	49781	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.977287054 CEST	443	49777	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.977333069 CEST	443	49777	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.977370977 CEST	49777	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.977495909 CEST	49777	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.977504969 CEST	443	49777	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.977523088 CEST	49777	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.977526903 CEST	443	49777	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.979792118 CEST	49782	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.979818106 CEST	443	49782	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:22.979880095 CEST	49782	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.979995966 CEST	49782	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:22.980021000 CEST	443	49782	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:23.141597033 CEST	49773	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:23.141614914 CEST	443	49773	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:23.251142979 CEST	49776	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:23.251209974 CEST	443	49776	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:23.572110891 CEST	443	49778	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:23.572776079 CEST	49778	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:23.572793007 CEST	443	49778	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:23.573373079 CEST	49778	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:23.573378086 CEST	443	49778	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:23.597491980 CEST	443	49779	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:23.597984076 CEST	49779	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:23.598051071 CEST	443	49779	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:23.598402023 CEST	49779	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:23.598417997 CEST	443	49779	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:23.610836029 CEST	443	49780	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:23.611180067 CEST	49780	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:23.611206055 CEST	443	49780	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:23.611717939 CEST	49780	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:23.611732006 CEST	443	49780	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:23.613768101 CEST	443	49782	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:23.614151955 CEST	49782	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:23.614208937 CEST	443	49782	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:23.614499092 CEST	49782	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:23.614511967 CEST	443	49782	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:23.640475035 CEST	443	49781	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:23.640821934 CEST	49781	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:23.640855074 CEST	443	49781	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:23.641364098 CEST	49781	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:23.641374111 CEST	443	49781	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:23.671284914 CEST	443	49778	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:23.671482086 CEST	443	49778	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:23.671546936 CEST	49778	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:23.671582937 CEST	49778	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:23.671605110 CEST	443	49778	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:23.671621084 CEST	49778	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:23.671628952 CEST	443	49778	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:23.674297094 CEST	49783	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:23.674339056 CEST	443	49783	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:23.674431086 CEST	49783	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:23.674603939 CEST	49783	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:23.674631119 CEST	443	49783	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:23.695980072 CEST	443	49779	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:23.696136951 CEST	443	49779	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:23.696325064 CEST	49779	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:23.696325064 CEST	49779	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:23.696325064 CEST	49779	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:23.701080084 CEST	49784	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:23.701126099 CEST	443	49784	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:23.701176882 CEST	49784	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:23.701354980 CEST	49784	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:23.701371908 CEST	443	49784	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:23.709860086 CEST	443	49780	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:23.710006952 CEST	443	49780	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:23.710083008 CEST	49780	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:23.710083008 CEST	49780	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:23.710176945 CEST	49780	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:23.710189104 CEST	443	49780	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:23.711967945 CEST	49785	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:23.712023020 CEST	443	49785	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:23.712085009 CEST	49785	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:23.712182045 CEST	49785	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:23.712198973 CEST	443	49785	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:23.713737011 CEST	443	49782	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:23.713795900 CEST	443	49782	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:23.713871002 CEST	49782	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:23.713946104 CEST	49782	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:23.713946104 CEST	49782	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:23.713979006 CEST	443	49782	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:23.714004040 CEST	443	49782	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:23.715662956 CEST	49786	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:23.715688944 CEST	443	49786	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:23.715756893 CEST	49786	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:23.715848923 CEST	49786	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:23.715873003 CEST	443	49786	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:23.788779974 CEST	443	49781	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:23.789020061 CEST	443	49781	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:23.789220095 CEST	49781	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:23.789220095 CEST	49781	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:23.789221048 CEST	49781	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:23.791690111 CEST	49787	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:23.791726112 CEST	443	49787	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:23.791795015 CEST	49787	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:23.791909933 CEST	49787	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:23.791914940 CEST	443	49787	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:23.907241106 CEST	49779	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:23.907318115 CEST	443	49779	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:24.094814062 CEST	49781	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:24.094877958 CEST	443	49781	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:24.332272053 CEST	443	49783	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:24.346643925 CEST	49783	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:24.346643925 CEST	49783	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:24.346663952 CEST	443	49783	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:24.346688986 CEST	443	49783	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:24.348136902 CEST	443	49786	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:24.348434925 CEST	49786	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:24.348464966 CEST	443	49786	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:24.348774910 CEST	49786	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:24.348788023 CEST	443	49786	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:24.352345943 CEST	443	49784	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:24.352619886 CEST	49784	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:24.352641106 CEST	443	49784	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:24.352943897 CEST	49784	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:24.352951050 CEST	443	49784	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:24.364262104 CEST	443	49785	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:24.364584923 CEST	49785	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:24.364619017 CEST	443	49785	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:24.364929914 CEST	49785	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:24.364940882 CEST	443	49785	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:24.428257942 CEST	443	49787	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:24.428695917 CEST	49787	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:24.428710938 CEST	443	49787	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:24.429060936 CEST	49787	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:24.429065943 CEST	443	49787	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:24.442205906 CEST	443	49783	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:24.442362070 CEST	443	49783	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:24.442461014 CEST	49783	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:24.442461014 CEST	49783	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:24.442523003 CEST	49783	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:24.442533970 CEST	443	49783	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:24.444693089 CEST	49788	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:24.444722891 CEST	443	49788	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:24.444796085 CEST	49788	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:24.444904089 CEST	49788	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:24.444909096 CEST	443	49788	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:24.446742058 CEST	443	49786	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:24.446815968 CEST	443	49786	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:24.446875095 CEST	49786	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:24.446934938 CEST	49786	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:24.446964979 CEST	443	49786	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:24.446990967 CEST	49786	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:24.447005033 CEST	443	49786	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:24.448551893 CEST	49789	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:24.448587894 CEST	443	49789	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:24.448652029 CEST	49789	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:24.448743105 CEST	49789	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:24.448755026 CEST	443	49789	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:24.455745935 CEST	443	49784	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:24.455882072 CEST	443	49784	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:24.455936909 CEST	49784	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:24.455965042 CEST	49784	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:24.455982924 CEST	443	49784	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:24.455996037 CEST	49784	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:24.456002951 CEST	443	49784	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:24.457636118 CEST	49790	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:24.457645893 CEST	443	49790	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:24.457712889 CEST	49790	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:24.457784891 CEST	49790	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:24.457792997 CEST	443	49790	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:24.465981960 CEST	443	49785	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:24.466113091 CEST	443	49785	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:24.466183901 CEST	49785	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:24.466217995 CEST	49785	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:24.466218948 CEST	49785	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:24.466236115 CEST	443	49785	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:24.466262102 CEST	443	49785	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:24.467842102 CEST	49791	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:24.467873096 CEST	443	49791	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:24.467947006 CEST	49791	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:24.468050003 CEST	49791	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:24.468060970 CEST	443	49791	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:24.528237104 CEST	443	49787	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:24.528398037 CEST	443	49787	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:24.528476954 CEST	49787	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:24.528503895 CEST	49787	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:24.528520107 CEST	443	49787	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:24.528531075 CEST	49787	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:24.528537989 CEST	443	49787	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:24.530392885 CEST	49792	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:24.530442953 CEST	443	49792	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:24.530548096 CEST	49792	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:24.530638933 CEST	49792	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:24.530653954 CEST	443	49792	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.105317116 CEST	443	49791	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.106066942 CEST	49791	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.106084108 CEST	443	49791	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.106750965 CEST	49791	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.106755972 CEST	443	49791	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.121696949 CEST	443	49790	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.122033119 CEST	443	49789	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.122047901 CEST	49790	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.122064114 CEST	443	49790	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.122317076 CEST	49789	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.122323990 CEST	443	49789	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.122600079 CEST	49790	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.122603893 CEST	443	49790	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.122795105 CEST	49789	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.122798920 CEST	443	49789	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.169395924 CEST	443	49792	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.170547009 CEST	49792	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.170607090 CEST	443	49792	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.171103954 CEST	49792	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.171118021 CEST	443	49792	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.205650091 CEST	443	49791	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.205801964 CEST	443	49791	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.205951929 CEST	49791	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.205981016 CEST	49791	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.205997944 CEST	443	49791	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.206008911 CEST	49791	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.206013918 CEST	443	49791	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.209381104 CEST	49793	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.209418058 CEST	443	49793	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.209505081 CEST	49793	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.209728003 CEST	49793	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.209739923 CEST	443	49793	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.224930048 CEST	443	49790	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.225002050 CEST	443	49790	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.225348949 CEST	49790	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.225509882 CEST	49790	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.225528002 CEST	443	49790	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.225542068 CEST	49790	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.225547075 CEST	443	49790	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.226579905 CEST	443	49789	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.226639986 CEST	443	49789	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.226694107 CEST	49789	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.226855040 CEST	49789	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.226857901 CEST	443	49789	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.226887941 CEST	49789	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.226891041 CEST	443	49789	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.227904081 CEST	49794	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.227916956 CEST	443	49794	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.229157925 CEST	49795	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.229190111 CEST	443	49795	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.229228020 CEST	49794	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.229249954 CEST	49795	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.229434013 CEST	49795	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.229445934 CEST	443	49795	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.229648113 CEST	49794	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.229659081 CEST	443	49794	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.268970966 CEST	443	49792	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.269035101 CEST	443	49792	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.269181967 CEST	49792	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.269207954 CEST	49792	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.269218922 CEST	443	49792	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.269233942 CEST	49792	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.269241095 CEST	443	49792	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.271287918 CEST	49796	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.271322012 CEST	443	49796	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.271382093 CEST	49796	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.271514893 CEST	49796	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.271532059 CEST	443	49796	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.658329964 CEST	49704	80	192.168.2.5	46.8.231.109
Oct 8, 2024 05:04:25.806638002 CEST	443	49788	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.810540915 CEST	49788	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.810554981 CEST	443	49788	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.810940027 CEST	49788	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.810944080 CEST	443	49788	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.845546007 CEST	443	49793	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.859224081 CEST	49793	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.859245062 CEST	443	49793	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.859774113 CEST	49793	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.859781981 CEST	443	49793	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.860358953 CEST	443	49794	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.863733053 CEST	443	49795	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.864480972 CEST	49794	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.864480972 CEST	49794	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.864492893 CEST	443	49794	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.864507914 CEST	443	49794	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.865295887 CEST	49795	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.865319967 CEST	443	49795	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.865662098 CEST	49795	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.865669966 CEST	443	49795	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.906315088 CEST	443	49788	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.906399012 CEST	443	49788	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.906543016 CEST	49788	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.906893969 CEST	49788	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.906908989 CEST	443	49788	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.906934023 CEST	49788	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.906939983 CEST	443	49788	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.910485983 CEST	49797	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.910525084 CEST	443	49797	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.910612106 CEST	49797	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.910792112 CEST	49797	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.910803080 CEST	443	49797	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.919542074 CEST	443	49796	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.920317888 CEST	49796	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.920355082 CEST	443	49796	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.920783997 CEST	49796	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.920789957 CEST	443	49796	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.955632925 CEST	443	49793	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.955703020 CEST	443	49793	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.955919981 CEST	49793	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.956378937 CEST	49793	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.956402063 CEST	443	49793	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.956473112 CEST	49793	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.956480980 CEST	443	49793	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.959631920 CEST	49798	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.959656954 CEST	443	49798	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.959753036 CEST	49798	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.959789991 CEST	443	49794	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.959887981 CEST	49798	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.959898949 CEST	443	49798	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.959945917 CEST	443	49794	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.959994078 CEST	49794	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.960063934 CEST	49794	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.960074902 CEST	443	49794	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.960136890 CEST	49794	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.960141897 CEST	443	49794	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.962049007 CEST	49799	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.962085009 CEST	443	49799	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.962233067 CEST	49799	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.962326050 CEST	49799	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.962340117 CEST	443	49799	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.964610100 CEST	443	49795	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.964679003 CEST	443	49795	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.964736938 CEST	49795	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.964917898 CEST	49795	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.964917898 CEST	49795	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.964951038 CEST	443	49795	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.964977980 CEST	443	49795	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.967749119 CEST	49800	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.967782021 CEST	443	49800	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:25.967849016 CEST	49800	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.967955112 CEST	49800	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:25.967964888 CEST	443	49800	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:26.019541979 CEST	443	49796	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:26.019608021 CEST	443	49796	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:26.019706011 CEST	49796	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:26.023191929 CEST	49796	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:26.023209095 CEST	443	49796	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:26.029326916 CEST	49801	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:26.029361010 CEST	443	49801	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:26.029474020 CEST	49801	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:26.031510115 CEST	49801	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:26.031519890 CEST	443	49801	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:26.548389912 CEST	443	49797	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:26.549113989 CEST	49797	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:26.549143076 CEST	443	49797	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:26.549549103 CEST	49797	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:26.549556017 CEST	443	49797	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:26.597673893 CEST	443	49798	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:26.602345943 CEST	49798	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:26.602375031 CEST	443	49798	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:26.602752924 CEST	49798	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:26.602770090 CEST	443	49798	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:26.603698969 CEST	443	49800	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:26.604033947 CEST	49800	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:26.604053974 CEST	443	49800	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:26.604413033 CEST	49800	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:26.604418039 CEST	443	49800	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:26.627551079 CEST	443	49799	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:26.628707886 CEST	49799	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:26.628731012 CEST	443	49799	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:26.629492998 CEST	49799	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:26.629496098 CEST	443	49799	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:26.647595882 CEST	443	49797	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:26.648233891 CEST	443	49797	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:26.648312092 CEST	49797	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:26.648312092 CEST	49797	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:26.648351908 CEST	49797	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:26.648365021 CEST	443	49797	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:26.651786089 CEST	49802	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:26.651808023 CEST	443	49802	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:26.651869059 CEST	49802	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:26.655091047 CEST	49802	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:26.655102015 CEST	443	49802	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:26.668098927 CEST	443	49801	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:26.668459892 CEST	49801	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:26.668466091 CEST	443	49801	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:26.668859959 CEST	49801	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:26.668864012 CEST	443	49801	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:26.698816061 CEST	443	49798	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:26.698862076 CEST	443	49798	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:26.699062109 CEST	49798	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:26.699130058 CEST	443	49798	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:26.699248075 CEST	49798	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:26.699248075 CEST	49798	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:26.699292898 CEST	443	49798	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:26.699620962 CEST	443	49798	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:26.699712038 CEST	443	49798	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:26.699769020 CEST	49798	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:26.701852083 CEST	49803	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:26.701885939 CEST	443	49803	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:26.701939106 CEST	49803	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:26.702048063 CEST	49803	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:26.702058077 CEST	443	49803	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:26.702723026 CEST	443	49800	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:26.702760935 CEST	443	49800	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:26.702796936 CEST	49800	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:26.702876091 CEST	49800	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:26.702883005 CEST	443	49800	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:26.702896118 CEST	49800	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:26.702898979 CEST	443	49800	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:26.704649925 CEST	49804	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:26.704694033 CEST	443	49804	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:26.704761028 CEST	49804	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:26.704840899 CEST	49804	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:26.704860926 CEST	443	49804	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:26.729413033 CEST	443	49799	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:26.729559898 CEST	443	49799	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:26.729628086 CEST	49799	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:26.729649067 CEST	49799	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:26.729660034 CEST	443	49799	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:26.729670048 CEST	49799	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:26.729674101 CEST	443	49799	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:26.742755890 CEST	49805	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:26.742773056 CEST	443	49805	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:26.742913961 CEST	49805	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:26.742935896 CEST	49805	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:26.742939949 CEST	443	49805	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:26.767179012 CEST	443	49801	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:26.767229080 CEST	443	49801	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:26.767293930 CEST	49801	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:26.767307043 CEST	443	49801	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:26.767354965 CEST	443	49801	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:26.767489910 CEST	49801	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:26.767514944 CEST	49801	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:26.767524004 CEST	443	49801	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:26.767532110 CEST	49801	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:26.767535925 CEST	443	49801	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:26.770035028 CEST	49806	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:26.770054102 CEST	443	49806	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:26.770153999 CEST	49806	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:26.770265102 CEST	49806	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:26.770272970 CEST	443	49806	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:27.330769062 CEST	443	49802	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:27.331412077 CEST	49802	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:27.331424952 CEST	443	49802	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:27.331876993 CEST	49802	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:27.331881046 CEST	443	49802	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:27.342704058 CEST	443	49804	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:27.343054056 CEST	49804	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:27.343094110 CEST	443	49804	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:27.343518972 CEST	49804	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:27.343527079 CEST	443	49804	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:27.364370108 CEST	443	49803	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:27.364792109 CEST	49803	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:27.364809036 CEST	443	49803	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:27.365211010 CEST	49803	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:27.365216970 CEST	443	49803	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:27.416026115 CEST	443	49806	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:27.416713953 CEST	49806	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:27.416734934 CEST	443	49806	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:27.417198896 CEST	49806	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:27.417203903 CEST	443	49806	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:27.420399904 CEST	443	49805	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:27.420883894 CEST	49805	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:27.420891047 CEST	443	49805	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:27.421263933 CEST	49805	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:27.421267986 CEST	443	49805	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:27.442501068 CEST	443	49804	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:27.442583084 CEST	443	49802	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:27.442637920 CEST	443	49802	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:27.442704916 CEST	49802	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:27.442719936 CEST	443	49802	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:27.442765951 CEST	49802	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:27.442770004 CEST	443	49802	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:27.442820072 CEST	49802	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:27.442922115 CEST	49802	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:27.442929029 CEST	443	49802	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:27.442939043 CEST	49802	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:27.442943096 CEST	443	49802	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:27.443064928 CEST	443	49804	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:27.443121910 CEST	49804	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:27.444138050 CEST	49804	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:27.444158077 CEST	443	49804	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:27.444171906 CEST	49804	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:27.444179058 CEST	443	49804	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:27.446393967 CEST	49807	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:27.446422100 CEST	443	49807	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:27.446496964 CEST	49807	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:27.446924925 CEST	49807	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:27.446943045 CEST	443	49807	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:27.447494030 CEST	49808	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:27.447542906 CEST	443	49808	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:27.447617054 CEST	49808	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:27.447707891 CEST	49808	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:27.447721958 CEST	443	49808	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:27.477391958 CEST	443	49803	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:27.477418900 CEST	443	49803	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:27.477528095 CEST	49803	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:27.477544069 CEST	443	49803	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:27.477809906 CEST	49803	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:27.477823019 CEST	443	49803	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:27.477832079 CEST	49803	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:27.478471994 CEST	443	49803	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:27.478579044 CEST	443	49803	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:27.478631020 CEST	49803	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:27.480422020 CEST	49809	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:27.480442047 CEST	443	49809	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:27.480556011 CEST	49809	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:27.480675936 CEST	49809	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:27.480684042 CEST	443	49809	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:27.516295910 CEST	443	49806	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:27.516334057 CEST	443	49806	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:27.516391039 CEST	49806	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:27.516736984 CEST	49806	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:27.516748905 CEST	443	49806	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:27.516761065 CEST	49806	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:27.516765118 CEST	443	49806	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:27.522042036 CEST	443	49805	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:27.522193909 CEST	443	49805	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:27.522273064 CEST	49805	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:27.522309065 CEST	49810	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:27.522316933 CEST	443	49810	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:27.522380114 CEST	49810	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:27.522525072 CEST	49805	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:27.522528887 CEST	443	49805	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:27.522540092 CEST	49805	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:27.522542000 CEST	443	49805	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:27.523437977 CEST	49810	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:27.523446083 CEST	443	49810	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:27.525160074 CEST	49811	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:27.525260925 CEST	443	49811	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:27.525494099 CEST	49811	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:27.525684118 CEST	49811	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:27.525722980 CEST	443	49811	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.096700907 CEST	443	49807	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.097405910 CEST	49807	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.097433090 CEST	443	49807	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.098092079 CEST	49807	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.098098040 CEST	443	49807	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.110934973 CEST	443	49808	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.111371040 CEST	49808	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.111381054 CEST	443	49808	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.111934900 CEST	49808	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.111939907 CEST	443	49808	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.124309063 CEST	443	49809	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.124763012 CEST	49809	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.124779940 CEST	443	49809	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.125161886 CEST	49809	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.125165939 CEST	443	49809	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.190828085 CEST	443	49811	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.191910028 CEST	49811	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.191975117 CEST	443	49811	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.192526102 CEST	49811	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.192539930 CEST	443	49811	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.193190098 CEST	443	49810	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.193778992 CEST	49810	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.193805933 CEST	443	49810	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.194293022 CEST	49810	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.194297075 CEST	443	49810	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.197506905 CEST	443	49807	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.197652102 CEST	443	49807	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.197735071 CEST	49807	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.197909117 CEST	49807	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.197957993 CEST	443	49807	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.198009968 CEST	49807	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.198026896 CEST	443	49807	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.201545000 CEST	49812	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.201570034 CEST	443	49812	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.201657057 CEST	49812	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.201809883 CEST	49812	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.201823950 CEST	443	49812	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.213942051 CEST	443	49808	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.214277029 CEST	443	49808	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.214350939 CEST	49808	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.214432955 CEST	49808	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.214458942 CEST	443	49808	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.214483023 CEST	49808	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.214497089 CEST	443	49808	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.217024088 CEST	49813	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.217052937 CEST	443	49813	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.217140913 CEST	49813	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.217293024 CEST	49813	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.217318058 CEST	443	49813	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.223192930 CEST	443	49809	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.223622084 CEST	443	49809	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.223701954 CEST	49809	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.223731995 CEST	49809	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.223741055 CEST	443	49809	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.223750114 CEST	49809	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.223753929 CEST	443	49809	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.225845098 CEST	49814	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.225864887 CEST	443	49814	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.225975037 CEST	49814	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.226141930 CEST	49814	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.226167917 CEST	443	49814	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.293742895 CEST	443	49810	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.293781996 CEST	443	49810	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.293888092 CEST	49810	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.294011116 CEST	443	49811	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.294153929 CEST	443	49811	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.294234991 CEST	49811	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.294270039 CEST	49810	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.294279099 CEST	443	49810	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.294295073 CEST	49810	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.294298887 CEST	443	49810	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.295547962 CEST	49811	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.295574903 CEST	443	49811	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.295598984 CEST	49811	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.295609951 CEST	443	49811	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.298902988 CEST	49815	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.298934937 CEST	443	49815	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.299017906 CEST	49815	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.299324036 CEST	49815	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.299339056 CEST	443	49815	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.300071001 CEST	49816	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.300101995 CEST	443	49816	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.300323963 CEST	49816	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.300522089 CEST	49816	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.300535917 CEST	443	49816	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.849072933 CEST	443	49812	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.849715948 CEST	49812	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.849735022 CEST	443	49812	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.851053953 CEST	49812	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.851058960 CEST	443	49812	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.862600088 CEST	443	49814	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.862875938 CEST	49814	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.862900019 CEST	443	49814	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.863070965 CEST	443	49813	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.863205910 CEST	49814	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.863212109 CEST	443	49814	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.863460064 CEST	49813	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.863467932 CEST	443	49813	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.863759041 CEST	49813	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.863765001 CEST	443	49813	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.937864065 CEST	443	49816	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.938107014 CEST	443	49815	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.938407898 CEST	49816	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.938431025 CEST	443	49816	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.938680887 CEST	49815	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.938704014 CEST	443	49815	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.938962936 CEST	49816	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.938970089 CEST	443	49816	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.939018011 CEST	49815	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.939024925 CEST	443	49815	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.949773073 CEST	443	49812	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.950005054 CEST	443	49812	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.950082064 CEST	49812	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.950129032 CEST	49812	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.950144053 CEST	443	49812	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.950156927 CEST	49812	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.950162888 CEST	443	49812	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.953355074 CEST	49817	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.953392029 CEST	443	49817	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.953448057 CEST	49817	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.953564882 CEST	49817	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.953574896 CEST	443	49817	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.961013079 CEST	443	49814	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.961329937 CEST	443	49814	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.961378098 CEST	443	49814	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.961471081 CEST	49814	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.961471081 CEST	49814	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.961508989 CEST	49814	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.961508989 CEST	49814	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.961518049 CEST	443	49814	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.961529016 CEST	443	49814	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.963598967 CEST	443	49813	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.963845968 CEST	443	49813	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.963895082 CEST	49813	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.963921070 CEST	49813	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.963931084 CEST	443	49813	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.963942051 CEST	49813	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.963948965 CEST	443	49813	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.964725971 CEST	49818	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.964735985 CEST	443	49818	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.964895964 CEST	49818	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.964895964 CEST	49818	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.964915037 CEST	443	49818	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.969070911 CEST	49819	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.969098091 CEST	443	49819	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:28.969146013 CEST	49819	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.969314098 CEST	49819	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:28.969321966 CEST	443	49819	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:29.036272049 CEST	443	49816	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:29.036350965 CEST	443	49816	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:29.036396027 CEST	49816	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:29.036405087 CEST	443	49816	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:29.036467075 CEST	443	49816	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:29.036506891 CEST	49816	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:29.036813021 CEST	49816	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:29.036824942 CEST	443	49816	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:29.036833048 CEST	49816	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:29.036838055 CEST	443	49816	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:29.038026094 CEST	443	49815	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:29.038161039 CEST	443	49815	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:29.038248062 CEST	49815	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:29.038738012 CEST	49815	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:29.038738012 CEST	49815	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:29.038752079 CEST	443	49815	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:29.038759947 CEST	443	49815	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:29.040527105 CEST	49820	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:29.040553093 CEST	443	49820	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:29.040607929 CEST	49820	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:29.041484118 CEST	49821	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:29.041564941 CEST	443	49821	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:29.041632891 CEST	49821	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:29.041655064 CEST	49820	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:29.041668892 CEST	443	49820	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:29.042079926 CEST	49821	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:29.042114973 CEST	443	49821	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:29.603534937 CEST	443	49817	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:29.618644953 CEST	443	49819	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:29.621615887 CEST	49817	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:29.621651888 CEST	443	49817	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:29.622014046 CEST	49817	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:29.622025967 CEST	443	49817	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:29.622275114 CEST	49819	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:29.622286081 CEST	443	49819	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:29.622962952 CEST	49819	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:29.622967005 CEST	443	49819	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:29.629697084 CEST	443	49818	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:29.630003929 CEST	49818	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:29.630021095 CEST	443	49818	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:29.630331993 CEST	49818	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:29.630342960 CEST	443	49818	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:29.692002058 CEST	443	49821	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:29.694655895 CEST	49821	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:29.694684029 CEST	443	49821	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:29.694976091 CEST	49821	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:29.694982052 CEST	443	49821	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:29.717411041 CEST	443	49817	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:29.717562914 CEST	443	49817	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:29.717639923 CEST	49817	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:29.717838049 CEST	49817	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:29.717838049 CEST	49817	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:29.717864037 CEST	443	49817	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:29.717885971 CEST	443	49817	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:29.719824076 CEST	443	49819	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:29.720021963 CEST	443	49819	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:29.720192909 CEST	49822	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:29.720205069 CEST	49819	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:29.720222950 CEST	443	49822	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:29.720304012 CEST	49819	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:29.720315933 CEST	443	49819	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:29.720340014 CEST	49819	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:29.720343113 CEST	49822	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:29.720344067 CEST	443	49819	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:29.720426083 CEST	49822	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:29.720434904 CEST	443	49822	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:29.722003937 CEST	49823	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:29.722031116 CEST	443	49823	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:29.722088099 CEST	49823	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:29.722181082 CEST	49823	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:29.722191095 CEST	443	49823	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:29.729751110 CEST	443	49818	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:29.729899883 CEST	443	49818	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:29.729963064 CEST	49818	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:29.730056047 CEST	49818	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:29.730086088 CEST	443	49818	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:29.730112076 CEST	49818	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:29.730127096 CEST	443	49818	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:29.731616020 CEST	49824	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:29.731626034 CEST	443	49824	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:29.731692076 CEST	49824	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:29.731759071 CEST	49824	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:29.731762886 CEST	443	49824	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:29.735358953 CEST	443	49820	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:29.735632896 CEST	49820	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:29.735640049 CEST	443	49820	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:29.736004114 CEST	49820	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:29.736006975 CEST	443	49820	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:29.790636063 CEST	443	49821	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:29.790780067 CEST	443	49821	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:29.790855885 CEST	49821	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:29.801837921 CEST	49821	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:29.801837921 CEST	49821	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:29.801862001 CEST	443	49821	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:29.801877022 CEST	443	49821	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:29.803457022 CEST	49825	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:29.803484917 CEST	443	49825	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:29.803545952 CEST	49825	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:29.803651094 CEST	49825	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:29.803668976 CEST	443	49825	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:29.842622042 CEST	443	49820	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:29.843266964 CEST	443	49820	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:29.843337059 CEST	49820	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:29.843358994 CEST	443	49820	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:29.843379974 CEST	443	49820	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:29.843427896 CEST	49820	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:29.843477011 CEST	49820	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:29.843488932 CEST	443	49820	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:29.843497038 CEST	49820	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:29.843501091 CEST	443	49820	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:29.845144033 CEST	49826	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:29.845161915 CEST	443	49826	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:29.845220089 CEST	49826	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:29.845300913 CEST	49826	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:29.845314980 CEST	443	49826	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:30.355735064 CEST	443	49823	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:30.356210947 CEST	49823	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:30.356230974 CEST	443	49823	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:30.356623888 CEST	49823	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:30.356630087 CEST	443	49823	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:30.394309998 CEST	443	49824	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:30.395003080 CEST	49824	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:30.395021915 CEST	443	49824	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:30.395339966 CEST	49824	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:30.395345926 CEST	443	49824	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:30.400681019 CEST	443	49822	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:30.400990009 CEST	49822	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:30.401016951 CEST	443	49822	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:30.401340961 CEST	49822	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:30.401346922 CEST	443	49822	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:30.454850912 CEST	443	49823	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:30.455077887 CEST	443	49823	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:30.455137968 CEST	49823	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:30.455276966 CEST	49823	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:30.455296993 CEST	443	49823	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:30.455312014 CEST	49823	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:30.455318928 CEST	443	49823	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:30.465008974 CEST	49827	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:30.465034962 CEST	443	49827	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:30.465090036 CEST	49827	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:30.467052937 CEST	49827	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:30.467067003 CEST	443	49827	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:30.471497059 CEST	443	49825	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:30.471797943 CEST	49825	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:30.471811056 CEST	443	49825	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:30.472176075 CEST	49825	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:30.472182989 CEST	443	49825	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:30.478899956 CEST	443	49826	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:30.479144096 CEST	49826	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:30.479160070 CEST	443	49826	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:30.483896971 CEST	49826	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:30.483902931 CEST	443	49826	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:30.496570110 CEST	443	49824	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:30.496757030 CEST	443	49824	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:30.496809959 CEST	49824	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:30.496810913 CEST	443	49824	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:30.496860981 CEST	49824	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:30.496896982 CEST	49824	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:30.496908903 CEST	443	49824	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:30.496920109 CEST	49824	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:30.496926069 CEST	443	49824	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:30.508364916 CEST	443	49822	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:30.508552074 CEST	443	49822	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:30.508610964 CEST	49822	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:30.508652925 CEST	49822	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:30.508676052 CEST	443	49822	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:30.508687973 CEST	49822	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:30.508694887 CEST	443	49822	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:30.574397087 CEST	443	49825	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:30.574546099 CEST	443	49825	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:30.574605942 CEST	49825	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:30.578702927 CEST	443	49826	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:30.578862906 CEST	443	49826	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:30.578913927 CEST	49826	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:30.578924894 CEST	443	49826	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:30.578968048 CEST	443	49826	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:30.579020023 CEST	49826	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:30.579672098 CEST	49825	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:30.579679966 CEST	443	49825	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:30.579701900 CEST	49825	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:30.579708099 CEST	443	49825	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:30.580574989 CEST	49826	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:30.580579996 CEST	443	49826	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:30.580594063 CEST	49826	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:30.580598116 CEST	443	49826	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:30.622941017 CEST	49828	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:30.622982979 CEST	443	49828	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:30.623044968 CEST	49828	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:30.623424053 CEST	49828	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:30.623435974 CEST	443	49828	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:30.624749899 CEST	49829	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:30.624845982 CEST	443	49829	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:30.624923944 CEST	49829	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:30.625029087 CEST	49829	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:30.625066042 CEST	443	49829	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:30.625519991 CEST	49830	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:30.625541925 CEST	443	49830	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:30.625597000 CEST	49830	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:30.626075029 CEST	49831	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:30.626082897 CEST	443	49831	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:30.626167059 CEST	49831	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:30.798444986 CEST	49830	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:30.798521042 CEST	443	49830	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:30.801579952 CEST	49831	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:30.801604033 CEST	443	49831	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:31.147938967 CEST	443	49827	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:31.152491093 CEST	49827	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:31.152518034 CEST	443	49827	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:31.152885914 CEST	49827	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:31.152892113 CEST	443	49827	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:31.266840935 CEST	443	49827	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:31.267169952 CEST	443	49827	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:31.267251015 CEST	49827	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:31.267431021 CEST	49827	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:31.267448902 CEST	443	49827	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:31.267465115 CEST	49827	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:31.267471075 CEST	443	49827	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:31.269728899 CEST	49832	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:31.269767046 CEST	443	49832	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:31.269941092 CEST	49832	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:31.270083904 CEST	49832	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:31.270106077 CEST	443	49832	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:31.282424927 CEST	443	49828	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:31.286066055 CEST	443	49829	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:31.286449909 CEST	49828	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:31.286459923 CEST	443	49828	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:31.286796093 CEST	49828	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:31.286799908 CEST	443	49828	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:31.287244081 CEST	49829	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:31.287292004 CEST	443	49829	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:31.288520098 CEST	49829	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:31.288532972 CEST	443	49829	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:31.329672098 CEST	443	49721	23.1.237.91	192.168.2.5
Oct 8, 2024 05:04:31.329777956 CEST	49721	443	192.168.2.5	23.1.237.91
Oct 8, 2024 05:04:31.399077892 CEST	443	49828	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:31.399231911 CEST	443	49828	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:31.399322033 CEST	49828	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:31.399524927 CEST	49828	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:31.399540901 CEST	443	49828	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:31.399549961 CEST	49828	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:31.399554968 CEST	443	49828	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:31.399749994 CEST	443	49829	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:31.399903059 CEST	443	49829	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:31.399975061 CEST	49829	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:31.400796890 CEST	49829	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:31.400796890 CEST	49829	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:31.400834084 CEST	443	49829	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:31.400856972 CEST	443	49829	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:31.401559114 CEST	443	49831	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:31.402626038 CEST	49833	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:31.402663946 CEST	443	49833	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:31.402734995 CEST	49833	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:31.403193951 CEST	49831	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:31.403207064 CEST	443	49831	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:31.403573036 CEST	49831	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:31.403577089 CEST	443	49831	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:31.403707027 CEST	49833	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:31.403723001 CEST	443	49833	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:31.404582024 CEST	49834	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:31.404593945 CEST	443	49834	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:31.406327009 CEST	49834	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:31.406407118 CEST	49834	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:31.406419992 CEST	443	49834	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:31.410108089 CEST	443	49830	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:31.414232969 CEST	49830	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:31.414251089 CEST	443	49830	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:31.414546967 CEST	49830	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:31.414556980 CEST	443	49830	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:31.502875090 CEST	443	49831	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:31.503027916 CEST	443	49831	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:31.503106117 CEST	49831	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:31.503263950 CEST	49831	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:31.503263950 CEST	49831	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:31.503278017 CEST	443	49831	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:31.503284931 CEST	443	49831	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:31.505642891 CEST	49835	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:31.505675077 CEST	443	49835	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:31.505764008 CEST	49835	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:31.505851030 CEST	49835	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:31.505882025 CEST	443	49835	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:31.515026093 CEST	443	49830	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:31.515126944 CEST	443	49830	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:31.515198946 CEST	49830	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:31.515223026 CEST	443	49830	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:31.515252113 CEST	443	49830	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:31.515305042 CEST	49830	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:31.515336037 CEST	443	49830	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:31.515362024 CEST	49830	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:31.515362024 CEST	49830	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:31.515378952 CEST	443	49830	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:31.515414000 CEST	443	49830	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:31.517038107 CEST	49836	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:31.517096043 CEST	443	49836	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:31.517172098 CEST	49836	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:31.517262936 CEST	49836	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:31.517283916 CEST	443	49836	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:31.929687023 CEST	443	49832	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:31.930795908 CEST	49832	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:31.930811882 CEST	443	49832	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:31.931226969 CEST	49832	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:31.931235075 CEST	443	49832	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.031095028 CEST	443	49832	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.031145096 CEST	443	49832	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.031308889 CEST	49832	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.031507969 CEST	49832	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.031507969 CEST	49832	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.031528950 CEST	443	49832	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.031542063 CEST	443	49832	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.045530081 CEST	443	49834	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.045766115 CEST	443	49833	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.058211088 CEST	49837	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.058257103 CEST	443	49837	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.058315992 CEST	49837	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.058681011 CEST	49834	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.058712959 CEST	443	49834	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.059077978 CEST	49834	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.059084892 CEST	443	49834	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.059431076 CEST	49833	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.059439898 CEST	443	49833	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.059849977 CEST	49833	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.059854984 CEST	443	49833	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.060184002 CEST	49837	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.060199976 CEST	443	49837	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.155088902 CEST	443	49834	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.155118942 CEST	443	49834	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.155164003 CEST	443	49834	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.155191898 CEST	49834	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.155213118 CEST	49834	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.155381918 CEST	49834	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.155406952 CEST	443	49834	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.155426025 CEST	49834	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.155432940 CEST	443	49834	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.156508923 CEST	443	49833	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.156663895 CEST	443	49833	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.156713009 CEST	49833	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.157627106 CEST	49838	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.157655001 CEST	443	49838	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.157710075 CEST	49838	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.157757044 CEST	49833	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.157764912 CEST	443	49833	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.157777071 CEST	49833	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.157782078 CEST	443	49833	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.158695936 CEST	49838	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.158705950 CEST	443	49838	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.159708977 CEST	49839	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.159748077 CEST	443	49839	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.159809113 CEST	49839	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.159893036 CEST	49839	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.159909010 CEST	443	49839	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.193314075 CEST	443	49836	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.193654060 CEST	49836	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.193667889 CEST	443	49836	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.194036961 CEST	49836	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.194041014 CEST	443	49836	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.194962025 CEST	443	49835	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.195250988 CEST	49835	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.195274115 CEST	443	49835	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.195734024 CEST	49835	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.195748091 CEST	443	49835	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.299974918 CEST	443	49836	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.300211906 CEST	443	49836	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.300390005 CEST	49836	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.300436974 CEST	49836	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.300456047 CEST	443	49836	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.300467968 CEST	49836	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.300473928 CEST	443	49836	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.302198887 CEST	49840	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.302237034 CEST	443	49840	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.302295923 CEST	49840	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.302390099 CEST	49840	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.302407026 CEST	443	49840	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.303646088 CEST	443	49835	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.303905010 CEST	443	49835	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.303957939 CEST	49835	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.304003954 CEST	49835	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.304003954 CEST	49835	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.304013968 CEST	443	49835	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.304022074 CEST	443	49835	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.305450916 CEST	49841	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.305471897 CEST	443	49841	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.305521011 CEST	49841	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.305638075 CEST	49841	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.305645943 CEST	443	49841	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.699314117 CEST	443	49837	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.699863911 CEST	49837	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.699897051 CEST	443	49837	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.700290918 CEST	49837	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.700298071 CEST	443	49837	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.797806978 CEST	443	49837	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.798105955 CEST	443	49837	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.798161983 CEST	49837	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.801073074 CEST	49837	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.801084995 CEST	443	49837	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.809254885 CEST	49842	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.809278965 CEST	443	49842	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.809333086 CEST	49842	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.809640884 CEST	49842	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.809648037 CEST	443	49842	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.823911905 CEST	443	49838	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.823971033 CEST	443	49839	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.824326038 CEST	49838	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.824347019 CEST	443	49838	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.824798107 CEST	49838	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.824801922 CEST	443	49838	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.825076103 CEST	49839	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.825103045 CEST	443	49839	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.825469017 CEST	49839	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.825474977 CEST	443	49839	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.926806927 CEST	443	49839	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.927028894 CEST	443	49839	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.927073002 CEST	443	49838	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.927119017 CEST	49839	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.927330971 CEST	49839	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.927352905 CEST	443	49839	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.927365065 CEST	49839	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.927371025 CEST	443	49839	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.927608967 CEST	443	49838	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.927656889 CEST	49838	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.927689075 CEST	443	49838	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.927720070 CEST	443	49838	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.927762032 CEST	49838	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.928927898 CEST	49838	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.928941011 CEST	443	49838	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.928953886 CEST	49838	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.928958893 CEST	443	49838	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.931487083 CEST	49843	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.931533098 CEST	443	49843	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.931601048 CEST	49843	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.932492971 CEST	49844	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.932535887 CEST	443	49844	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.932590008 CEST	49844	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.932702065 CEST	49843	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.932727098 CEST	443	49843	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.932815075 CEST	49844	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.932833910 CEST	443	49844	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.965498924 CEST	443	49841	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.965637922 CEST	443	49840	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.966160059 CEST	49841	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.966181040 CEST	443	49841	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.966631889 CEST	49841	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.966636896 CEST	443	49841	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.966979027 CEST	49840	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.967005014 CEST	443	49840	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:32.967376947 CEST	49840	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:32.967392921 CEST	443	49840	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:33.067533970 CEST	443	49840	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:33.067687035 CEST	443	49840	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:33.067748070 CEST	49840	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:33.068104982 CEST	443	49841	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:33.068263054 CEST	443	49841	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:33.068310976 CEST	49841	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:33.087449074 CEST	49840	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:33.087474108 CEST	443	49840	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:33.087487936 CEST	49840	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:33.087493896 CEST	443	49840	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:33.087656021 CEST	49841	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:33.087675095 CEST	443	49841	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:33.087688923 CEST	49841	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:33.087693930 CEST	443	49841	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:33.100291014 CEST	49845	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:33.100331068 CEST	443	49845	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:33.100433111 CEST	49845	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:33.144081116 CEST	49845	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:33.144109964 CEST	443	49845	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:33.236622095 CEST	49846	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:33.236670017 CEST	443	49846	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:33.236772060 CEST	49846	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:33.256025076 CEST	49846	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:33.256056070 CEST	443	49846	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:33.452555895 CEST	443	49842	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:33.495109081 CEST	49842	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:33.495127916 CEST	443	49842	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:33.502264023 CEST	49842	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:33.502269030 CEST	443	49842	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:33.590795994 CEST	443	49844	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:33.591825962 CEST	443	49843	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:33.598082066 CEST	443	49842	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:33.598196983 CEST	443	49842	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:33.598244905 CEST	49842	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:33.598257065 CEST	443	49842	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:33.598301888 CEST	443	49842	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:33.598359108 CEST	49842	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:33.641623974 CEST	49844	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:33.642302990 CEST	49843	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:33.651983976 CEST	49844	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:33.652002096 CEST	443	49844	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:33.652455091 CEST	49844	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:33.652467012 CEST	443	49844	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:33.652767897 CEST	49843	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:33.652789116 CEST	443	49843	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:33.652925968 CEST	49842	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:33.652940989 CEST	443	49842	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:33.652952909 CEST	49842	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:33.652956963 CEST	443	49842	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:33.653223991 CEST	49843	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:33.653235912 CEST	443	49843	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:33.656517029 CEST	49847	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:33.656574965 CEST	443	49847	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:33.656656981 CEST	49847	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:33.657032013 CEST	49847	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:33.657064915 CEST	443	49847	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:33.747951031 CEST	443	49843	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:33.748136997 CEST	443	49843	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:33.748200893 CEST	49843	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:33.748270988 CEST	49843	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:33.748296976 CEST	443	49843	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:33.748321056 CEST	49843	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:33.748333931 CEST	443	49843	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:33.748766899 CEST	443	49844	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:33.749059916 CEST	443	49844	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:33.749094009 CEST	443	49844	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:33.749111891 CEST	49844	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:33.749145985 CEST	49844	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:33.749596119 CEST	49844	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:33.749596119 CEST	49844	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:33.749622107 CEST	443	49844	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:33.749644041 CEST	443	49844	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:33.752193928 CEST	49848	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:33.752208948 CEST	443	49848	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:33.752269983 CEST	49848	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:33.753112078 CEST	49849	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:33.753205061 CEST	443	49849	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:33.753222942 CEST	49848	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:33.753232956 CEST	443	49848	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:33.753281116 CEST	49849	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:33.753403902 CEST	49849	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:33.753443956 CEST	443	49849	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:33.817013025 CEST	443	49845	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:33.817394018 CEST	49845	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:33.817419052 CEST	443	49845	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:33.817816973 CEST	49845	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:33.817821026 CEST	443	49845	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:33.897926092 CEST	443	49846	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:33.905874014 CEST	49846	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:33.905884981 CEST	443	49846	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:33.906347990 CEST	49846	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:33.906352043 CEST	443	49846	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:33.918627024 CEST	443	49845	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:33.919078112 CEST	443	49845	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:33.919141054 CEST	49845	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:33.919156075 CEST	49845	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:33.919163942 CEST	443	49845	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:33.919176102 CEST	49845	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:33.919179916 CEST	443	49845	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:33.921825886 CEST	49850	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:33.921917915 CEST	443	49850	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:33.922008038 CEST	49850	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:33.922116995 CEST	49850	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:33.922141075 CEST	443	49850	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:34.001409054 CEST	443	49846	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:34.001502991 CEST	443	49846	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:34.001601934 CEST	443	49846	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:34.001611948 CEST	49846	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:34.001725912 CEST	49846	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:34.002331018 CEST	49846	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:34.002334118 CEST	443	49846	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:34.007874966 CEST	49851	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:34.007886887 CEST	443	49851	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:34.008045912 CEST	49851	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:34.008285999 CEST	49851	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:34.008295059 CEST	443	49851	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:34.325989962 CEST	443	49847	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:34.326558113 CEST	49847	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:34.326601028 CEST	443	49847	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:34.327016115 CEST	49847	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:34.327028990 CEST	443	49847	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:34.391496897 CEST	443	49849	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:34.392482042 CEST	49849	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:34.392546892 CEST	443	49849	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:34.392833948 CEST	49849	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:34.392851114 CEST	443	49849	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:34.404921055 CEST	443	49848	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:34.405365944 CEST	49848	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:34.405373096 CEST	443	49848	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:34.405740023 CEST	49848	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:34.405744076 CEST	443	49848	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:34.427751064 CEST	443	49847	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:34.427932024 CEST	443	49847	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:34.428034067 CEST	49847	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:34.428363085 CEST	49847	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:34.428402901 CEST	443	49847	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:34.428428888 CEST	49847	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:34.428445101 CEST	443	49847	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:34.432506084 CEST	49852	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:34.432568073 CEST	443	49852	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:34.432657957 CEST	49852	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:34.432789087 CEST	49852	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:34.432810068 CEST	443	49852	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:34.494817972 CEST	443	49849	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:34.494837999 CEST	443	49849	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:34.494865894 CEST	443	49849	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:34.495027065 CEST	49849	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:34.495027065 CEST	49849	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:34.495831966 CEST	49849	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:34.495831966 CEST	49849	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:34.495879889 CEST	443	49849	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:34.495908022 CEST	443	49849	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:34.500137091 CEST	49853	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:34.500164986 CEST	443	49853	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:34.500293016 CEST	49853	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:34.501262903 CEST	49853	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:34.501281023 CEST	443	49853	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:34.515074015 CEST	443	49848	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:34.515377045 CEST	443	49848	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:34.515434980 CEST	49848	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:34.515459061 CEST	49848	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:34.515464067 CEST	443	49848	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:34.515472889 CEST	49848	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:34.515476942 CEST	443	49848	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:34.518116951 CEST	49854	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:34.518134117 CEST	443	49854	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:34.518232107 CEST	49854	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:34.518520117 CEST	49854	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:34.518536091 CEST	443	49854	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:34.559056044 CEST	443	49850	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:34.559562922 CEST	49850	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:34.559582949 CEST	443	49850	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:34.560208082 CEST	49850	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:34.560266018 CEST	443	49850	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:34.656877041 CEST	443	49850	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:34.656975985 CEST	443	49850	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:34.657068014 CEST	49850	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:34.657083035 CEST	443	49850	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:34.657141924 CEST	49850	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:34.659538031 CEST	49850	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:34.659538031 CEST	49850	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:34.659607887 CEST	443	49850	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:34.659642935 CEST	443	49850	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:34.661067963 CEST	443	49851	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:34.673783064 CEST	49851	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:34.673804998 CEST	443	49851	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:34.674290895 CEST	49851	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:34.674295902 CEST	443	49851	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:34.706423998 CEST	49855	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:34.706469059 CEST	443	49855	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:34.706551075 CEST	49855	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:34.751368046 CEST	49855	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:34.751405001 CEST	443	49855	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:34.770838976 CEST	443	49851	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:34.770899057 CEST	443	49851	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:34.770958900 CEST	49851	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:34.771222115 CEST	49851	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:34.771234035 CEST	443	49851	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:34.771244049 CEST	49851	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:34.771249056 CEST	443	49851	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:34.842474937 CEST	49856	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:34.842492104 CEST	443	49856	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:34.842570066 CEST	49856	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:34.842688084 CEST	49856	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:34.842698097 CEST	443	49856	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.071160078 CEST	443	49852	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.072211027 CEST	49852	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:35.072227955 CEST	443	49852	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.072792053 CEST	49852	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:35.072798014 CEST	443	49852	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.140078068 CEST	443	49853	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.142141104 CEST	49853	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:35.142162085 CEST	443	49853	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.142554998 CEST	49853	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:35.142560005 CEST	443	49853	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.171521902 CEST	443	49854	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.172000885 CEST	443	49852	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.172018051 CEST	49854	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:35.172034979 CEST	443	49854	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.172204018 CEST	443	49852	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.172446966 CEST	49852	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:35.172584057 CEST	49854	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:35.172590971 CEST	443	49854	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.172622919 CEST	49852	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:35.172655106 CEST	443	49852	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.172683001 CEST	49852	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:35.172698021 CEST	443	49852	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.175574064 CEST	49857	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:35.175668001 CEST	443	49857	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.179735899 CEST	49857	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:35.179841995 CEST	49857	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:35.179883003 CEST	443	49857	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.240046024 CEST	443	49853	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.240330935 CEST	443	49853	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.240437031 CEST	49853	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:35.260056019 CEST	49853	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:35.260071993 CEST	443	49853	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.260087013 CEST	49853	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:35.260093927 CEST	443	49853	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.262965918 CEST	49858	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:35.263019085 CEST	443	49858	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.263278961 CEST	49858	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:35.263278961 CEST	49858	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:35.263428926 CEST	443	49858	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.271229982 CEST	443	49854	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.271313906 CEST	443	49854	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.271404028 CEST	49854	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:35.271415949 CEST	443	49854	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.271454096 CEST	443	49854	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.271678925 CEST	49854	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:35.271678925 CEST	49854	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:35.271693945 CEST	443	49854	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.271732092 CEST	49854	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:35.271737099 CEST	443	49854	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.274357080 CEST	49859	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:35.274374962 CEST	443	49859	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.274445057 CEST	49859	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:35.274547100 CEST	49859	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:35.274557114 CEST	443	49859	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.416954994 CEST	443	49855	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.420267105 CEST	49855	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:35.420329094 CEST	443	49855	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.420731068 CEST	49855	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:35.420744896 CEST	443	49855	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.480957985 CEST	443	49856	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.481472015 CEST	49856	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:35.481483936 CEST	443	49856	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.481854916 CEST	49856	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:35.481858969 CEST	443	49856	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.519962072 CEST	443	49855	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.520101070 CEST	443	49855	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.520227909 CEST	49855	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:35.520335913 CEST	49855	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:35.520356894 CEST	443	49855	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.520371914 CEST	49855	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:35.520379066 CEST	443	49855	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.523128986 CEST	49860	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:35.523168087 CEST	443	49860	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.523243904 CEST	49860	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:35.523363113 CEST	49860	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:35.523395061 CEST	443	49860	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.578521013 CEST	443	49856	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.578551054 CEST	443	49856	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.578597069 CEST	443	49856	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.578615904 CEST	49856	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:35.578649998 CEST	49856	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:35.578794956 CEST	49856	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:35.578808069 CEST	443	49856	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.578816891 CEST	49856	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:35.578821898 CEST	443	49856	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.606653929 CEST	49861	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:35.606693029 CEST	443	49861	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.606774092 CEST	49861	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:35.606889009 CEST	49861	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:35.606908083 CEST	443	49861	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.831059933 CEST	443	49857	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.836328030 CEST	49857	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:35.836391926 CEST	443	49857	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.836692095 CEST	49857	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:35.836709023 CEST	443	49857	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.902055025 CEST	443	49858	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.902744055 CEST	49858	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:35.902767897 CEST	443	49858	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.903191090 CEST	49858	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:35.903198004 CEST	443	49858	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.910006046 CEST	443	49859	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.912029982 CEST	49859	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:35.912048101 CEST	443	49859	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.912389040 CEST	49859	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:35.912391901 CEST	443	49859	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.939435959 CEST	443	49857	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.939599991 CEST	443	49857	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.939739943 CEST	49857	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:35.951744080 CEST	49857	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:35.951767921 CEST	443	49857	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.951781988 CEST	49857	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:35.951790094 CEST	443	49857	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.987449884 CEST	49862	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:35.987479925 CEST	443	49862	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:35.987811089 CEST	49862	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:35.987811089 CEST	49862	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:35.987838984 CEST	443	49862	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.001638889 CEST	443	49858	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.001822948 CEST	443	49858	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.003751040 CEST	49858	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:36.003844976 CEST	49858	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:36.003856897 CEST	443	49858	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.003869057 CEST	49858	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:36.003874063 CEST	443	49858	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.007106066 CEST	49863	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:36.007201910 CEST	443	49863	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.007291079 CEST	49863	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:36.007437944 CEST	49863	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:36.007466078 CEST	443	49863	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.008883953 CEST	443	49859	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.009115934 CEST	443	49859	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.009174109 CEST	49859	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:36.009423018 CEST	49859	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:36.009437084 CEST	443	49859	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.009449005 CEST	49859	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:36.009453058 CEST	443	49859	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.011697054 CEST	49864	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:36.011790991 CEST	443	49864	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.011876106 CEST	49864	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:36.011991024 CEST	49864	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:36.012022018 CEST	443	49864	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.190896988 CEST	443	49860	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.191435099 CEST	49860	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:36.191457033 CEST	443	49860	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.191941023 CEST	49860	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:36.191945076 CEST	443	49860	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.268934965 CEST	443	49861	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.269742966 CEST	49861	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:36.269742966 CEST	49861	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:36.269757032 CEST	443	49861	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.269772053 CEST	443	49861	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.293024063 CEST	443	49860	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.293217897 CEST	443	49860	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.293268919 CEST	49860	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:36.293277979 CEST	443	49860	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.293325901 CEST	443	49860	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.293346882 CEST	49860	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:36.293356895 CEST	443	49860	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.293370008 CEST	49860	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:36.293373108 CEST	443	49860	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.293384075 CEST	49860	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:36.293385983 CEST	443	49860	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.309148073 CEST	49865	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:36.309163094 CEST	443	49865	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.309226990 CEST	49865	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:36.309576035 CEST	49865	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:36.309585094 CEST	443	49865	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.368840933 CEST	443	49861	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.369060040 CEST	443	49861	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.369282007 CEST	49861	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:36.369282007 CEST	49861	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:36.369447947 CEST	49861	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:36.369461060 CEST	443	49861	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.372256041 CEST	49866	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:36.372268915 CEST	443	49866	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.372343063 CEST	49866	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:36.372487068 CEST	49866	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:36.372495890 CEST	443	49866	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.640728951 CEST	443	49863	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.642812967 CEST	49863	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:36.642836094 CEST	443	49863	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.643327951 CEST	49863	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:36.643332958 CEST	443	49863	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.645243883 CEST	443	49862	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.646373034 CEST	49862	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:36.646397114 CEST	443	49862	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.648628950 CEST	443	49864	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.654611111 CEST	49862	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:36.654619932 CEST	443	49862	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.654877901 CEST	49864	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:36.654921055 CEST	443	49864	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.655349970 CEST	49864	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:36.655358076 CEST	443	49864	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.740010977 CEST	443	49863	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.740067959 CEST	443	49863	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.740127087 CEST	49863	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:36.740386963 CEST	49863	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:36.740400076 CEST	443	49863	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.740411043 CEST	49863	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:36.740416050 CEST	443	49863	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.743563890 CEST	49867	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:36.743604898 CEST	443	49867	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.743676901 CEST	49867	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:36.743813992 CEST	49867	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:36.743834972 CEST	443	49867	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.760458946 CEST	443	49864	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.760518074 CEST	443	49864	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.760567904 CEST	49864	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:36.760694981 CEST	49864	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:36.760704994 CEST	443	49864	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.760720015 CEST	49864	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:36.760725975 CEST	443	49864	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.763524055 CEST	443	49862	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.764753103 CEST	443	49862	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.764786959 CEST	443	49862	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.764812946 CEST	49862	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:36.764857054 CEST	49862	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:36.769746065 CEST	49862	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:36.769746065 CEST	49862	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:36.769767046 CEST	443	49862	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.769789934 CEST	443	49862	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.774548054 CEST	49868	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:36.774578094 CEST	443	49868	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.774655104 CEST	49868	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:36.777448893 CEST	49868	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:36.777463913 CEST	443	49868	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.785218954 CEST	49869	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:36.785248041 CEST	443	49869	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.785355091 CEST	49869	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:36.785429001 CEST	49869	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:36.785437107 CEST	443	49869	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.987648964 CEST	443	49865	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.995019913 CEST	49865	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:36.995032072 CEST	443	49865	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:36.995441914 CEST	49865	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:36.995445013 CEST	443	49865	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:37.066884995 CEST	443	49866	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:37.067945957 CEST	49866	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:37.067966938 CEST	443	49866	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:37.069664001 CEST	49866	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:37.069669962 CEST	443	49866	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:37.098047972 CEST	443	49865	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:37.098362923 CEST	443	49865	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:37.098468065 CEST	49865	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:37.098932028 CEST	49865	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:37.098932028 CEST	49865	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:37.098948956 CEST	443	49865	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:37.098958969 CEST	443	49865	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:37.103545904 CEST	49871	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:37.103586912 CEST	443	49871	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:37.103705883 CEST	49871	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:37.103940964 CEST	49871	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:37.103955984 CEST	443	49871	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:37.169847965 CEST	443	49866	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:37.170228004 CEST	443	49866	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:37.170310020 CEST	49866	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:37.170424938 CEST	49866	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:37.170424938 CEST	49866	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:37.170435905 CEST	443	49866	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:37.170443058 CEST	443	49866	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:37.173933029 CEST	49872	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:37.173969030 CEST	443	49872	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:37.174061060 CEST	49872	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:37.174681902 CEST	49872	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:37.174700022 CEST	443	49872	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:37.403518915 CEST	443	49867	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:37.404057026 CEST	49867	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:37.404093027 CEST	443	49867	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:37.404465914 CEST	49867	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:37.404474974 CEST	443	49867	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:37.434226036 CEST	443	49868	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:37.434442043 CEST	443	49869	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:37.434679985 CEST	49868	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:37.434695959 CEST	443	49868	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:37.434909105 CEST	49869	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:37.434926033 CEST	443	49869	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:37.435162067 CEST	49868	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:37.435167074 CEST	443	49868	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:37.435857058 CEST	49869	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:37.435863018 CEST	443	49869	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:37.506267071 CEST	443	49867	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:37.506444931 CEST	443	49867	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:37.506515980 CEST	49867	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:37.506612062 CEST	49867	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:37.506629944 CEST	443	49867	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:37.506645918 CEST	49867	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:37.506654024 CEST	443	49867	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:37.509449005 CEST	49873	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:37.509490967 CEST	443	49873	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:37.509598970 CEST	49873	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:37.509748936 CEST	49873	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:37.509757996 CEST	443	49873	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:37.536079884 CEST	443	49869	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:37.536248922 CEST	443	49869	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:37.536385059 CEST	49869	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:37.536428928 CEST	49869	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:37.536428928 CEST	49869	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:37.536442041 CEST	443	49869	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:37.536448956 CEST	443	49869	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:37.538317919 CEST	49874	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:37.538378954 CEST	443	49874	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:37.538471937 CEST	49874	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:37.538593054 CEST	49874	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:37.538609982 CEST	443	49874	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:37.544812918 CEST	443	49868	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:37.544964075 CEST	443	49868	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:37.545023918 CEST	49868	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:37.545161009 CEST	49868	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:37.545177937 CEST	443	49868	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:37.545188904 CEST	49868	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:37.545193911 CEST	443	49868	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:37.547415972 CEST	49875	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:37.547454119 CEST	443	49875	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:37.547646046 CEST	49875	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:37.547646046 CEST	49875	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:37.547684908 CEST	443	49875	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:37.762509108 CEST	443	49871	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:37.762972116 CEST	49871	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:37.762990952 CEST	443	49871	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:37.763389111 CEST	49871	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:37.763394117 CEST	443	49871	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:37.814060926 CEST	443	49872	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:37.814400911 CEST	49872	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:37.814433098 CEST	443	49872	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:37.814845085 CEST	49872	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:37.814851046 CEST	443	49872	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:37.862365007 CEST	443	49871	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:37.862428904 CEST	443	49871	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:37.862523079 CEST	443	49871	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:37.862603903 CEST	49871	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:37.862675905 CEST	49871	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:37.862677097 CEST	49871	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:37.862720966 CEST	443	49871	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:37.862747908 CEST	443	49871	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:37.865133047 CEST	49876	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:37.865175009 CEST	443	49876	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:37.865262985 CEST	49876	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:37.865380049 CEST	49876	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:37.865390062 CEST	443	49876	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:37.913933992 CEST	443	49872	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:37.914129972 CEST	443	49872	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:37.914227009 CEST	49872	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:37.914227009 CEST	49872	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:37.914323092 CEST	49872	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:37.914334059 CEST	443	49872	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:37.916074038 CEST	49877	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:37.916105986 CEST	443	49877	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:37.918112040 CEST	49877	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:37.918204069 CEST	49877	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:37.918210030 CEST	443	49877	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:38.155664921 CEST	443	49873	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:38.156044006 CEST	49873	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:38.156053066 CEST	443	49873	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:38.156459093 CEST	49873	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:38.156462908 CEST	443	49873	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:38.173947096 CEST	443	49874	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:38.174364090 CEST	49874	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:38.174376011 CEST	443	49874	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:38.174798012 CEST	49874	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:38.174802065 CEST	443	49874	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:38.187769890 CEST	443	49875	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:38.188090086 CEST	49875	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:38.188102007 CEST	443	49875	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:38.188416004 CEST	49875	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:38.188432932 CEST	443	49875	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:38.257735014 CEST	443	49873	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:38.257775068 CEST	443	49873	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:38.258156061 CEST	49873	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:38.258311987 CEST	49873	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:38.258311987 CEST	49873	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:38.258357048 CEST	443	49873	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:38.258384943 CEST	443	49873	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:38.260500908 CEST	49879	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:38.260545969 CEST	443	49879	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:38.260627985 CEST	49879	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:38.260730028 CEST	49879	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:38.260739088 CEST	443	49879	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:38.274698019 CEST	443	49874	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:38.275022984 CEST	443	49874	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:38.275114059 CEST	49874	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:38.275135040 CEST	49874	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:38.275140047 CEST	443	49874	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:38.275155067 CEST	49874	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:38.275160074 CEST	443	49874	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:38.276820898 CEST	49880	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:38.276844025 CEST	443	49880	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:38.276910067 CEST	49880	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:38.277004004 CEST	49880	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:38.277014971 CEST	443	49880	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:38.286597967 CEST	443	49875	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:38.286653996 CEST	443	49875	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:38.286778927 CEST	443	49875	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:38.286802053 CEST	49875	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:38.286845922 CEST	49875	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:38.286969900 CEST	49875	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:38.286969900 CEST	49875	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:38.286983967 CEST	443	49875	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:38.286993980 CEST	443	49875	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:38.288688898 CEST	49881	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:38.288706064 CEST	443	49881	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:38.288773060 CEST	49881	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:38.288871050 CEST	49881	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:38.288883924 CEST	443	49881	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:38.517926931 CEST	443	49876	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:38.519798994 CEST	49876	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:38.519825935 CEST	443	49876	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:38.520226955 CEST	49876	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:38.520231962 CEST	443	49876	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:38.581068993 CEST	443	49877	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:38.581681967 CEST	49877	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:38.581706047 CEST	443	49877	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:38.582134008 CEST	49877	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:38.582138062 CEST	443	49877	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:38.617757082 CEST	443	49876	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:38.617824078 CEST	443	49876	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:38.617930889 CEST	443	49876	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:38.617990971 CEST	49876	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:38.618047953 CEST	49876	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:38.618062973 CEST	443	49876	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:38.618073940 CEST	49876	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:38.618079901 CEST	443	49876	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:38.620712996 CEST	49882	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:38.620754957 CEST	443	49882	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:38.620856047 CEST	49882	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:38.620984077 CEST	49882	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:38.620999098 CEST	443	49882	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:38.684098005 CEST	443	49877	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:38.684134960 CEST	443	49877	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:38.684190989 CEST	443	49877	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:38.684231997 CEST	49877	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:38.684259892 CEST	49877	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:38.684386969 CEST	49877	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:38.684406042 CEST	443	49877	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:38.684415102 CEST	49877	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:38.684420109 CEST	443	49877	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:38.686640024 CEST	49883	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:38.686677933 CEST	443	49883	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:38.686738968 CEST	49883	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:38.686888933 CEST	49883	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:38.686898947 CEST	443	49883	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:38.894916058 CEST	443	49879	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:38.898029089 CEST	49879	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:38.898067951 CEST	443	49879	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:38.898447990 CEST	49879	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:38.898454905 CEST	443	49879	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:38.908323050 CEST	443	49880	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:38.909852028 CEST	49880	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:38.909866095 CEST	443	49880	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:38.910202026 CEST	49880	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:38.910206079 CEST	443	49880	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:38.940300941 CEST	443	49881	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:38.944487095 CEST	49881	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:38.944525957 CEST	443	49881	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:38.945019007 CEST	49881	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:38.945025921 CEST	443	49881	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:38.998404980 CEST	443	49879	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:38.998523951 CEST	443	49879	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:38.998699903 CEST	49879	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:38.999254942 CEST	49879	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:38.999279022 CEST	443	49879	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:38.999290943 CEST	49879	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:38.999296904 CEST	443	49879	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.006788015 CEST	49884	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:39.006810904 CEST	443	49884	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.007122040 CEST	49884	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:39.007628918 CEST	443	49880	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.007652998 CEST	443	49880	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.007685900 CEST	443	49880	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.007705927 CEST	49880	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:39.007731915 CEST	49880	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:39.052453041 CEST	49880	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:39.052453041 CEST	49880	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:39.052483082 CEST	443	49880	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.052493095 CEST	443	49880	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.052582026 CEST	49884	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:39.052608013 CEST	443	49884	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.059999943 CEST	443	49881	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.060163975 CEST	443	49881	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.060220957 CEST	49881	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:39.066402912 CEST	49881	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:39.066426992 CEST	443	49881	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.066442966 CEST	49881	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:39.066448927 CEST	443	49881	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.069107056 CEST	49885	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:39.069149017 CEST	443	49885	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.069245100 CEST	49885	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:39.072150946 CEST	49885	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:39.072165966 CEST	443	49885	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.073668957 CEST	49886	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:39.073683977 CEST	443	49886	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.073740959 CEST	49886	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:39.073864937 CEST	49886	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:39.073877096 CEST	443	49886	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.258465052 CEST	443	49882	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.258896112 CEST	49882	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:39.258913994 CEST	443	49882	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.259291887 CEST	49882	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:39.259298086 CEST	443	49882	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.360064030 CEST	443	49882	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.360096931 CEST	443	49882	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.360157013 CEST	49882	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:39.360171080 CEST	443	49882	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.360227108 CEST	49882	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:39.366126060 CEST	443	49883	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.383619070 CEST	49882	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:39.383646965 CEST	443	49882	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.383662939 CEST	49882	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:39.383671045 CEST	443	49882	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.385246038 CEST	49883	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:39.385277033 CEST	443	49883	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.385639906 CEST	49883	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:39.385646105 CEST	443	49883	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.387371063 CEST	49887	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:39.387428999 CEST	443	49887	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.387598991 CEST	49887	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:39.387897015 CEST	49887	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:39.387911081 CEST	443	49887	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.486319065 CEST	443	49883	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.486521006 CEST	443	49883	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.486572981 CEST	49883	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:39.486581087 CEST	443	49883	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.486637115 CEST	49883	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:39.490818024 CEST	49883	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:39.490838051 CEST	443	49883	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.493901014 CEST	49888	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:39.493942022 CEST	443	49888	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.494067907 CEST	49888	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:39.494962931 CEST	49888	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:39.494980097 CEST	443	49888	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.713386059 CEST	443	49884	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.720710039 CEST	49884	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:39.720736980 CEST	443	49884	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.721173048 CEST	49884	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:39.721190929 CEST	443	49884	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.753117085 CEST	443	49886	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.753782988 CEST	49886	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:39.753803968 CEST	443	49886	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.754945040 CEST	49886	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:39.754956007 CEST	443	49886	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.756573915 CEST	443	49885	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.756978035 CEST	49885	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:39.756993055 CEST	443	49885	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.757853031 CEST	49885	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:39.757863045 CEST	443	49885	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.820028067 CEST	443	49884	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.821074963 CEST	443	49884	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.821114063 CEST	443	49884	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.821197033 CEST	49884	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:39.821197033 CEST	49884	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:39.823113918 CEST	49884	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:39.823133945 CEST	443	49884	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.823204041 CEST	49884	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:39.823215008 CEST	443	49884	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.828831911 CEST	49889	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:39.828876019 CEST	443	49889	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.828957081 CEST	49889	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:39.829427958 CEST	49889	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:39.829453945 CEST	443	49889	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.854196072 CEST	443	49885	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.854387045 CEST	443	49885	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.854475975 CEST	49885	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:39.854511976 CEST	49885	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:39.854511976 CEST	49885	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:39.854533911 CEST	443	49885	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.854553938 CEST	443	49885	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.856506109 CEST	49890	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:39.856529951 CEST	443	49890	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.856642962 CEST	49890	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:39.856825113 CEST	49890	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:39.856849909 CEST	443	49890	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.857981920 CEST	443	49886	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.858278036 CEST	443	49886	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.858340025 CEST	49886	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:39.858369112 CEST	49886	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:39.858369112 CEST	49886	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:39.858382940 CEST	443	49886	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.858401060 CEST	443	49886	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.860470057 CEST	49891	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:39.860501051 CEST	443	49891	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:39.860727072 CEST	49891	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:39.860901117 CEST	49891	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:39.860915899 CEST	443	49891	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:40.037852049 CEST	443	49887	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:40.038706064 CEST	49887	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:40.038714886 CEST	443	49887	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:40.039028883 CEST	49887	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:40.039033890 CEST	443	49887	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:40.139102936 CEST	443	49887	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:40.139251947 CEST	443	49887	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:40.139419079 CEST	49887	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:40.139643908 CEST	49887	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:40.139652014 CEST	443	49887	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:40.139672995 CEST	49887	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:40.139679909 CEST	443	49887	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:40.142508030 CEST	49892	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:40.142540932 CEST	443	49892	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:40.143301010 CEST	49892	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:40.143603086 CEST	49892	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:40.143615961 CEST	443	49892	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:40.151751041 CEST	443	49888	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:40.152096033 CEST	49888	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:40.152106047 CEST	443	49888	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:40.152570009 CEST	49888	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:40.152575970 CEST	443	49888	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:40.254704952 CEST	443	49888	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:40.254739046 CEST	443	49888	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:40.254777908 CEST	443	49888	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:40.254834890 CEST	49888	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:40.255014896 CEST	49888	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:40.255014896 CEST	49888	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:40.255026102 CEST	443	49888	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:40.255036116 CEST	443	49888	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:40.257081032 CEST	49893	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:40.257162094 CEST	443	49893	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:40.257246017 CEST	49893	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:40.257388115 CEST	49893	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:40.257424116 CEST	443	49893	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:40.506217957 CEST	443	49889	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:40.506659985 CEST	49889	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:40.506724119 CEST	443	49889	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:40.507127047 CEST	49889	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:40.507142067 CEST	443	49889	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:40.510885000 CEST	443	49890	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:40.511171103 CEST	49890	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:40.511187077 CEST	443	49890	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:40.511524916 CEST	49890	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:40.511538029 CEST	443	49890	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:40.561433077 CEST	443	49891	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:40.561846018 CEST	49891	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:40.561872959 CEST	443	49891	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:40.562100887 CEST	49891	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:40.562112093 CEST	443	49891	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:40.612010956 CEST	443	49890	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:40.612293959 CEST	443	49890	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:40.612348080 CEST	443	49890	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:40.612346888 CEST	49890	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:40.612409115 CEST	49890	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:40.612459898 CEST	49890	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:40.612459898 CEST	49890	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:40.612498045 CEST	443	49890	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:40.612519979 CEST	443	49890	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:40.615015984 CEST	443	49889	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:40.615075111 CEST	443	49889	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:40.615158081 CEST	49889	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:40.615345001 CEST	49889	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:40.615361929 CEST	443	49889	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:40.615410089 CEST	49889	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:40.615423918 CEST	443	49889	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:40.615462065 CEST	49894	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:40.615505934 CEST	443	49894	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:40.615639925 CEST	49894	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:40.615947962 CEST	49894	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:40.615958929 CEST	443	49894	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:40.617413998 CEST	49895	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:40.617440939 CEST	443	49895	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:40.617501974 CEST	49895	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:40.617613077 CEST	49895	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:40.617625952 CEST	443	49895	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:40.668653011 CEST	443	49891	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:40.668816090 CEST	443	49891	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:40.668915987 CEST	49891	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:40.668915987 CEST	49891	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:40.671066046 CEST	49896	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:40.671112061 CEST	443	49896	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:40.671185017 CEST	49896	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:40.671309948 CEST	49896	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:40.671319962 CEST	443	49896	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:40.671422005 CEST	49891	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:40.671438932 CEST	443	49891	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:40.786709070 CEST	443	49892	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:40.787167072 CEST	49892	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:40.787201881 CEST	443	49892	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:40.787586927 CEST	49892	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:40.787590981 CEST	443	49892	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:40.884948969 CEST	443	49892	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:40.885010004 CEST	443	49892	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:40.885108948 CEST	443	49892	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:40.885174036 CEST	49892	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:40.885281086 CEST	49892	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:40.885302067 CEST	443	49892	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:40.885313988 CEST	49892	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:40.885319948 CEST	443	49892	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:40.887954950 CEST	49897	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:40.888000011 CEST	443	49897	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:40.888200045 CEST	49897	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:40.888324976 CEST	49897	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:40.888339996 CEST	443	49897	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:40.932302952 CEST	443	49893	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:40.932686090 CEST	49893	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:40.932699919 CEST	443	49893	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:40.933171988 CEST	49893	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:40.933177948 CEST	443	49893	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:41.035605907 CEST	443	49893	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:41.035669088 CEST	443	49893	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:41.035829067 CEST	49893	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:41.035857916 CEST	49893	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:41.035871983 CEST	443	49893	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:41.035881042 CEST	49893	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:41.035887003 CEST	443	49893	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:41.038098097 CEST	49898	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:41.038115978 CEST	443	49898	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:41.038182974 CEST	49898	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:41.038285971 CEST	49898	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:41.038290977 CEST	443	49898	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:41.271724939 CEST	443	49894	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:41.272171974 CEST	49894	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:41.272192955 CEST	443	49894	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:41.272628069 CEST	49894	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:41.272634983 CEST	443	49894	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:41.278863907 CEST	443	49895	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:41.279208899 CEST	49895	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:41.279220104 CEST	443	49895	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:41.279562950 CEST	49895	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:41.279567003 CEST	443	49895	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:41.327442884 CEST	443	49896	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:41.327852011 CEST	49896	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:41.327881098 CEST	443	49896	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:41.328165054 CEST	49896	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:41.328172922 CEST	443	49896	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:41.375621080 CEST	443	49894	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:41.375688076 CEST	443	49894	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:41.375900030 CEST	49894	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:41.375937939 CEST	49894	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:41.375955105 CEST	443	49894	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:41.375965118 CEST	49894	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:41.375971079 CEST	443	49894	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:41.378599882 CEST	49899	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:41.378679991 CEST	443	49899	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:41.378777981 CEST	49899	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:41.378914118 CEST	49899	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:41.378930092 CEST	443	49899	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:41.380692005 CEST	443	49895	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:41.380894899 CEST	443	49895	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:41.380945921 CEST	49895	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:41.380969048 CEST	49895	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:41.380984068 CEST	443	49895	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:41.380994081 CEST	49895	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:41.380999088 CEST	443	49895	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:41.382962942 CEST	49900	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:41.382993937 CEST	443	49900	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:41.383186102 CEST	49900	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:41.383186102 CEST	49900	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:41.383209944 CEST	443	49900	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:41.430691004 CEST	443	49896	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:41.430828094 CEST	443	49896	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:41.430958033 CEST	49896	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:41.431018114 CEST	49896	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:41.431032896 CEST	443	49896	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:41.431045055 CEST	49896	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:41.431051016 CEST	443	49896	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:41.433432102 CEST	49901	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:41.433475018 CEST	443	49901	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:41.433536053 CEST	49901	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:41.433641911 CEST	49901	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:41.433653116 CEST	443	49901	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:41.769743919 CEST	443	49898	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:41.770203114 CEST	443	49897	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:41.772957087 CEST	49898	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:41.772981882 CEST	443	49898	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:41.773466110 CEST	49898	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:41.773471117 CEST	443	49898	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:41.776391029 CEST	49897	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:41.776401997 CEST	443	49897	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:41.776782036 CEST	49897	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:41.776786089 CEST	443	49897	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:41.868614912 CEST	443	49898	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:41.868642092 CEST	443	49898	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:41.868679047 CEST	443	49898	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:41.868758917 CEST	49898	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:41.868784904 CEST	49898	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:41.868968010 CEST	49898	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:41.868988991 CEST	443	49898	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:41.868999958 CEST	49898	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:41.869004965 CEST	443	49898	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:41.871939898 CEST	49902	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:41.872046947 CEST	443	49902	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:41.872139931 CEST	49902	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:41.872375011 CEST	49902	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:41.872411013 CEST	443	49902	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:41.873284101 CEST	443	49897	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:41.873430967 CEST	443	49897	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:41.873554945 CEST	49897	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:41.873671055 CEST	49897	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:41.873676062 CEST	443	49897	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:41.873683929 CEST	49897	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:41.873686075 CEST	443	49897	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:41.875412941 CEST	49903	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:41.875442982 CEST	443	49903	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:41.875608921 CEST	49903	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:41.875608921 CEST	49903	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:41.875642061 CEST	443	49903	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.016946077 CEST	443	49899	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.020234108 CEST	49899	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.020268917 CEST	443	49899	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.020562887 CEST	49899	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.020575047 CEST	443	49899	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.021883011 CEST	443	49900	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.024321079 CEST	49900	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.024321079 CEST	49900	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.024353027 CEST	443	49900	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.024372101 CEST	443	49900	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.083612919 CEST	443	49901	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.083914995 CEST	49901	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.083933115 CEST	443	49901	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.084233999 CEST	49901	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.084239960 CEST	443	49901	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.118736982 CEST	443	49899	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.119002104 CEST	443	49899	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.119112015 CEST	49899	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.119158030 CEST	49899	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.119158030 CEST	49899	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.119179010 CEST	443	49899	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.119189978 CEST	443	49899	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.121392012 CEST	443	49900	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.121539116 CEST	443	49900	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.121577978 CEST	443	49900	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.121599913 CEST	49900	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.121671915 CEST	49900	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.122050047 CEST	49904	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.122081995 CEST	443	49904	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.122134924 CEST	49904	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.122235060 CEST	49900	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.122235060 CEST	49900	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.122250080 CEST	443	49900	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.122258902 CEST	443	49900	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.122586966 CEST	49904	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.122601986 CEST	443	49904	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.124433041 CEST	49905	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.124460936 CEST	443	49905	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.124541044 CEST	49905	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.124656916 CEST	49905	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.124669075 CEST	443	49905	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.185659885 CEST	443	49901	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.185997009 CEST	443	49901	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.186156988 CEST	49901	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.186222076 CEST	49901	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.186222076 CEST	49901	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.186254025 CEST	443	49901	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.186278105 CEST	443	49901	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.189033985 CEST	49906	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.189064026 CEST	443	49906	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.189136982 CEST	49906	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.189524889 CEST	49906	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.189537048 CEST	443	49906	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.530023098 CEST	443	49903	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.530612946 CEST	49903	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.530631065 CEST	443	49903	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.531095028 CEST	49903	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.531100988 CEST	443	49903	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.537820101 CEST	443	49902	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.538152933 CEST	49902	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.538177013 CEST	443	49902	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.538503885 CEST	49902	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.538510084 CEST	443	49902	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.631488085 CEST	443	49903	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.631539106 CEST	443	49903	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.631678104 CEST	49903	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.631788015 CEST	49903	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.631788015 CEST	49903	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.631808996 CEST	443	49903	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.631815910 CEST	443	49903	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.634095907 CEST	49907	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.634145975 CEST	443	49907	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.634229898 CEST	49907	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.634341002 CEST	49907	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.634349108 CEST	443	49907	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.643425941 CEST	443	49902	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.643611908 CEST	443	49902	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.643649101 CEST	443	49902	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.643699884 CEST	49902	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.643699884 CEST	49902	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.643826008 CEST	49902	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.643846035 CEST	443	49902	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.643857002 CEST	49902	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.643862009 CEST	443	49902	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.645587921 CEST	49908	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.645654917 CEST	443	49908	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.645736933 CEST	49908	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.645837069 CEST	49908	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.645884991 CEST	443	49908	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.760299921 CEST	443	49904	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.760727882 CEST	49904	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.760754108 CEST	443	49904	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.761142015 CEST	49904	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.761148930 CEST	443	49904	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.785455942 CEST	443	49905	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.785837889 CEST	49905	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.785851002 CEST	443	49905	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.786209106 CEST	49905	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.786212921 CEST	443	49905	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.837743044 CEST	443	49906	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.838190079 CEST	49906	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.838205099 CEST	443	49906	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.838644028 CEST	49906	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.838649988 CEST	443	49906	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.871709108 CEST	443	49904	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.871742010 CEST	443	49904	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.871792078 CEST	443	49904	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.871861935 CEST	49904	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.872121096 CEST	49904	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.872136116 CEST	443	49904	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.872164011 CEST	49904	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.872169971 CEST	443	49904	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.874785900 CEST	49909	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.874825001 CEST	443	49909	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.874933958 CEST	49909	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.875108004 CEST	49909	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.875119925 CEST	443	49909	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.890959978 CEST	443	49905	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.891069889 CEST	443	49905	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.891267061 CEST	49905	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.891294003 CEST	49905	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.891294003 CEST	49905	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.891304016 CEST	443	49905	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.891311884 CEST	443	49905	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.893553019 CEST	49910	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.893573999 CEST	443	49910	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.893713951 CEST	49910	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.893749952 CEST	49910	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.893754005 CEST	443	49910	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.937376022 CEST	443	49906	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.937429905 CEST	443	49906	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.937511921 CEST	49906	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.937526941 CEST	443	49906	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.937544107 CEST	443	49906	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.937588930 CEST	49906	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.937681913 CEST	49906	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.937690973 CEST	443	49906	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.937700987 CEST	49906	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.937705040 CEST	443	49906	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.939548016 CEST	49911	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.939579010 CEST	443	49911	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:42.939659119 CEST	49911	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.939763069 CEST	49911	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:42.939775944 CEST	443	49911	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:43.283624887 CEST	443	49908	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:43.284240007 CEST	49908	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:43.284264088 CEST	443	49908	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:43.284699917 CEST	49908	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:43.284708977 CEST	443	49908	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:43.300750971 CEST	443	49907	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:43.303843021 CEST	49907	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:43.303883076 CEST	443	49907	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:43.304092884 CEST	49907	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:43.304100037 CEST	443	49907	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:43.382355928 CEST	443	49908	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:43.392599106 CEST	443	49908	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:43.392643929 CEST	443	49908	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:43.392673016 CEST	49908	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:43.392719984 CEST	49908	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:43.392776012 CEST	49908	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:43.392796993 CEST	443	49908	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:43.392811060 CEST	49908	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:43.392818928 CEST	443	49908	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:43.395207882 CEST	49912	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:43.395323038 CEST	443	49912	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:43.395438910 CEST	49912	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:43.395554066 CEST	49912	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:43.395576954 CEST	443	49912	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:43.407222033 CEST	443	49907	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:43.407241106 CEST	443	49907	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:43.407300949 CEST	49907	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:43.407320023 CEST	443	49907	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:43.407334089 CEST	443	49907	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:43.407375097 CEST	49907	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:43.407501936 CEST	49907	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:43.407515049 CEST	443	49907	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:43.407524109 CEST	49907	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:43.407531023 CEST	443	49907	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:43.409526110 CEST	49913	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:43.409562111 CEST	443	49913	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:43.409635067 CEST	49913	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:43.409729004 CEST	49913	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:43.409745932 CEST	443	49913	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:43.509845972 CEST	443	49909	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:43.512074947 CEST	49909	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:43.512094021 CEST	443	49909	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:43.512485027 CEST	49909	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:43.512489080 CEST	443	49909	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:43.538913012 CEST	443	49910	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:43.539350033 CEST	49910	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:43.539366007 CEST	443	49910	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:43.539736986 CEST	49910	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:43.539741993 CEST	443	49910	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:43.584441900 CEST	443	49911	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:43.584942102 CEST	49911	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:43.585002899 CEST	443	49911	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:43.585370064 CEST	49911	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:43.585385084 CEST	443	49911	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:43.608617067 CEST	443	49909	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:43.608819962 CEST	443	49909	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:43.609036922 CEST	49909	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:43.609080076 CEST	49909	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:43.609080076 CEST	49909	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:43.609101057 CEST	443	49909	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:43.609111071 CEST	443	49909	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:43.612118006 CEST	49914	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:43.612168074 CEST	443	49914	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:43.612368107 CEST	49914	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:43.612509012 CEST	49914	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:43.612518072 CEST	443	49914	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:43.638789892 CEST	443	49910	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:43.638818979 CEST	443	49910	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:43.638853073 CEST	443	49910	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:43.639014959 CEST	49910	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:43.639014959 CEST	49910	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:43.639095068 CEST	49910	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:43.639111042 CEST	443	49910	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:43.639121056 CEST	49910	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:43.639126062 CEST	443	49910	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:43.640870094 CEST	49915	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:43.640964985 CEST	443	49915	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:43.641060114 CEST	49915	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:43.641163111 CEST	49915	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:43.641184092 CEST	443	49915	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:43.687163115 CEST	443	49911	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:43.687338114 CEST	443	49911	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:43.687489986 CEST	49911	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:43.687489986 CEST	49911	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:43.687555075 CEST	49911	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:43.687580109 CEST	443	49911	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:43.689450979 CEST	49916	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:43.689479113 CEST	443	49916	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:43.689558983 CEST	49916	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:43.689668894 CEST	49916	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:43.689675093 CEST	443	49916	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.042808056 CEST	443	49913	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.044173002 CEST	49913	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:44.044209003 CEST	443	49913	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.045325041 CEST	49913	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:44.045331955 CEST	443	49913	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.055109024 CEST	443	49912	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.055444002 CEST	49912	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:44.055501938 CEST	443	49912	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.055756092 CEST	49912	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:44.055769920 CEST	443	49912	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.142146111 CEST	443	49913	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.142265081 CEST	443	49913	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.142354965 CEST	49913	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:44.142455101 CEST	49913	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:44.142455101 CEST	49913	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:44.142474890 CEST	443	49913	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.142483950 CEST	443	49913	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.144975901 CEST	49917	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:44.145035982 CEST	443	49917	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.145121098 CEST	49917	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:44.145251989 CEST	49917	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:44.145265102 CEST	443	49917	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.157994986 CEST	443	49912	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.158360958 CEST	443	49912	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.158390999 CEST	443	49912	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.158421040 CEST	49912	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:44.158473969 CEST	49912	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:44.158473969 CEST	49912	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:44.158474922 CEST	49912	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:44.160943031 CEST	49918	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:44.160965919 CEST	443	49918	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.161274910 CEST	49918	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:44.161276102 CEST	49918	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:44.161408901 CEST	443	49918	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.262151003 CEST	443	49914	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.262748003 CEST	49914	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:44.262758970 CEST	443	49914	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.262984037 CEST	49914	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:44.262989044 CEST	443	49914	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.285567045 CEST	443	49915	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.285824060 CEST	49915	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:44.285861969 CEST	443	49915	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.286119938 CEST	49915	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:44.286134005 CEST	443	49915	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.360620975 CEST	443	49916	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.360927105 CEST	49916	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:44.360949993 CEST	443	49916	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.361258030 CEST	49916	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:44.361262083 CEST	443	49916	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.364566088 CEST	443	49914	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.364681959 CEST	443	49914	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.364748955 CEST	49914	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:44.364761114 CEST	443	49914	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.364789009 CEST	443	49914	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.364867926 CEST	49914	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:44.364867926 CEST	49914	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:44.364924908 CEST	49914	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:44.364933968 CEST	443	49914	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.367134094 CEST	49919	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:44.367157936 CEST	443	49919	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.367221117 CEST	49919	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:44.367321014 CEST	49919	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:44.367324114 CEST	443	49919	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.389261961 CEST	443	49915	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.389296055 CEST	443	49915	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.389475107 CEST	49915	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:44.389622927 CEST	49915	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:44.389622927 CEST	49915	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:44.389662981 CEST	443	49915	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.389688969 CEST	443	49915	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.391419888 CEST	49920	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:44.391449928 CEST	443	49920	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.391597986 CEST	49920	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:44.393023968 CEST	49920	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:44.393035889 CEST	443	49920	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.469827890 CEST	49912	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:44.469892025 CEST	443	49912	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.654045105 CEST	443	49916	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.654118061 CEST	443	49916	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.654169083 CEST	49916	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:44.654182911 CEST	443	49916	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.654218912 CEST	443	49916	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.654268026 CEST	49916	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:44.654371023 CEST	49916	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:44.654383898 CEST	443	49916	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.654392004 CEST	49916	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:44.654396057 CEST	443	49916	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.656856060 CEST	49921	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:44.656920910 CEST	443	49921	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.657004118 CEST	49921	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:44.657139063 CEST	49921	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:44.657166004 CEST	443	49921	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.843146086 CEST	443	49918	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.843722105 CEST	49918	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:44.843786001 CEST	443	49918	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.844149113 CEST	49918	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:44.844165087 CEST	443	49918	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.849956989 CEST	443	49917	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.850511074 CEST	49917	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:44.850527048 CEST	443	49917	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.850871086 CEST	49917	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:44.850882053 CEST	443	49917	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.943860054 CEST	443	49918	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.943913937 CEST	443	49918	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.944097042 CEST	49918	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:44.944237947 CEST	49918	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:44.944237947 CEST	49918	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:44.944292068 CEST	443	49918	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.944323063 CEST	443	49918	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.947061062 CEST	49922	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:44.947160959 CEST	443	49922	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.947254896 CEST	49922	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:44.947408915 CEST	49922	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:44.947427988 CEST	443	49922	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.952965021 CEST	443	49917	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.953212976 CEST	443	49917	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.953275919 CEST	49917	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:44.953314066 CEST	49917	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:44.953314066 CEST	49917	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:44.953330040 CEST	443	49917	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.953349113 CEST	443	49917	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.955255032 CEST	49923	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:44.955287933 CEST	443	49923	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:44.955404997 CEST	49923	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:44.955530882 CEST	49923	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:44.955543041 CEST	443	49923	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.023370981 CEST	443	49919	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.023720026 CEST	49919	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:45.023739100 CEST	443	49919	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.024101973 CEST	49919	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:45.024106026 CEST	443	49919	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.042234898 CEST	443	49920	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.042944908 CEST	49920	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:45.042944908 CEST	49920	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:45.042963982 CEST	443	49920	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.042982101 CEST	443	49920	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.123604059 CEST	443	49919	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.123951912 CEST	443	49919	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.124001980 CEST	49919	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:45.124011040 CEST	443	49919	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.124052048 CEST	443	49919	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.124083996 CEST	49919	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:45.124102116 CEST	443	49919	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.124113083 CEST	49919	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:45.124113083 CEST	49919	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:45.124119997 CEST	443	49919	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.124126911 CEST	443	49919	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.128981113 CEST	49924	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:45.129082918 CEST	443	49924	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.129173040 CEST	49924	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:45.129278898 CEST	49924	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:45.129298925 CEST	443	49924	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.143043995 CEST	443	49920	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.143323898 CEST	443	49920	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.143425941 CEST	49920	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:45.143425941 CEST	49920	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:45.143459082 CEST	49920	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:45.143475056 CEST	443	49920	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.146995068 CEST	49925	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:45.147012949 CEST	443	49925	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.147063017 CEST	49925	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:45.147308111 CEST	49925	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:45.147319078 CEST	443	49925	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.320776939 CEST	443	49921	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.321207047 CEST	49921	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:45.321219921 CEST	443	49921	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.321609020 CEST	49921	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:45.321614027 CEST	443	49921	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.422214031 CEST	443	49921	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.422396898 CEST	443	49921	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.422508955 CEST	49921	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:45.422508955 CEST	49921	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:45.422573090 CEST	49921	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:45.422600985 CEST	443	49921	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.425436974 CEST	49926	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:45.425470114 CEST	443	49926	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.425534964 CEST	49926	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:45.425789118 CEST	49926	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:45.425801039 CEST	443	49926	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.580297947 CEST	443	49922	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.580862999 CEST	49922	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:45.580950975 CEST	443	49922	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.586731911 CEST	49922	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:45.586747885 CEST	443	49922	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.601768970 CEST	443	49923	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.602085114 CEST	49923	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:45.602101088 CEST	443	49923	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.603404045 CEST	49923	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:45.603410006 CEST	443	49923	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.681912899 CEST	443	49922	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.682071924 CEST	443	49922	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.682104111 CEST	443	49922	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.682153940 CEST	49922	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:45.682209969 CEST	49922	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:45.682296038 CEST	49922	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:45.682329893 CEST	443	49922	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.682379961 CEST	49922	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:45.682396889 CEST	443	49922	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.684509993 CEST	49927	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:45.684609890 CEST	443	49927	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.684705973 CEST	49927	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:45.684817076 CEST	49927	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:45.684837103 CEST	443	49927	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.702693939 CEST	443	49923	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.702872992 CEST	443	49923	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.702980995 CEST	49923	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:45.702981949 CEST	49923	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:45.703002930 CEST	49923	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:45.703012943 CEST	443	49923	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.704677105 CEST	49928	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:45.704701900 CEST	443	49928	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.704757929 CEST	49928	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:45.704854012 CEST	49928	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:45.704862118 CEST	443	49928	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.778394938 CEST	443	49924	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.778789997 CEST	49924	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:45.778856993 CEST	443	49924	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.779201984 CEST	49924	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:45.779220104 CEST	443	49924	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.794766903 CEST	443	49925	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.795039892 CEST	49925	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:45.795058966 CEST	443	49925	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.795396090 CEST	49925	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:45.795399904 CEST	443	49925	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.882294893 CEST	443	49924	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.882365942 CEST	443	49924	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.882539034 CEST	443	49924	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.882639885 CEST	49924	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:45.882639885 CEST	49924	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:45.882639885 CEST	49924	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:45.882639885 CEST	49924	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:45.882742882 CEST	443	49924	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.884996891 CEST	49929	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:45.885071993 CEST	443	49929	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.885165930 CEST	49929	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:45.885293007 CEST	49929	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:45.885318995 CEST	443	49929	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.896676064 CEST	443	49925	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.896842957 CEST	443	49925	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.896903992 CEST	49925	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:45.897061110 CEST	49925	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:45.897061110 CEST	49925	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:45.897074938 CEST	443	49925	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.897083044 CEST	443	49925	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.898627996 CEST	49930	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:45.898639917 CEST	443	49930	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:45.898725986 CEST	49930	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:45.898818970 CEST	49930	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:45.898829937 CEST	443	49930	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:46.092052937 CEST	443	49926	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:46.092540979 CEST	49926	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:46.092565060 CEST	443	49926	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:46.092959881 CEST	49926	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:46.092964888 CEST	443	49926	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:46.188541889 CEST	49924	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:46.188566923 CEST	443	49924	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:46.195219040 CEST	443	49926	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:46.195421934 CEST	443	49926	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:46.195488930 CEST	49926	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:46.195540905 CEST	49926	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:46.195552111 CEST	443	49926	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:46.195559025 CEST	49926	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:46.195564032 CEST	443	49926	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:46.197968006 CEST	49931	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:46.198002100 CEST	443	49931	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:46.198074102 CEST	49931	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:46.198180914 CEST	49931	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:46.198185921 CEST	443	49931	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:46.328721046 CEST	443	49927	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:46.329164982 CEST	49927	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:46.329206944 CEST	443	49927	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:46.329603910 CEST	49927	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:46.329621077 CEST	443	49927	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:46.353543043 CEST	443	49928	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:46.353836060 CEST	49928	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:46.353849888 CEST	443	49928	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:46.354226112 CEST	49928	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:46.354229927 CEST	443	49928	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:46.428507090 CEST	443	49927	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:46.428525925 CEST	443	49927	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:46.428555012 CEST	443	49927	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:46.428575039 CEST	49927	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:46.428608894 CEST	49927	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:46.428781986 CEST	49927	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:46.428796053 CEST	443	49927	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:46.428805113 CEST	49927	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:46.428809881 CEST	443	49927	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:46.431257963 CEST	49932	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:46.431282997 CEST	443	49932	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:46.431363106 CEST	49932	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:46.431484938 CEST	49932	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:46.431490898 CEST	443	49932	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:46.456089973 CEST	443	49928	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:46.456209898 CEST	443	49928	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:46.456263065 CEST	49928	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:46.456284046 CEST	49928	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:46.456293106 CEST	443	49928	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:46.456302881 CEST	49928	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:46.456306934 CEST	443	49928	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:46.458060026 CEST	49933	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:46.458120108 CEST	443	49933	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:46.458197117 CEST	49933	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:46.458296061 CEST	49933	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:46.458312988 CEST	443	49933	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:46.542061090 CEST	443	49930	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:46.542398930 CEST	49930	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:46.542414904 CEST	443	49930	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:46.542756081 CEST	49930	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:46.542762995 CEST	443	49930	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:46.550697088 CEST	443	49929	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:46.550920963 CEST	49929	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:46.550930977 CEST	443	49929	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:46.551208973 CEST	49929	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:46.551214933 CEST	443	49929	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:46.643307924 CEST	443	49930	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:46.643379927 CEST	443	49930	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:46.643440962 CEST	49930	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:46.643469095 CEST	443	49930	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:46.643526077 CEST	443	49930	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:46.643578053 CEST	49930	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:46.643651962 CEST	49930	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:46.643668890 CEST	443	49930	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:46.643681049 CEST	49930	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:46.643688917 CEST	443	49930	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:46.646230936 CEST	49934	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:46.646255970 CEST	443	49934	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:46.646332979 CEST	49934	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:46.646462917 CEST	49934	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:46.646466970 CEST	443	49934	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:46.652899027 CEST	443	49929	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:46.653434038 CEST	443	49929	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:46.653497934 CEST	49929	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:46.653538942 CEST	49929	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:46.653538942 CEST	49929	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:46.653553009 CEST	443	49929	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:46.653567076 CEST	443	49929	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:46.655328035 CEST	49935	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:46.655361891 CEST	443	49935	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:46.655431032 CEST	49935	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:46.655545950 CEST	49935	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:46.655555964 CEST	443	49935	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.032310963 CEST	443	49931	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.032789946 CEST	49931	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.032804966 CEST	443	49931	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.033221006 CEST	49931	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.033229113 CEST	443	49931	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.064004898 CEST	443	49932	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.064450026 CEST	49932	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.064460039 CEST	443	49932	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.064846992 CEST	49932	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.064851046 CEST	443	49932	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.103375912 CEST	443	49933	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.103724957 CEST	49933	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.103748083 CEST	443	49933	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.104104042 CEST	49933	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.104109049 CEST	443	49933	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.131639957 CEST	443	49931	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.131779909 CEST	443	49931	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.131841898 CEST	49931	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.131895065 CEST	49931	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.131916046 CEST	443	49931	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.131946087 CEST	49931	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.131951094 CEST	443	49931	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.134645939 CEST	49936	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.134675980 CEST	443	49936	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.134747028 CEST	49936	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.134874105 CEST	49936	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.134895086 CEST	443	49936	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.162497997 CEST	443	49932	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.162712097 CEST	443	49932	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.162760019 CEST	49932	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.162769079 CEST	443	49932	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.162781000 CEST	443	49932	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.162827015 CEST	49932	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.162890911 CEST	49932	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.162904978 CEST	443	49932	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.162914991 CEST	49932	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.162919044 CEST	443	49932	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.165045023 CEST	49937	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.165096045 CEST	443	49937	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.165168047 CEST	49937	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.165297031 CEST	49937	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.165304899 CEST	443	49937	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.204185009 CEST	443	49933	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.204310894 CEST	443	49933	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.204356909 CEST	49933	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.204395056 CEST	49933	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.204395056 CEST	49933	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.204416037 CEST	443	49933	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.204425097 CEST	443	49933	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.206176996 CEST	49938	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.206279993 CEST	443	49938	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.206368923 CEST	49938	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.206471920 CEST	49938	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.206515074 CEST	443	49938	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.493192911 CEST	443	49935	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.493607998 CEST	49935	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.493614912 CEST	443	49935	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.494189978 CEST	49935	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.494194031 CEST	443	49935	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.499330044 CEST	443	49934	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.499615908 CEST	49934	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.499638081 CEST	443	49934	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.499973059 CEST	49934	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.499978065 CEST	443	49934	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.592590094 CEST	443	49935	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.592673063 CEST	443	49935	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.592741013 CEST	49935	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.592833996 CEST	49935	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.592849970 CEST	443	49935	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.592859030 CEST	49935	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.592864037 CEST	443	49935	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.595324039 CEST	49939	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.595351934 CEST	443	49939	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.595418930 CEST	49939	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.595513105 CEST	49939	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.595516920 CEST	443	49939	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.596599102 CEST	443	49934	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.596772909 CEST	443	49934	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.596842051 CEST	49934	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.596879005 CEST	49934	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.596879005 CEST	49934	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.596894026 CEST	443	49934	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.596901894 CEST	443	49934	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.598562002 CEST	49940	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.598634958 CEST	443	49940	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.598716021 CEST	49940	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.598825932 CEST	49940	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.598862886 CEST	443	49940	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.778666973 CEST	443	49936	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.779161930 CEST	49936	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.779179096 CEST	443	49936	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.779659033 CEST	49936	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.779664040 CEST	443	49936	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.811897039 CEST	443	49937	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.812570095 CEST	49937	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.812647104 CEST	443	49937	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.812794924 CEST	49937	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.812812090 CEST	443	49937	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.850183010 CEST	443	49938	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.850661993 CEST	49938	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.850691080 CEST	443	49938	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.850915909 CEST	49938	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.850923061 CEST	443	49938	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.878576994 CEST	443	49936	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.878638983 CEST	443	49936	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.878694057 CEST	49936	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.878705025 CEST	443	49936	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.878739119 CEST	443	49936	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.878788948 CEST	49936	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.878890038 CEST	49936	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.878902912 CEST	443	49936	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.878911972 CEST	49936	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.878916025 CEST	443	49936	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.882189989 CEST	49941	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.882219076 CEST	443	49941	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.882306099 CEST	49941	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.882615089 CEST	49941	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.882622957 CEST	443	49941	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.914690971 CEST	443	49937	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.914930105 CEST	443	49937	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.915086031 CEST	49937	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.915086031 CEST	49937	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.915086031 CEST	49937	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.918350935 CEST	49942	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.918368101 CEST	443	49942	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.918528080 CEST	49942	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.918528080 CEST	49942	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.918550014 CEST	443	49942	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.948998928 CEST	443	49938	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.949131012 CEST	443	49938	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.949161053 CEST	443	49938	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.949328899 CEST	49938	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.949328899 CEST	49938	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.949330091 CEST	49938	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.949330091 CEST	49938	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.950965881 CEST	49943	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.951033115 CEST	443	49943	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:47.951112032 CEST	49943	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.951211929 CEST	49943	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:47.951231956 CEST	443	49943	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:48.219785929 CEST	49937	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:48.219866037 CEST	443	49937	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:48.251209974 CEST	49938	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:48.251240015 CEST	443	49938	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:48.252003908 CEST	443	49940	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:48.252445936 CEST	49940	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:48.252489090 CEST	443	49940	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:48.252854109 CEST	49940	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:48.252866983 CEST	443	49940	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:48.261236906 CEST	443	49939	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:48.261470079 CEST	49939	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:48.261492014 CEST	443	49939	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:48.261746883 CEST	49939	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:48.261750937 CEST	443	49939	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:48.357369900 CEST	443	49940	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:48.357470036 CEST	443	49940	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:48.357573986 CEST	49940	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:48.357589960 CEST	443	49940	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:48.357654095 CEST	49940	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:48.357758045 CEST	49940	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:48.357795000 CEST	443	49940	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:48.357825041 CEST	49940	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:48.357841015 CEST	443	49940	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:48.360105991 CEST	49945	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:48.360136986 CEST	443	49945	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:48.360213041 CEST	49945	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:48.360336065 CEST	49945	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:48.360352039 CEST	443	49945	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:48.364214897 CEST	443	49939	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:48.364453077 CEST	443	49939	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:48.364511967 CEST	49939	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:48.364536047 CEST	49939	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:48.364536047 CEST	49939	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:48.364547014 CEST	443	49939	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:48.364553928 CEST	443	49939	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:48.366156101 CEST	49946	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:48.366172075 CEST	443	49946	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:48.366233110 CEST	49946	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:48.366322041 CEST	49946	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:48.366327047 CEST	443	49946	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:48.610662937 CEST	443	49941	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:48.611387968 CEST	49941	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:48.611398935 CEST	443	49941	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:48.611419916 CEST	49941	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:48.611424923 CEST	443	49941	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:48.948462963 CEST	443	49941	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:48.948640108 CEST	443	49941	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:48.948719025 CEST	49941	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:48.948776960 CEST	49941	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:48.948776960 CEST	49941	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:48.948791027 CEST	443	49941	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:48.948797941 CEST	443	49941	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:48.949839115 CEST	443	49942	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:48.950180054 CEST	49942	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:48.950189114 CEST	443	49942	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:48.950592041 CEST	49942	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:48.950596094 CEST	443	49942	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:48.950839996 CEST	443	49943	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:48.951155901 CEST	49943	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:48.951194048 CEST	443	49943	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:48.951440096 CEST	49947	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:48.951478958 CEST	49943	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:48.951493025 CEST	443	49943	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:48.951538086 CEST	443	49947	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:48.951627016 CEST	49947	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:48.951742887 CEST	49947	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:48.951766968 CEST	443	49947	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.050889015 CEST	443	49942	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.051160097 CEST	443	49942	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.051244020 CEST	49942	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.051244020 CEST	49942	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.051278114 CEST	49942	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.051292896 CEST	443	49942	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.053359985 CEST	443	49943	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.053483963 CEST	49948	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.053566933 CEST	443	49948	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.053652048 CEST	49948	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.053771019 CEST	49948	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.053787947 CEST	443	49948	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.053828001 CEST	443	49943	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.053920984 CEST	49943	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.053921938 CEST	49943	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.053921938 CEST	49943	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.055586100 CEST	49949	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.055628061 CEST	443	49949	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.055696011 CEST	49949	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.055804968 CEST	49949	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.055814981 CEST	443	49949	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.132744074 CEST	443	49945	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.133043051 CEST	49945	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.133057117 CEST	443	49945	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.133418083 CEST	49945	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.133424044 CEST	443	49945	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.134428024 CEST	443	49946	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.134679079 CEST	49946	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.134685993 CEST	443	49946	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.134963036 CEST	49946	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.134965897 CEST	443	49946	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.231117010 CEST	443	49945	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.231179953 CEST	443	49945	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.231223106 CEST	49945	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.231231928 CEST	443	49945	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.231276989 CEST	443	49945	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.231322050 CEST	49945	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.231471062 CEST	49945	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.231489897 CEST	443	49945	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.231498003 CEST	49945	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.231502056 CEST	443	49945	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.234935999 CEST	49950	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.234975100 CEST	443	49950	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.235025883 CEST	49950	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.235162973 CEST	49950	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.235168934 CEST	443	49950	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.235188007 CEST	443	49946	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.235367060 CEST	443	49946	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.235399008 CEST	49946	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.235584021 CEST	49946	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.235594988 CEST	443	49946	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.235605955 CEST	49946	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.235611916 CEST	443	49946	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.238178015 CEST	49951	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.238233089 CEST	443	49951	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.238302946 CEST	49951	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.238545895 CEST	49951	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.238560915 CEST	443	49951	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.360600948 CEST	49943	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.360651016 CEST	443	49943	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.586597919 CEST	443	49947	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.587054014 CEST	49947	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.587088108 CEST	443	49947	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.587447882 CEST	49947	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.587457895 CEST	443	49947	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.687120914 CEST	443	49947	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.687328100 CEST	443	49947	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.687432051 CEST	49947	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.687477112 CEST	49947	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.687477112 CEST	49947	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.687498093 CEST	443	49947	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.687510014 CEST	443	49947	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.690782070 CEST	49952	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.690907001 CEST	443	49952	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.691001892 CEST	49952	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.691108942 CEST	49952	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.691129923 CEST	443	49952	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.695671082 CEST	443	49948	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.696028948 CEST	49948	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.696115971 CEST	443	49948	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.696400881 CEST	49948	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.696407080 CEST	443	49949	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.696422100 CEST	443	49948	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.696640015 CEST	49949	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.696661949 CEST	443	49949	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.696916103 CEST	49949	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.696923018 CEST	443	49949	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.795253992 CEST	443	49948	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.795631886 CEST	443	49948	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.795694113 CEST	49948	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.795731068 CEST	49948	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.795731068 CEST	49948	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.795752048 CEST	443	49948	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.795763016 CEST	443	49948	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.796145916 CEST	443	49949	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.796219110 CEST	443	49949	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.796262980 CEST	49949	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.796327114 CEST	49949	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.796341896 CEST	443	49949	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.796355009 CEST	49949	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.796361923 CEST	443	49949	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.798902988 CEST	49953	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.798928976 CEST	443	49953	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.798995018 CEST	49953	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.799623013 CEST	49954	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.799632072 CEST	443	49954	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.799688101 CEST	49954	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.799726963 CEST	49953	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.799737930 CEST	443	49953	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.799803019 CEST	49954	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.799815893 CEST	443	49954	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.889863968 CEST	443	49950	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.890278101 CEST	49950	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.890309095 CEST	443	49950	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.890656948 CEST	49950	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.890662909 CEST	443	49950	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.901967049 CEST	443	49951	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.902232885 CEST	49951	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.902260065 CEST	443	49951	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.902513027 CEST	49951	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.902518988 CEST	443	49951	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.989658117 CEST	443	49950	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.989862919 CEST	443	49950	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.989924908 CEST	49950	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.989964008 CEST	49950	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.989964008 CEST	49950	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.989985943 CEST	443	49950	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.989996910 CEST	443	49950	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.991906881 CEST	49955	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.991940975 CEST	443	49955	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:49.992017984 CEST	49955	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.992135048 CEST	49955	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:49.992141008 CEST	443	49955	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:50.006472111 CEST	443	49951	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:50.006654978 CEST	443	49951	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:50.006716967 CEST	49951	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:50.006756067 CEST	49951	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:50.006768942 CEST	443	49951	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:50.006779909 CEST	49951	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:50.006786108 CEST	443	49951	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:50.008378983 CEST	49956	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:50.008418083 CEST	443	49956	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:50.008492947 CEST	49956	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:50.008604050 CEST	49956	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:50.008620024 CEST	443	49956	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:50.337295055 CEST	443	49952	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:50.337724924 CEST	49952	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:50.337748051 CEST	443	49952	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:50.338135958 CEST	49952	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:50.338141918 CEST	443	49952	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:50.621877909 CEST	443	49952	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:50.622029066 CEST	443	49952	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:50.622162104 CEST	49952	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:50.622198105 CEST	49952	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:50.622199059 CEST	49952	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:50.622222900 CEST	443	49952	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:50.622236967 CEST	443	49952	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:50.623626947 CEST	443	49954	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:50.624473095 CEST	443	49953	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:50.624569893 CEST	49957	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:50.624594927 CEST	443	49957	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:50.624650955 CEST	49957	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:50.624797106 CEST	49954	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:50.624816895 CEST	443	49954	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:50.624888897 CEST	49953	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:50.624895096 CEST	443	49953	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:50.625183105 CEST	49954	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:50.625188112 CEST	443	49954	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:50.625266075 CEST	49953	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:50.625271082 CEST	443	49953	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:50.625283003 CEST	49957	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:50.625296116 CEST	443	49957	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:50.722899914 CEST	443	49954	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:50.723340034 CEST	443	49954	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:50.723378897 CEST	443	49954	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:50.723448992 CEST	49954	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:50.725003958 CEST	443	49953	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:50.725442886 CEST	443	49953	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:50.725522041 CEST	49953	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:50.726793051 CEST	49954	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:50.726818085 CEST	443	49954	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:50.726831913 CEST	49954	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:50.726840019 CEST	443	49954	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:50.727304935 CEST	49953	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:50.727313042 CEST	443	49953	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:50.727324963 CEST	49953	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:50.727332115 CEST	443	49953	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:50.729640961 CEST	49958	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:50.729667902 CEST	443	49958	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:50.729696035 CEST	49959	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:50.729732037 CEST	49958	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:50.729737997 CEST	443	49959	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:50.729792118 CEST	49959	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:50.729847908 CEST	49958	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:50.729856968 CEST	443	49958	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:50.729933977 CEST	49959	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:50.729954004 CEST	443	49959	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:50.804327965 CEST	443	49956	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:50.804722071 CEST	49956	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:50.804752111 CEST	443	49956	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:50.805113077 CEST	49956	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:50.805119991 CEST	443	49956	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:50.810831070 CEST	443	49955	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:50.811065912 CEST	49955	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:50.811084986 CEST	443	49955	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:50.811351061 CEST	49955	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:50.811357975 CEST	443	49955	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:50.912239075 CEST	443	49956	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:50.912286997 CEST	443	49956	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:50.912353039 CEST	49956	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:50.912492037 CEST	49956	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:50.912508011 CEST	443	49956	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:50.912519932 CEST	49956	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:50.912527084 CEST	443	49956	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:50.913083076 CEST	443	49955	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:50.913549900 CEST	443	49955	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:50.913608074 CEST	49955	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:50.913623095 CEST	443	49955	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:50.913651943 CEST	443	49955	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:50.913702011 CEST	49955	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:50.913702011 CEST	49955	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:50.913732052 CEST	49955	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:50.913744926 CEST	443	49955	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:50.915474892 CEST	49960	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:50.915565014 CEST	443	49960	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:50.915641069 CEST	49960	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:50.915864944 CEST	49960	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:50.915903091 CEST	443	49960	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:50.916261911 CEST	49961	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:50.916301012 CEST	443	49961	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:50.916450977 CEST	49961	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:50.916450977 CEST	49961	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:50.916485071 CEST	443	49961	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:51.266474962 CEST	443	49957	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:51.267024040 CEST	49957	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:51.267041922 CEST	443	49957	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:51.267431021 CEST	49957	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:51.267435074 CEST	443	49957	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:51.365504980 CEST	443	49957	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:51.365677118 CEST	443	49957	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:51.365744114 CEST	49957	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:51.365751982 CEST	443	49957	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:51.365770102 CEST	443	49957	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:51.365816116 CEST	49957	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:51.365852118 CEST	49957	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:51.365865946 CEST	443	49957	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:51.365875006 CEST	49957	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:51.365880966 CEST	443	49957	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:51.368815899 CEST	49962	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:51.368848085 CEST	443	49962	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:51.368995905 CEST	49962	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:51.369153976 CEST	49962	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:51.369159937 CEST	443	49962	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:51.370500088 CEST	443	49958	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:51.370753050 CEST	49958	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:51.370760918 CEST	443	49958	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:51.371092081 CEST	49958	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:51.371095896 CEST	443	49958	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:51.381634951 CEST	443	49959	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:51.381963015 CEST	49959	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:51.381990910 CEST	443	49959	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:51.382316113 CEST	49959	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:51.382322073 CEST	443	49959	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:51.472830057 CEST	443	49958	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:51.472898960 CEST	443	49958	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:51.472944975 CEST	49958	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:51.473073006 CEST	49958	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:51.473092079 CEST	443	49958	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:51.473107100 CEST	49958	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:51.473110914 CEST	443	49958	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:51.475574017 CEST	49963	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:51.475646019 CEST	443	49963	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:51.475722075 CEST	49963	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:51.475842953 CEST	49963	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:51.475858927 CEST	443	49963	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:51.484821081 CEST	443	49959	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:51.485244036 CEST	443	49959	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:51.485294104 CEST	49959	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:51.485320091 CEST	49959	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:51.485320091 CEST	49959	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:51.485336065 CEST	443	49959	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:51.485346079 CEST	443	49959	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:51.487046003 CEST	49964	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:51.487078905 CEST	443	49964	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:51.487129927 CEST	49964	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:51.487236023 CEST	49964	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:51.487248898 CEST	443	49964	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:51.557981014 CEST	443	49960	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:51.558327913 CEST	49960	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:51.558372974 CEST	443	49960	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:51.558705091 CEST	49960	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:51.558717012 CEST	443	49960	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:51.562459946 CEST	443	49961	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:51.563066959 CEST	49961	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:51.563066959 CEST	49961	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:51.563081026 CEST	443	49961	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:51.563100100 CEST	443	49961	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:51.658018112 CEST	443	49960	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:51.658274889 CEST	443	49960	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:51.658348083 CEST	49960	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:51.658396959 CEST	49960	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:51.658396959 CEST	49960	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:51.658425093 CEST	443	49960	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:51.658447981 CEST	443	49960	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:51.660211086 CEST	49965	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:51.660252094 CEST	443	49965	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:51.660322905 CEST	49965	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:51.660434961 CEST	49965	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:51.660439968 CEST	443	49965	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:51.664798021 CEST	443	49961	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:51.664922953 CEST	443	49961	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:51.664990902 CEST	49961	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:51.665008068 CEST	443	49961	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:51.665038109 CEST	443	49961	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:51.665096045 CEST	49961	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:51.665122032 CEST	49961	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:51.665122032 CEST	49961	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:51.665138006 CEST	443	49961	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:51.665148973 CEST	443	49961	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:51.666729927 CEST	49966	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:51.666778088 CEST	443	49966	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:51.666848898 CEST	49966	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:51.666964054 CEST	49966	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:51.666979074 CEST	443	49966	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.016145945 CEST	443	49962	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.017199993 CEST	49962	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.017199993 CEST	49962	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.017214060 CEST	443	49962	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.017256021 CEST	443	49962	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.113640070 CEST	443	49962	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.113800049 CEST	443	49962	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.113950014 CEST	49962	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.114085913 CEST	49962	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.114085913 CEST	49962	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.114101887 CEST	443	49962	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.114113092 CEST	443	49962	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.114237070 CEST	443	49963	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.114562988 CEST	49963	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.114603043 CEST	443	49963	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.115053892 CEST	49963	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.115066051 CEST	443	49963	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.116528988 CEST	49967	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.116580009 CEST	443	49967	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.116657972 CEST	49967	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.116797924 CEST	49967	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.116807938 CEST	443	49967	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.120800972 CEST	443	49964	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.121066093 CEST	49964	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.121078014 CEST	443	49964	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.121396065 CEST	49964	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.121401072 CEST	443	49964	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.213125944 CEST	443	49963	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.213255882 CEST	443	49963	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.213323116 CEST	49963	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.213463068 CEST	49963	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.213500977 CEST	443	49963	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.213530064 CEST	49963	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.213546038 CEST	443	49963	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.217302084 CEST	49968	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.217333078 CEST	443	49968	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.217391968 CEST	49968	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.217614889 CEST	49968	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.217623949 CEST	443	49968	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.221110106 CEST	443	49964	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.221124887 CEST	443	49964	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.221168041 CEST	49964	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.221189976 CEST	443	49964	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.221266031 CEST	443	49964	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.221307993 CEST	49964	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.221472979 CEST	49964	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.221484900 CEST	443	49964	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.221493006 CEST	49964	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.221497059 CEST	443	49964	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.224328995 CEST	49969	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.224386930 CEST	443	49969	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.224462032 CEST	49969	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.224744081 CEST	49969	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.224771023 CEST	443	49969	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.456080914 CEST	443	49965	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.460810900 CEST	443	49966	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.501044989 CEST	49965	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.516732931 CEST	49966	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.542937994 CEST	49965	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.542953968 CEST	443	49965	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.543349028 CEST	49965	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.543354034 CEST	443	49965	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.546355963 CEST	49966	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.546367884 CEST	443	49966	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.549832106 CEST	49966	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.549837112 CEST	443	49966	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.642067909 CEST	443	49965	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.642116070 CEST	443	49965	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.642168045 CEST	49965	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.642388105 CEST	49965	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.642407894 CEST	443	49965	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.642420053 CEST	49965	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.642425060 CEST	443	49965	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.645571947 CEST	49970	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.645627975 CEST	443	49970	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.645700932 CEST	49970	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.645808935 CEST	49970	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.645854950 CEST	443	49970	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.649133921 CEST	443	49966	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.649184942 CEST	443	49966	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.649245024 CEST	49966	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.649255037 CEST	443	49966	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.649301052 CEST	443	49966	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.649348974 CEST	49966	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.650887966 CEST	49966	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.650891066 CEST	443	49966	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.650901079 CEST	49966	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.650903940 CEST	443	49966	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.653033018 CEST	49971	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.653059959 CEST	443	49971	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.653111935 CEST	49971	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.653206110 CEST	49971	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.653215885 CEST	443	49971	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.769320965 CEST	443	49967	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.769979000 CEST	49967	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.769995928 CEST	443	49967	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.770375967 CEST	49967	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.770379066 CEST	443	49967	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.872998953 CEST	443	49968	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.873395920 CEST	49968	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.873415947 CEST	443	49968	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.873780966 CEST	49968	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.873784065 CEST	443	49968	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.898655891 CEST	443	49967	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.898701906 CEST	443	49967	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.898760080 CEST	49967	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.898792982 CEST	443	49967	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.898891926 CEST	49967	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.898912907 CEST	443	49967	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.898926973 CEST	49967	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.899259090 CEST	443	49967	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.899336100 CEST	443	49967	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.899404049 CEST	49967	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.901135921 CEST	49972	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.901181936 CEST	443	49972	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.901267052 CEST	49972	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.901365042 CEST	49972	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.901371956 CEST	443	49972	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.973556042 CEST	443	49968	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.973579884 CEST	443	49968	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.973639011 CEST	49968	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.973651886 CEST	443	49968	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.973664999 CEST	443	49968	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.973721027 CEST	49968	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.973906994 CEST	49968	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.973923922 CEST	443	49968	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.973933935 CEST	49968	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.973938942 CEST	443	49968	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.976416111 CEST	49973	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.976497889 CEST	443	49973	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:52.976650953 CEST	49973	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.976747990 CEST	49973	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:52.976768017 CEST	443	49973	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:53.108067989 CEST	443	49969	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:53.108522892 CEST	49969	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:53.108586073 CEST	443	49969	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:53.108889103 CEST	49969	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:53.108902931 CEST	443	49969	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:53.225171089 CEST	443	49969	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:53.225189924 CEST	443	49969	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:53.225261927 CEST	49969	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:53.225303888 CEST	443	49969	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:53.225362062 CEST	443	49969	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:53.225420952 CEST	49969	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:53.225462914 CEST	49969	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:53.225462914 CEST	49969	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:53.225498915 CEST	443	49969	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:53.225522041 CEST	443	49969	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:53.228454113 CEST	49974	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:53.228529930 CEST	443	49974	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:53.228622913 CEST	49974	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:53.228748083 CEST	49974	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:53.228768110 CEST	443	49974	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:53.292371988 CEST	443	49970	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:53.292726994 CEST	49970	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:53.292743921 CEST	443	49970	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:53.293350935 CEST	49970	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:53.293355942 CEST	443	49970	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:53.331243038 CEST	443	49971	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:53.331649065 CEST	49971	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:53.331660032 CEST	443	49971	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:53.331998110 CEST	49971	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:53.332001925 CEST	443	49971	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:53.394162893 CEST	443	49970	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:53.394217014 CEST	443	49970	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:53.394270897 CEST	49970	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:53.394361019 CEST	49970	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:53.394372940 CEST	443	49970	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:53.394382954 CEST	49970	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:53.394387960 CEST	443	49970	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:53.396524906 CEST	49975	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:53.396568060 CEST	443	49975	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:53.396656036 CEST	49975	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:53.396749020 CEST	49975	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:53.396755934 CEST	443	49975	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:53.435291052 CEST	443	49971	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:53.435477018 CEST	443	49971	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:53.435729980 CEST	49971	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:53.435782909 CEST	49971	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:53.435796022 CEST	443	49971	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:53.435807943 CEST	49971	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:53.435812950 CEST	443	49971	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:53.437747002 CEST	49976	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:53.437792063 CEST	443	49976	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:53.437882900 CEST	49976	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:53.437979937 CEST	49976	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:53.437988997 CEST	443	49976	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:53.546155930 CEST	443	49973	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:53.546649933 CEST	49973	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:53.546665907 CEST	443	49973	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:53.547276974 CEST	49973	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:53.547282934 CEST	443	49973	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:53.569943905 CEST	443	49972	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:53.570262909 CEST	49972	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:53.570281982 CEST	443	49972	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:53.570797920 CEST	49972	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:53.570802927 CEST	443	49972	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:53.646799088 CEST	443	49973	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:53.646923065 CEST	443	49973	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:53.647006035 CEST	49973	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:53.647247076 CEST	49973	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:53.647264004 CEST	443	49973	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:53.647278070 CEST	49973	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:53.647284985 CEST	443	49973	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:53.649959087 CEST	49977	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:53.650006056 CEST	443	49977	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:53.650095940 CEST	49977	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:53.650211096 CEST	49977	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:53.650218010 CEST	443	49977	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:53.671504974 CEST	443	49972	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:53.671840906 CEST	443	49972	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:53.671912909 CEST	49972	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:53.671953917 CEST	49972	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:53.671969891 CEST	443	49972	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:53.671986103 CEST	49972	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:53.671993971 CEST	443	49972	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:53.674242973 CEST	49978	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:53.674256086 CEST	443	49978	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:53.674344063 CEST	49978	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:53.674566031 CEST	49978	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:53.674581051 CEST	443	49978	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:53.793740988 CEST	443	49974	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:53.794146061 CEST	49974	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:53.794162035 CEST	443	49974	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:53.794503927 CEST	49974	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:53.794511080 CEST	443	49974	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:53.894393921 CEST	443	49974	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:53.894418955 CEST	443	49974	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:53.894484043 CEST	443	49974	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:53.894597054 CEST	49974	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:53.894597054 CEST	49974	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:53.894721031 CEST	49974	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:53.894745111 CEST	443	49974	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:53.894757032 CEST	49974	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:53.894766092 CEST	443	49974	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:53.897844076 CEST	49979	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:53.897886992 CEST	443	49979	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:53.897972107 CEST	49979	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:53.898231030 CEST	49979	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:53.898237944 CEST	443	49979	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.042015076 CEST	443	49975	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.042690039 CEST	49975	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:54.042714119 CEST	443	49975	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.043081045 CEST	49975	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:54.043086052 CEST	443	49975	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.079125881 CEST	443	49976	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.079633951 CEST	49976	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:54.079655886 CEST	443	49976	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.080172062 CEST	49976	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:54.080176115 CEST	443	49976	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.141573906 CEST	443	49975	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.141597986 CEST	443	49975	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.141705036 CEST	49975	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:54.141727924 CEST	443	49975	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.141741037 CEST	443	49975	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.141783953 CEST	49975	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:54.142288923 CEST	49975	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:54.142301083 CEST	443	49975	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.142333984 CEST	49975	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:54.142339945 CEST	443	49975	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.145354986 CEST	49980	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:54.145406961 CEST	443	49980	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.145715952 CEST	49980	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:54.145715952 CEST	49980	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:54.145760059 CEST	443	49980	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.179774046 CEST	443	49976	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.179847956 CEST	443	49976	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.179892063 CEST	443	49976	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.179929972 CEST	49976	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:54.179944038 CEST	443	49976	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.179985046 CEST	49976	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:54.180010080 CEST	49976	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:54.264410019 CEST	443	49976	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.264528990 CEST	49976	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:54.264559031 CEST	443	49976	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.264575958 CEST	49976	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:54.264575958 CEST	49976	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:54.264584064 CEST	443	49976	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.264631987 CEST	443	49976	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.264652967 CEST	49976	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:54.264667988 CEST	443	49976	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.267134905 CEST	49981	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:54.267215967 CEST	443	49981	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.267317057 CEST	49981	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:54.267440081 CEST	49981	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:54.267458916 CEST	443	49981	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.296406984 CEST	443	49977	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.296828985 CEST	49977	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:54.296866894 CEST	443	49977	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.297195911 CEST	49977	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:54.297202110 CEST	443	49977	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.340528011 CEST	443	49978	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.340853930 CEST	49978	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:54.340863943 CEST	443	49978	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.341398001 CEST	49978	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:54.341403008 CEST	443	49978	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.398926973 CEST	443	49977	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.398957014 CEST	443	49977	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.399143934 CEST	49977	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:54.399156094 CEST	443	49977	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.399202108 CEST	443	49977	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.399254084 CEST	49977	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:54.399411917 CEST	49977	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:54.399425030 CEST	443	49977	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.399437904 CEST	49977	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:54.399444103 CEST	443	49977	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.401789904 CEST	49982	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:54.401875973 CEST	443	49982	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.401974916 CEST	49982	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:54.402071953 CEST	49982	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:54.402091026 CEST	443	49982	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.443751097 CEST	443	49978	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.443816900 CEST	443	49978	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.443861961 CEST	443	49978	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.443890095 CEST	49978	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:54.443902016 CEST	443	49978	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.443937063 CEST	49978	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:54.443963051 CEST	49978	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:54.532736063 CEST	443	49978	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.532808065 CEST	443	49978	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.532835960 CEST	49978	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:54.532846928 CEST	443	49978	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.532883883 CEST	49978	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:54.532907963 CEST	49978	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:54.532913923 CEST	443	49978	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.532969952 CEST	443	49978	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.533021927 CEST	49978	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:54.533143997 CEST	49978	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:54.533157110 CEST	443	49978	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.533169985 CEST	49978	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:54.533175945 CEST	443	49978	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.536429882 CEST	49983	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:54.536468983 CEST	443	49983	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.536560059 CEST	49983	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:54.536681890 CEST	49983	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:54.536700010 CEST	443	49983	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.540005922 CEST	443	49979	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.540343046 CEST	49979	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:54.540369034 CEST	443	49979	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.540920019 CEST	49979	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:54.540925026 CEST	443	49979	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.639905930 CEST	443	49979	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.639928102 CEST	443	49979	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.639987946 CEST	443	49979	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.640026093 CEST	49979	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:54.640225887 CEST	49979	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:54.640225887 CEST	49979	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:54.640225887 CEST	49979	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:54.642560959 CEST	49984	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:54.642604113 CEST	443	49984	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.642694950 CEST	49984	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:54.642803907 CEST	49984	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:54.642812014 CEST	443	49984	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.806273937 CEST	443	49980	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.807353973 CEST	49980	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:54.807353973 CEST	49980	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:54.807379007 CEST	443	49980	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.807404995 CEST	443	49980	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.909291029 CEST	443	49980	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.909311056 CEST	443	49980	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.909418106 CEST	49980	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:54.909435987 CEST	443	49980	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.909816027 CEST	443	49980	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.909897089 CEST	49980	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:54.921133041 CEST	443	49981	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.938627958 CEST	49979	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:54.938709974 CEST	443	49979	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:54.969846010 CEST	49981	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:55.040812016 CEST	443	49982	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:55.042871952 CEST	49980	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:55.042871952 CEST	49980	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:55.042918921 CEST	443	49980	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:55.042937994 CEST	443	49980	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:55.045361996 CEST	49981	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:55.045423985 CEST	443	49981	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:55.045902014 CEST	49981	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:55.045916080 CEST	443	49981	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:55.047343969 CEST	49982	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:55.047363997 CEST	443	49982	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:55.047687054 CEST	49982	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:55.047697067 CEST	443	49982	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:55.050400972 CEST	49985	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:55.050456047 CEST	443	49985	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:55.050564051 CEST	49985	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:55.050812006 CEST	49985	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:55.050828934 CEST	443	49985	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:55.142951012 CEST	443	49982	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:55.143088102 CEST	443	49982	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:55.143168926 CEST	49982	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:55.143732071 CEST	443	49981	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:55.143949986 CEST	443	49981	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:55.144010067 CEST	49981	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:55.147260904 CEST	49982	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:55.147260904 CEST	49982	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:55.147298098 CEST	443	49982	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:55.147321939 CEST	443	49982	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:55.155868053 CEST	49981	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:55.155885935 CEST	443	49981	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:55.155910015 CEST	49981	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:55.155924082 CEST	443	49981	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:55.176995993 CEST	443	49983	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:55.185770988 CEST	49983	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:55.185786963 CEST	443	49983	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:55.186172009 CEST	49983	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:55.186177969 CEST	443	49983	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:55.214863062 CEST	49986	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:55.214886904 CEST	443	49986	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:55.215006113 CEST	49986	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:55.228908062 CEST	49987	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:55.229006052 CEST	443	49987	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:55.229149103 CEST	49987	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:55.229202032 CEST	49986	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:55.229216099 CEST	443	49986	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:55.229294062 CEST	49987	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:55.229325056 CEST	443	49987	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:55.278222084 CEST	443	49984	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:55.293056011 CEST	443	49983	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:55.293226957 CEST	443	49983	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:55.293297052 CEST	49983	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:55.329166889 CEST	49984	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:55.346982956 CEST	49984	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:55.347018003 CEST	443	49984	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:55.347866058 CEST	49984	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:55.347888947 CEST	443	49984	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:55.395595074 CEST	49983	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:55.395613909 CEST	443	49983	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:55.395629883 CEST	49983	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:55.395636082 CEST	443	49983	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:55.411343098 CEST	49988	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:55.411371946 CEST	443	49988	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:55.411444902 CEST	49988	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:55.411685944 CEST	49988	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:55.411693096 CEST	443	49988	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:55.454390049 CEST	443	49984	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:55.454442024 CEST	443	49984	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:55.454500914 CEST	49984	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:55.459538937 CEST	49984	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:55.459554911 CEST	443	49984	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:55.459575891 CEST	49984	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:55.459582090 CEST	443	49984	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:55.464081049 CEST	49989	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:55.464175940 CEST	443	49989	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:55.464270115 CEST	49989	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:55.465058088 CEST	49989	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:55.465095043 CEST	443	49989	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:55.602921009 CEST	443	49985	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:55.603732109 CEST	49985	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:55.603765011 CEST	443	49985	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:55.604114056 CEST	49985	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:55.604120970 CEST	443	49985	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:55.705147028 CEST	443	49985	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:55.705207109 CEST	443	49985	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:55.705244064 CEST	443	49985	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:55.705280066 CEST	49985	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:55.705323935 CEST	49985	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:55.705585957 CEST	49985	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:55.705610991 CEST	443	49985	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:55.705626965 CEST	49985	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:55.705634117 CEST	443	49985	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:55.882462978 CEST	443	49987	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:55.882968903 CEST	49987	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:55.882996082 CEST	443	49987	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:55.883398056 CEST	49987	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:55.883409023 CEST	443	49987	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:55.910794020 CEST	443	49986	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:55.911148071 CEST	49986	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:55.911186934 CEST	443	49986	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:55.911473036 CEST	49986	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:55.911479950 CEST	443	49986	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:55.982537031 CEST	443	49987	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:55.982702971 CEST	443	49987	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:55.982784033 CEST	49987	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:55.982898951 CEST	49987	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:55.982898951 CEST	49987	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:55.982948065 CEST	443	49987	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:55.982975006 CEST	443	49987	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:56.015847921 CEST	443	49986	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:56.016057014 CEST	443	49986	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:56.016115904 CEST	49986	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:56.016156912 CEST	49986	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:56.016156912 CEST	49986	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:56.016180038 CEST	443	49986	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:56.016194105 CEST	443	49986	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:56.050812006 CEST	443	49988	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:56.051147938 CEST	49988	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:56.051162958 CEST	443	49988	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:56.051523924 CEST	49988	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:56.051527977 CEST	443	49988	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:56.101172924 CEST	443	49989	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:56.101682901 CEST	49989	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:56.101746082 CEST	443	49989	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:56.101933002 CEST	49989	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:56.101948977 CEST	443	49989	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:56.151344061 CEST	443	49988	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:56.151554108 CEST	443	49988	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:56.151674986 CEST	49988	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:56.151674986 CEST	49988	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:56.151705027 CEST	49988	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:56.151716948 CEST	443	49988	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:56.200215101 CEST	443	49989	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:56.200258970 CEST	443	49989	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:56.200388908 CEST	49989	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:56.200457096 CEST	49989	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:56.200457096 CEST	49989	443	192.168.2.5	13.107.246.60
Oct 8, 2024 05:04:56.200496912 CEST	443	49989	13.107.246.60	192.168.2.5
Oct 8, 2024 05:04:56.200520039 CEST	443	49989	13.107.246.60	192.168.2.5

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 8, 2024 05:03:55.553972960 CEST	1.1.1.1	192.168.2.5	0x6a26	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Oct 8, 2024 05:03:55.553972960 CEST	1.1.1.1	192.168.2.5	0x6a26	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Oct 8, 2024 05:03:56.067451954 CEST	1.1.1.1	192.168.2.5	0x581a	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 05:03:56.067451954 CEST	1.1.1.1	192.168.2.5	0x581a	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Oct 8, 2024 05:04:13.434941053 CEST	1.1.1.1	192.168.2.5	0x2d16	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 05:04:13.434941053 CEST	1.1.1.1	192.168.2.5	0x2d16	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false
Oct 8, 2024 05:04:56.644952059 CEST	1.1.1.1	192.168.2.5	0xae4f	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Oct 8, 2024 05:04:56.644952059 CEST	1.1.1.1	192.168.2.5	0xae4f	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

46.8.231.109

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	46.8.231.109	80	6544	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 05:03:53.607753992 CEST	87	OUT	GET / HTTP/1.1 Host: 46.8.231.109 Connection: Keep-Alive Cache-Control: no-cache

Target ID:	0
Start time:	23:03:52
Start date:	07/10/2024
Path:	C:\Users\user\Desktop\SKGOzZRZGX.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SKGOzZRZGX.exe"
Imagebase:	0x940000
File size:	505'344 bytes
MD5 hash:	02D84538A17B96AFC0845FB922645888
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2154849305.000000000096D000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	23:03:52
Start date:	07/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0x310000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	23:03:52
Start date:	07/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0x870000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000002.00000002.2474401417.0000000000488000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000002.00000002.2474401417.0000000000462000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000002.00000002.2474401417.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000002.00000002.2474955101.0000000000D57000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000002.00000002.2474401417.000000000049A000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	23:03:52
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5636 -s 268
Imagebase:	0xf80000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	23:04:35
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6544 -s 1232
Imagebase:	0xf80000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	6.1%
Total number of Nodes:	229
Total number of Limit Nodes:	4

Executed Functions

Function 00942021 Relevance: 7.6, APIs: 1, Strings: 3, Instructions: 631
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(009BA6D8,?,00000040,?), ref: 00942738

Strings

a, xrefs: 00942296
', xrefs: 00942718
S, xrefs: 0094206A

Memory Dump Source

Source File: 00000000.00000002.2154781065.0000000000941000.00000020.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2154721774.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154819903.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154849305.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154920448.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154935513.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154950176.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_SKGOzZRZGX.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: '$S$a
API String ID: 544645111-1060379873
Opcode ID: 705375ae0c49426bf28ff902bc8f0fda91b9b0dad85ef7d4a47ca614981df0b8
Instruction ID: 25f316edd8aa4c7e519f6f6fcbe9df87e21fcc1a71eca093949846c1a267270d
Opcode Fuzzy Hash: 705375ae0c49426bf28ff902bc8f0fda91b9b0dad85ef7d4a47ca614981df0b8
Instruction Fuzzy Hash: 39F1F027934E1B06E70866394D526E5998AF7EA730FD24733BE22DB3F4E36D09419284

Function 00958E2E Relevance: 4.7, APIs: 3, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__freea.LIBCMT ref: 00958FDD

Part of subcall function 00953A83: HeapAlloc.KERNEL32(00000000,0095A1AA,?,?,0095A1AA,00000220,?,?,?), ref: 00953AB5

__freea.LIBCMT ref: 00958FF2
__freea.LIBCMT ref: 00959002

Memory Dump Source

Source File: 00000000.00000002.2154781065.0000000000941000.00000020.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2154721774.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154819903.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154849305.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154920448.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154935513.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154950176.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_SKGOzZRZGX.jbxd

Yara matches

Similarity

API ID: __freea$AllocHeap
String ID:
API String ID: 85559729-0
Opcode ID: ae7b2bcc1dbbd5554b49e8cedbc7187b0db242ff356f3edaae273e280e246d98
Instruction ID: 7c9275df81b2ec39af649610c1769ad14c6f70bfafc98af832da5d3ec9bae03f
Opcode Fuzzy Hash: ae7b2bcc1dbbd5554b49e8cedbc7187b0db242ff356f3edaae273e280e246d98
Instruction Fuzzy Hash: 6451B572600216AFEF25EF66CC81EBB76AEEF48752B150529FD04E6150EF35CC5887A0

Function 0095A3A6 Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00959ED6: GetOEMCP.KERNEL32(00000000,?,?,?,?), ref: 00959F01

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,0095A1ED,?,00000000,?,?,?), ref: 0095A407
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,0095A1ED,?,00000000,?,?,?), ref: 0095A449

Memory Dump Source

Source File: 00000000.00000002.2154781065.0000000000941000.00000020.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2154721774.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154819903.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154849305.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154920448.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154935513.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154950176.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_SKGOzZRZGX.jbxd

Yara matches

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 634fa79bc0d541eb95930a16b28f5876ebb64d3b4526286bd8229be048f30e9c
Instruction ID: 062caaeed30530d73485510a52766cbf858304cfedf7e28e1661c5b7a63a55cb
Opcode Fuzzy Hash: 634fa79bc0d541eb95930a16b28f5876ebb64d3b4526286bd8229be048f30e9c
Instruction Fuzzy Hash: 3D515B70A003458FDB21CF77C885AAEBBF9EF81301F14466ED89287161E7B4994ECB56

Function 00956368 Relevance: 3.0, APIs: 2, Instructions: 34
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE(?,00958F1C,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 0095639C
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00958F1C,?,?,00000000,?,00000000), ref: 009563BA

Memory Dump Source

Source File: 00000000.00000002.2154781065.0000000000941000.00000020.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2154721774.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154819903.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154849305.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154920448.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154935513.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154950176.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_SKGOzZRZGX.jbxd

Yara matches

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: b5233ec4d389f3f1c0d178fbda0c5d014a37ece90af68d5b388349b2607e96eb
Instruction ID: 550c8a57609862aca46e5b500cc6bcb35cfb58b2abb44b6af9ee3269c69a4dd0
Opcode Fuzzy Hash: b5233ec4d389f3f1c0d178fbda0c5d014a37ece90af68d5b388349b2607e96eb
Instruction Fuzzy Hash: C2F07A3240015ABBCF129F91DC09EDE3F26EF48361F458014FE1866020C736D979BB90

Function 00959FAA Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(E8458D00,?,0095A1F9,0095A1ED,00000000), ref: 00959FDC

Memory Dump Source

Source File: 00000000.00000002.2154781065.0000000000941000.00000020.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2154721774.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154819903.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154849305.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154920448.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154935513.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154950176.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_SKGOzZRZGX.jbxd

Yara matches

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: 7dba25e3f9f106a3e3e767bd078a830b2bdb54dfe959124f83d4988dae5ca019
Instruction ID: 5cb67ce76fa7d83973e6b68d5be328af6e084ee681903c5775fa97efc86901b4
Opcode Fuzzy Hash: 7dba25e3f9f106a3e3e767bd078a830b2bdb54dfe959124f83d4988dae5ca019
Instruction Fuzzy Hash: 2E516B719081589ADB21CB39CC80BE67BBCEB56304F2406EDD99AC7182C2759D4ADF21

Non-executed Functions

Function 00990F98 Relevance: 11.3, Strings: 5, Instructions: 5010COMMON

Download Yara Rule

Strings

66.\, xrefs: 00991719
B^U!, xrefs: 0099120D
X/:, xrefs: 009917A0
m27/, xrefs: 00991741
KG&!, xrefs: 00991583

Memory Dump Source

Source File: 00000000.00000002.2154849305.000000000096D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2154721774.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154781065.0000000000941000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154819903.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154920448.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154935513.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154950176.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_SKGOzZRZGX.jbxd

Yara matches

Similarity

API ID:
String ID: 66.\$B^U!$KG&!$X/:$m27/
API String ID: 0-1441538931
Opcode ID: 2b9b1c30e7f6628c0adfe3d770ddac04f4f114ca0a85add565e8573d05011e3c
Instruction ID: 06ca5c4dbeb572c5db40304f6f13b9667b4cfd2853625c9df86b8e5ecfd4ce26
Opcode Fuzzy Hash: 2b9b1c30e7f6628c0adfe3d770ddac04f4f114ca0a85add565e8573d05011e3c
Instruction Fuzzy Hash: AB63637241E7D62ECB27CB3847B61A17F6ABE1321031D49CEC4C18F9B3C6949A16E356

Function 0095D39B Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0095D57F

Strings

1#QNAN, xrefs: 0095D4AE
1#INF, xrefs: 0095D4D1
1#IND, xrefs: 0095D4A0
1#SNAN, xrefs: 0095D4A7

Memory Dump Source

Source File: 00000000.00000002.2154781065.0000000000941000.00000020.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2154721774.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154819903.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154849305.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154920448.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154935513.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154950176.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_SKGOzZRZGX.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: d5a5af3869524ff1564fcfcb72f1722af1701c502b4f0ebbd47ddbc16e4670a3
Instruction ID: 3cfd20d11cd083554cfe8cea9e18d79a3ed2819b4f5678f30e8f82a7253349a9
Opcode Fuzzy Hash: d5a5af3869524ff1564fcfcb72f1722af1701c502b4f0ebbd47ddbc16e4670a3
Instruction Fuzzy Hash: 26D23A71E092298FDB65CF25CC407EAB7B9EB84306F1445EAD80DE7240E779AE858F41

Function 0095C814 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,0095CB32,00000002,00000000,?,?,?,0095CB32,?,00000000), ref: 0095C8AD
GetLocaleInfoW.KERNEL32(?,20001004,0095CB32,00000002,00000000,?,?,?,0095CB32,?,00000000), ref: 0095C8D6
GetACP.KERNEL32(?,?,0095CB32,?,00000000), ref: 0095C8EB

Strings

ACP, xrefs: 0095C832
OCP, xrefs: 0095C868

Memory Dump Source

Source File: 00000000.00000002.2154781065.0000000000941000.00000020.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2154721774.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154819903.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154849305.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154920448.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154935513.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154950176.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_SKGOzZRZGX.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 5919e7338b1da59fbad41c63c1b3de647b4fd67cd19be40bd073f2b6b1d9f6a7
Instruction ID: f407df83f23ea3c9d70bda45199873826915617632ce6c2056d1ffd272795a1e
Opcode Fuzzy Hash: 5919e7338b1da59fbad41c63c1b3de647b4fd67cd19be40bd073f2b6b1d9f6a7
Instruction Fuzzy Hash: CE2192A2A00301EEDB34CF57C901A9773AAAF54F52B568428EF0ADB210E732DD4CD750

Function 0095C9E9 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00954EB1: GetLastError.KERNEL32(?,00000008,00959482), ref: 00954EB5
Part of subcall function 00954EB1: SetLastError.KERNEL32(00000000,0096C480,00000024,00950419), ref: 00954F57

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 0095CAF5
IsValidCodePage.KERNEL32(00000000), ref: 0095CB3E
IsValidLocale.KERNEL32(?,00000001), ref: 0095CB4D
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 0095CB95
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 0095CBB4

Memory Dump Source

Source File: 00000000.00000002.2154781065.0000000000941000.00000020.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2154721774.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154819903.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154849305.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154920448.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154935513.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154950176.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_SKGOzZRZGX.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 294cac1d7ac8d04c6ea55a4ba930fa2911082d4cbb1c264e66583a220bf38ff6
Instruction ID: 151275f87b478fce63bcc8b744fd6afa38e904ceeb2840b58b9f74c144291e99
Opcode Fuzzy Hash: 294cac1d7ac8d04c6ea55a4ba930fa2911082d4cbb1c264e66583a220bf38ff6
Instruction Fuzzy Hash: AA5140B1A00309AFDB10DFA6DC46BBA77B8FF48702F144469ED11E7190E7709A48CBA1

Function 0095C085 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00954EB1: GetLastError.KERNEL32(?,00000008,00959482), ref: 00954EB5
Part of subcall function 00954EB1: SetLastError.KERNEL32(00000000,0096C480,00000024,00950419), ref: 00954F57

GetACP.KERNEL32(?,?,?,?,?,?,00951848,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0095C146
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00951848,?,?,?,00000055,?,-00000050,?,?), ref: 0095C171
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 0095C2D4

Strings

utf8, xrefs: 0095C243

Memory Dump Source

Source File: 00000000.00000002.2154781065.0000000000941000.00000020.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2154721774.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154819903.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154849305.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154920448.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154935513.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154950176.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_SKGOzZRZGX.jbxd

Yara matches

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: e18d3c24c848c776645e4ba8051fb798ae6a0c82abb5ecaa96d16fc5a3913e86
Instruction ID: 428d26bd20c11b93206755a6f487bed962b8c1533c00d86498d017eb4fe28c77
Opcode Fuzzy Hash: e18d3c24c848c776645e4ba8051fb798ae6a0c82abb5ecaa96d16fc5a3913e86
Instruction Fuzzy Hash: CB7116B1A04306AEDB24EB77DC42BAA73ACEF85706F144429FD15D7181EB74E94C87A0

Function 00953C92 Relevance: 6.3, APIs: 4, Instructions: 337COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00953D1F

Memory Dump Source

Source File: 00000000.00000002.2154781065.0000000000941000.00000020.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2154721774.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154819903.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154849305.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154920448.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154935513.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154950176.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_SKGOzZRZGX.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 40f0e063838af908aa0c23a01ee66fead67f3bdac29e3056e6e3dd52480c6ad0
Instruction ID: abe4b1e986c2fec00c14ef45084da218c0dd9422bba24559a6a7337ba0f8fc83
Opcode Fuzzy Hash: 40f0e063838af908aa0c23a01ee66fead67f3bdac29e3056e6e3dd52480c6ad0
Instruction Fuzzy Hash: 77B11672D042459FEB15CF69C891BEEBBF9EF55381F14C169EC05AB281D2349E09CBA0

Function 00947922 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 0094792E
IsDebuggerPresent.KERNEL32 ref: 009479FA
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00947A13
UnhandledExceptionFilter.KERNEL32(?), ref: 00947A1D

Memory Dump Source

Source File: 00000000.00000002.2154781065.0000000000941000.00000020.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2154721774.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154819903.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154849305.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154920448.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154935513.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154950176.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_SKGOzZRZGX.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 2d69006cd321c75986d1f2918180a0d2c454ba73d92d1185b047577ef40efcfc
Instruction ID: 72f2b5c6ccb5fabdb6ecc936fe15638708cf1fce529ccef009d6489d77a4cd69
Opcode Fuzzy Hash: 2d69006cd321c75986d1f2918180a0d2c454ba73d92d1185b047577ef40efcfc
Instruction Fuzzy Hash: 2431F775D0521D9BDB20EFA4D949BCDBBB8AF08340F1041EAE40CAB250EBB19B858F55

Function 0095C498 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00954EB1: GetLastError.KERNEL32(?,00000008,00959482), ref: 00954EB5
Part of subcall function 00954EB1: SetLastError.KERNEL32(00000000,0096C480,00000024,00950419), ref: 00954F57

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0095C4EC
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0095C536
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0095C5FC

Memory Dump Source

Source File: 00000000.00000002.2154781065.0000000000941000.00000020.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2154721774.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154819903.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154849305.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154920448.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154935513.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154950176.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_SKGOzZRZGX.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 4b743216129bc1a89d410b994559b28ba179abd13f403f61aefd21dfa73234ee
Instruction ID: b41f3580e10ea7e6391dfcc6566c72996bfb2225844eec375da3c7f9b615bfd8
Opcode Fuzzy Hash: 4b743216129bc1a89d410b994559b28ba179abd13f403f61aefd21dfa73234ee
Instruction Fuzzy Hash: 246191B29152079FDB28DF26CC82B6A77A8EF44312F10416AED05C6585F774EA49CB50

Function 0094DA73 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 0094DB6B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 0094DB75
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 0094DB82

Memory Dump Source

Source File: 00000000.00000002.2154781065.0000000000941000.00000020.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2154721774.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154819903.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154849305.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154920448.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154935513.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154950176.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_SKGOzZRZGX.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: e3e172bac953765cb55b69871d1a579d8f291b22e3ea3a6ae304c49b0d8f6771
Instruction ID: 81a254839395f7a4b28809664a9707e1db95563e2ee22828fe5c066f8d13b964
Opcode Fuzzy Hash: e3e172bac953765cb55b69871d1a579d8f291b22e3ea3a6ae304c49b0d8f6771
Instruction Fuzzy Hash: 9D31D17491122CABCB21DF68DC89B9DBBB8FF48310F5041EAE41CA7251EB709B858F44

Function 0094FEF0 Relevance: 3.4, APIs: 2, Instructions: 449COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2154781065.0000000000941000.00000020.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2154721774.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154819903.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154849305.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154920448.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154935513.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154950176.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_SKGOzZRZGX.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b78e9bc5a25061f1abca4818c36b3245c47596756df3441acd3b4668cd2eb70a
Instruction ID: fcc5d9d109042c5c6d9ba669d86dcd59b144fe8ba33c92718fb4b8d3f2dbc95c
Opcode Fuzzy Hash: b78e9bc5a25061f1abca4818c36b3245c47596756df3441acd3b4668cd2eb70a
Instruction Fuzzy Hash: 3BF14171E002199FDF14CFA9D884AADB7B5FF88325F158269E819AB381D730AD05CF90

Function 0095572C Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00955727,?,?,00000008,?,?,009615F5,00000000), ref: 00955959

Memory Dump Source

Source File: 00000000.00000002.2154781065.0000000000941000.00000020.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2154721774.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154819903.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154849305.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154920448.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154935513.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154950176.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_SKGOzZRZGX.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 7293008c3bd87533687e21f5d12901584c50917cf6562418da39851dc479a888
Instruction ID: d9f6b7e860df82e677773df09cb99db67473e0de4e91f32af2307f323c724864
Opcode Fuzzy Hash: 7293008c3bd87533687e21f5d12901584c50917cf6562418da39851dc479a888
Instruction Fuzzy Hash: 01B16F31610A04CFD715CF29C4A6B647BE0FF45366F2A8658ED99CF2A2C339E995CB40

Function 0094729C Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 009472B2

Memory Dump Source

Source File: 00000000.00000002.2154781065.0000000000941000.00000020.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2154721774.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154819903.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154849305.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154920448.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154935513.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154950176.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_SKGOzZRZGX.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 74309d760898e11beb06a4d71fabe657c20590e696bf3792b4b0c9957ed79495
Instruction ID: d075f84411bf14ed22ffe308b7ad90f4c78240aa9a38494f02d6923215d8347c
Opcode Fuzzy Hash: 74309d760898e11beb06a4d71fabe657c20590e696bf3792b4b0c9957ed79495
Instruction Fuzzy Hash: 5DA17272E2A6058FDB18CFA5E981B59BBF4FB48324F14912ED429EB390D3749841DF50

Function 00959ABF Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2154781065.0000000000941000.00000020.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2154721774.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154819903.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154849305.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154920448.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154935513.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154950176.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_SKGOzZRZGX.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 224094cdac8df9e01f84b82dfbbca0d8949c3adf922ab9e672d1f626370d3b0d
Instruction ID: 82fe1a8ea65f3223281599a32f3442ba70fbdff56e480d6f54adaa2d031568fd
Opcode Fuzzy Hash: 224094cdac8df9e01f84b82dfbbca0d8949c3adf922ab9e672d1f626370d3b0d
Instruction Fuzzy Hash: 6831F776900219EFEB20DFBADC85EBB777DEB84315F144158FD0597244EA70AE448B60

Function 0094CAF2 Relevance: 1.6, Strings: 1, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 0094CC80

Memory Dump Source

Source File: 00000000.00000002.2154781065.0000000000941000.00000020.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2154721774.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154819903.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154849305.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154920448.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154935513.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154950176.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_SKGOzZRZGX.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 2206aecdc45d348ea023543c1896327496f63887dd0bb55d1fd84fbe762f3325
Instruction ID: c3954c40f628d61c5aa69cb0cdfd66e826b4135164821be80fe8aec5922dd82c
Opcode Fuzzy Hash: 2206aecdc45d348ea023543c1896327496f63887dd0bb55d1fd84fbe762f3325
Instruction Fuzzy Hash: 9CC1D0F4A0260A8FCBB8CF28C481E7EBBB9EF45314F144A1DD4969B291D734AD45CB91

Function 0095C6EB Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00954EB1: GetLastError.KERNEL32(?,00000008,00959482), ref: 00954EB5
Part of subcall function 00954EB1: SetLastError.KERNEL32(00000000,0096C480,00000024,00950419), ref: 00954F57

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0095C73F

Memory Dump Source

Source File: 00000000.00000002.2154781065.0000000000941000.00000020.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2154721774.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154819903.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154849305.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154920448.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154935513.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154950176.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_SKGOzZRZGX.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 773b14aa5355e0ff02b26f79b8f00be5a9229a7481b087e6233e875e0e00cf2f
Instruction ID: bf529b97dca49e354fde846b304c3dcec7c4a8d57e6476e6de52d800112e788c
Opcode Fuzzy Hash: 773b14aa5355e0ff02b26f79b8f00be5a9229a7481b087e6233e875e0e00cf2f
Instruction Fuzzy Hash: 312171B2A15206AFEB18DA26DC42B7A77ACEF48316B10006AFD05D6541EB749D498B50

Function 0095C372 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00954EB1: GetLastError.KERNEL32(?,00000008,00959482), ref: 00954EB5
Part of subcall function 00954EB1: SetLastError.KERNEL32(00000000,0096C480,00000024,00950419), ref: 00954F57

EnumSystemLocalesW.KERNEL32(0095C498,00000001,00000000,?,-00000050,?,0095CAC9,00000000,?,?,?,00000055,?), ref: 0095C3E4

Memory Dump Source

Source File: 00000000.00000002.2154781065.0000000000941000.00000020.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2154721774.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154819903.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154849305.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154920448.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154935513.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154950176.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_SKGOzZRZGX.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 00571ba81741434cac81ad542cb9ac09af4bf87f60e16ab60884553a17579d3b
Instruction ID: 07ade6f185e57537e4661207cefd14c2404e1f98958fb2bcab453afdd9a54374
Opcode Fuzzy Hash: 00571ba81741434cac81ad542cb9ac09af4bf87f60e16ab60884553a17579d3b
Instruction Fuzzy Hash: 191125762003055FDB18EF3AD8A16BABBA1FF8036AB18842CED4797A40D371A946C740

Function 0095C91A Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00954EB1: GetLastError.KERNEL32(?,00000008,00959482), ref: 00954EB5
Part of subcall function 00954EB1: SetLastError.KERNEL32(00000000,0096C480,00000024,00950419), ref: 00954F57

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,0095C6B4,00000000,00000000,?), ref: 0095C946

Memory Dump Source

Source File: 00000000.00000002.2154781065.0000000000941000.00000020.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2154721774.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154819903.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154849305.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154920448.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154935513.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154950176.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_SKGOzZRZGX.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: a768d36887daca53dc03f268f9d0aaf731b440ebf034676b8981595b83d56653
Instruction ID: e0ce11627e959fbc57b3383d201f638781cbb393e0a49758cad0bfc4ff043b26
Opcode Fuzzy Hash: a768d36887daca53dc03f268f9d0aaf731b440ebf034676b8981595b83d56653
Instruction Fuzzy Hash: 1CF0A973500211BFDB24DA668C15BBAB79CEB80755F154428ED46B3180DA74FE49C790

Function 0095C40D Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00954EB1: GetLastError.KERNEL32(?,00000008,00959482), ref: 00954EB5
Part of subcall function 00954EB1: SetLastError.KERNEL32(00000000,0096C480,00000024,00950419), ref: 00954F57

EnumSystemLocalesW.KERNEL32(0095C6EB,00000001,?,?,-00000050,?,0095CA8D,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 0095C457

Memory Dump Source

Source File: 00000000.00000002.2154781065.0000000000941000.00000020.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2154721774.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154819903.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154849305.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154920448.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154935513.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154950176.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_SKGOzZRZGX.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 41b0b0cea9bf9ebd44dc130b0ee00e7b78817b6d7357cac306370c447b748e09
Instruction ID: bba472e117b7baf72a2bfab661fc0ea9e4833f3747c05cb527338807032ef98a
Opcode Fuzzy Hash: 41b0b0cea9bf9ebd44dc130b0ee00e7b78817b6d7357cac306370c447b748e09
Instruction Fuzzy Hash: A3F022722003046FCB149F3ADC91E7B7BA4EB80769F04802CFD068B6A0C2B19C4AC700

Function 00955D7F Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0094DDC1: EnterCriticalSection.KERNEL32(?,?,00954B89,?,0096C2E0,00000008,00954D4D,?,0094C446,?), ref: 0094DDD0

EnumSystemLocalesW.KERNEL32(00955D72,00000001,0096C3A0,0000000C,00956127,00000000), ref: 00955DB7

Memory Dump Source

Source File: 00000000.00000002.2154781065.0000000000941000.00000020.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2154721774.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154819903.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154849305.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154920448.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154935513.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154950176.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_SKGOzZRZGX.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 4003d4c8799b6fc0109daad5ec027d87be37c46fda8d4dddf6967a59dfb5da42
Instruction ID: 2f6eb4c0a891401d7db92bffa28c2c30e4e01815bec167edac9a1fe934f90c75
Opcode Fuzzy Hash: 4003d4c8799b6fc0109daad5ec027d87be37c46fda8d4dddf6967a59dfb5da42
Instruction Fuzzy Hash: A8F04972A14204EFD700EF99E856BAD7BF0FB88721F10821AF9119B2E1C7B69904DB44

Function 0095C327 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00954EB1: GetLastError.KERNEL32(?,00000008,00959482), ref: 00954EB5
Part of subcall function 00954EB1: SetLastError.KERNEL32(00000000,0096C480,00000024,00950419), ref: 00954F57

EnumSystemLocalesW.KERNEL32(0095C280,00000001,?,?,?,0095CAEB,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0095C35E

Memory Dump Source

Source File: 00000000.00000002.2154781065.0000000000941000.00000020.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2154721774.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154819903.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154849305.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154920448.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154935513.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154950176.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_SKGOzZRZGX.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 24c08395bcf11308b4d29b0d39fbfdc9af9fb8e2a94fffbb5f892874ec7bc171
Instruction ID: d5d11abd69e39ed1f9f676d3805bcab8367bd5ecd23629227d01b5f60e9ac8d1
Opcode Fuzzy Hash: 24c08395bcf11308b4d29b0d39fbfdc9af9fb8e2a94fffbb5f892874ec7bc171
Instruction Fuzzy Hash: FCF0E5363003095BCB14DF76DC4566ABF94EFC1B65F068058EE098B690C675998AD790

Function 0095622B Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,009523AE,?,20001004,00000000,00000002,?,?,009519B0), ref: 0095625F

Memory Dump Source

Source File: 00000000.00000002.2154781065.0000000000941000.00000020.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2154721774.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154819903.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154849305.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154920448.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154935513.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154950176.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_SKGOzZRZGX.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 3b1b39138dd7ad41a452a9d5f414f92db6eeca4a0050b25f1dfc56f38eb00f2a
Instruction ID: cbbc0a85e2c861f8d06000c05766a9b87c817e78ba57a53b421cde93487ffecf
Opcode Fuzzy Hash: 3b1b39138dd7ad41a452a9d5f414f92db6eeca4a0050b25f1dfc56f38eb00f2a
Instruction Fuzzy Hash: B9E04831504118B7CF126F62DC09B9E7F29EF44751F418014FD1566121CB71CD28AB91

Function 00947AAF Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00007ABB,00946DC9), ref: 00947AB4

Memory Dump Source

Source File: 00000000.00000002.2154781065.0000000000941000.00000020.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2154721774.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154819903.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154849305.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154920448.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154935513.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154950176.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_SKGOzZRZGX.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 63268c7079a2ba8322122c98fa26e24d309cd9968808f1e652261d6fc4fc7be5
Instruction ID: 52beef05fb95cdbe13a9f85db8ca7dbd9299f20a2e1b9eaa7c7f851f74b45f4c
Opcode Fuzzy Hash: 63268c7079a2ba8322122c98fa26e24d309cd9968808f1e652261d6fc4fc7be5
Instruction Fuzzy Hash:

Function 00941D79 Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

Z81xbyuAua, xrefs: 00941E9B

Memory Dump Source

Source File: 00000000.00000002.2154781065.0000000000941000.00000020.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2154721774.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154819903.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154849305.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154920448.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154935513.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154950176.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_SKGOzZRZGX.jbxd

Yara matches

Similarity

API ID:
String ID: Z81xbyuAua
API String ID: 0-3121583705
Opcode ID: abcd1fc8145f864681081aa1546604e98ee0f38f39c015151c9f991de399c35c
Instruction ID: 7903f30d6226b9f0fd3cd0db805cc58372b06fc1c67b01eafc15b0dfa09d0582
Opcode Fuzzy Hash: abcd1fc8145f864681081aa1546604e98ee0f38f39c015151c9f991de399c35c
Instruction Fuzzy Hash: E5412D76E2052B5BCB0CEEB8C8565AFBB69E746350B04427ADD11DB3D1E234CA41CBD0

Function 0095CC4B Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0095CC4B

Memory Dump Source

Source File: 00000000.00000002.2154781065.0000000000941000.00000020.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2154721774.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154819903.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154849305.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154920448.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154935513.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154950176.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_SKGOzZRZGX.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 8b0246a1445152aca356accf7bde8eae7bf8f8a2c900bc1d1138b8a58a4448cf
Instruction ID: 65d3c0955e42bc383069e47e952056ebb07d1a462c769c09982a66a00278be99
Opcode Fuzzy Hash: 8b0246a1445152aca356accf7bde8eae7bf8f8a2c900bc1d1138b8a58a4448cf
Instruction Fuzzy Hash: E2A011302282008B83008F3AAE0A22C3AA8AA0A2A030AC028E000C00A0EBA08080BF00

Function 0095BB36 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2154781065.0000000000941000.00000020.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2154721774.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154819903.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154849305.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154920448.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154935513.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154950176.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_SKGOzZRZGX.jbxd

Yara matches

Similarity

API ID: ErrorLastProcess$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 3471368781-0
Opcode ID: aafe2569280b54aa6a9798e7421fa96fcc8d2db25455d26c24540093b02d1833
Instruction ID: e27107a3642ea1b1cbbde492c253edb0c3868b3c8542e5f51cc079e133012650
Opcode Fuzzy Hash: aafe2569280b54aa6a9798e7421fa96fcc8d2db25455d26c24540093b02d1833
Instruction Fuzzy Hash: F2B1F6755007058BDB34DF2ACC92BB7B3A8EF4430AF54442DEE83C6680EB75A989C710

Function 0095A64C Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2154781065.0000000000941000.00000020.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2154721774.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154819903.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154849305.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154920448.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154935513.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154950176.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_SKGOzZRZGX.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d30a52f00f890bd01d6e84b1357bca7669443c8ff688bb46904ed1c21e63159d
Instruction ID: 3372ae684746d04bd81fa54bb6a8bd848044e62365fd1b3ef97409ee3522e974
Opcode Fuzzy Hash: d30a52f00f890bd01d6e84b1357bca7669443c8ff688bb46904ed1c21e63159d
Instruction Fuzzy Hash: 91E08C32922238EBCB14DB9AC904A8AF3ECEB85B01B550596B901D3210C270EE04C7D0

Function 00986628 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2154849305.000000000096D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2154721774.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154781065.0000000000941000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154819903.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154920448.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154935513.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154950176.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_SKGOzZRZGX.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00942003 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2154781065.0000000000941000.00000020.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2154721774.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154819903.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154849305.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154920448.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154935513.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154950176.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_SKGOzZRZGX.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e245313f985c111f9477e32cff74718d45da5729baa8dc067cbccee28ec9b82
Instruction ID: 170f7e6b2e2ab4a43eaf92b8c2fddf6179996cb1df5d85a17c47189b7df35b3f
Opcode Fuzzy Hash: 6e245313f985c111f9477e32cff74718d45da5729baa8dc067cbccee28ec9b82
Instruction Fuzzy Hash: 4BD0923A6059109FC210CF09E440941F7B4FB996307164196E90493720C330FC41CAD0

Function 00950F2E Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2154781065.0000000000941000.00000020.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2154721774.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154819903.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154849305.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154920448.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154935513.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154950176.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_SKGOzZRZGX.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f509db719341cefea6c6c824f556d87c4149af31b656ab04d21882e9f704e7b0
Instruction ID: e858b7d5d0153bb690715c61480d66afadb55ccbe9449a2e9677d3a442664ba9
Opcode Fuzzy Hash: f509db719341cefea6c6c824f556d87c4149af31b656ab04d21882e9f704e7b0
Instruction Fuzzy Hash: 83C04C74141E4086CE39D91682B17A53359A7E2783F9415CCDD1A4B752C51E9C8ADB11

Function 0094A5C8 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 303
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

type_info::operator==.LIBVCRUNTIME ref: 0094A6E7
___TypeMatch.LIBVCRUNTIME ref: 0094A7F5
CallUnexpected.LIBVCRUNTIME ref: 0094A962

Strings

csm, xrefs: 0094A672
csm, xrefs: 0094A71E
csm, xrefs: 0094A605

Memory Dump Source

Source File: 00000000.00000002.2154781065.0000000000941000.00000020.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2154721774.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154819903.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154849305.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154920448.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154935513.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154950176.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_SKGOzZRZGX.jbxd

Yara matches

Similarity

API ID: CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 1206542248-393685449
Opcode ID: b6a8129f54e95a7e9dcc3c4f618228b31b14549f0794b9147c99269a13e283ff
Instruction ID: ebe9ff3dbf3a470e340cfd3b4cda9a760078c5005b6e0500e2e070ccb9d502f2
Opcode Fuzzy Hash: b6a8129f54e95a7e9dcc3c4f618228b31b14549f0794b9147c99269a13e283ff
Instruction Fuzzy Hash: 2EB17871C40209EFCF28DFA4C981EAEBBB9FF54310F15456AE8116B212D731DA52CB92

Function 00955F4A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,F8250000,?,87E9FD49,?,00956057,0094C446,?,F8250000,00000000), ref: 0095600B

Strings

ext-ms-, xrefs: 00955FB5
api-ms-, xrefs: 00955FA1

Memory Dump Source

Source File: 00000000.00000002.2154781065.0000000000941000.00000020.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2154721774.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154819903.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154849305.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154920448.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154935513.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154950176.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_SKGOzZRZGX.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 022c08f3bc3a2bed8a0a65027fcd6b0ae169ce998e76a3eb9806561489dba77c
Instruction ID: 05799b6415c1fdf4be61890955b2279cae65f5e7ac8eff4d2214960143cced24
Opcode Fuzzy Hash: 022c08f3bc3a2bed8a0a65027fcd6b0ae169ce998e76a3eb9806561489dba77c
Instruction Fuzzy Hash: FF210571A05510A7CB22DB26EC50B5E376CAF813A1F224214FD15A72D1DB70EE08D7D0

Function 0095F356 Relevance: 9.3, APIs: 6, Instructions: 298
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2154781065.0000000000941000.00000020.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2154721774.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154819903.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154849305.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154920448.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154935513.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154950176.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_SKGOzZRZGX.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4ca4e5e76fdfff6ad80922b13d4e503e3f59d64805aa1c6de95293061819b6c
Instruction ID: 9553e0e37e4956a62f444509ed08dbf1db1e7e1a4d06d8bfbcaa19bd06c2faf4
Opcode Fuzzy Hash: b4ca4e5e76fdfff6ad80922b13d4e503e3f59d64805aa1c6de95293061819b6c
Instruction Fuzzy Hash: 0AB10574E052099FDB11DFAAC8A0BBDBBB5FF85321F144169E8019B2A2C7719D49CF60

Function 009453B1 Relevance: 9.1, APIs: 6, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 009453B8
std::_Lockit::_Lockit.LIBCPMT ref: 009453C2
int.LIBCPMT ref: 009453D9

Part of subcall function 009416B4: std::_Lockit::_Lockit.LIBCPMT ref: 009416C5
Part of subcall function 009416B4: std::_Lockit::~_Lockit.LIBCPMT ref: 009416DF

std::_Facet_Register.LIBCPMT ref: 00945413
std::_Lockit::~_Lockit.LIBCPMT ref: 00945433
Concurrency::cancel_current_task.LIBCPMT ref: 00945440

Memory Dump Source

Source File: 00000000.00000002.2154781065.0000000000941000.00000020.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2154721774.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154819903.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154849305.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154920448.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154935513.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154950176.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_SKGOzZRZGX.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: 8ccffdc1a7342c1eea00979f42c946d5fc71521e7acd4ecb70f35f78bea5ebc5
Instruction ID: 294056fd0208b84065f7d707dd91e301264a59fe252aee7da4cbc3e56e1f267c
Opcode Fuzzy Hash: 8ccffdc1a7342c1eea00979f42c946d5fc71521e7acd4ecb70f35f78bea5ebc5
Instruction Fuzzy Hash: B411D3719146149BCB24EFA4D805FAEB7F5EF84320F55050DF805AB3A2DFB4AE408B80

Function 0094A25A Relevance: 9.1, APIs: 6, Instructions: 60
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,0094A251,00948978,00947AFF), ref: 0094A268
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0094A276
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0094A28F
SetLastError.KERNEL32(00000000,0094A251,00948978,00947AFF), ref: 0094A2E1

Memory Dump Source

Source File: 00000000.00000002.2154781065.0000000000941000.00000020.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2154721774.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154819903.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154849305.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154920448.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154935513.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154950176.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_SKGOzZRZGX.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 818b4eba9ffbbcb167b901585925e0538274cc2fbb1752a78aec4841b530c8fd
Instruction ID: 5a65a7e665f5f626e052304911a6f80a40e1a90dafa6ef28540ae789b563e175
Opcode Fuzzy Hash: 818b4eba9ffbbcb167b901585925e0538274cc2fbb1752a78aec4841b530c8fd
Instruction Fuzzy Hash: 7001D4327AE7116EA6142776BC86F272759EB42774B20032DF130454F1EFD38C06B246

Function 00950F50 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,87E9FD49,?,?,00000000,00961FC8,000000FF,?,00950EE0,00951010,?,00950EB4,00000000), ref: 00950F85
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00950F97
FreeLibrary.KERNEL32(00000000,?,?,00000000,00961FC8,000000FF,?,00950EE0,00951010,?,00950EB4,00000000), ref: 00950FB9

Strings

CorExitProcess, xrefs: 00950F8F
mscoree.dll, xrefs: 00950F7E

Memory Dump Source

Source File: 00000000.00000002.2154781065.0000000000941000.00000020.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2154721774.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154819903.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154849305.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154920448.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154935513.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154950176.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_SKGOzZRZGX.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 3f793bfc39921e0ed941787458d1b7967ff32c657761ade0a0ff375d4e4b76a8
Instruction ID: 69c586bec0b1877836909e7c59a377f84da9e9a326d5ab994361a03c7ab32cc5
Opcode Fuzzy Hash: 3f793bfc39921e0ed941787458d1b7967ff32c657761ade0a0ff375d4e4b76a8
Instruction Fuzzy Hash: D8016231918615EFDB118B55DC09FAEBBB8FB44B15F044629FC11A22D0DBB49908DB90

Function 00944436 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00944442
int.LIBCPMT ref: 00944455

Part of subcall function 009416B4: std::_Lockit::_Lockit.LIBCPMT ref: 009416C5
Part of subcall function 009416B4: std::_Lockit::~_Lockit.LIBCPMT ref: 009416DF

std::_Facet_Register.LIBCPMT ref: 00944488
std::_Lockit::~_Lockit.LIBCPMT ref: 0094449E
Concurrency::cancel_current_task.LIBCPMT ref: 009444A9

Memory Dump Source

Source File: 00000000.00000002.2154781065.0000000000941000.00000020.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2154721774.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154819903.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154849305.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154920448.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154935513.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154950176.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_SKGOzZRZGX.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 62451fc5c8308a5c0e28c12cc76383173acd79cfaf4a5f0269281f060a54dd94
Instruction ID: 19e78e9579d0d90423a4f5f60e8989eef87a801758216692acec460ef098716b
Opcode Fuzzy Hash: 62451fc5c8308a5c0e28c12cc76383173acd79cfaf4a5f0269281f060a54dd94
Instruction Fuzzy Hash: 0301A276900518ABCB25ABA4D805FAD77A8EFC0760F100659F909A72A1EB70AE41D780

Function 00943DB1 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00943DBD
int.LIBCPMT ref: 00943DD0

Part of subcall function 009416B4: std::_Lockit::_Lockit.LIBCPMT ref: 009416C5
Part of subcall function 009416B4: std::_Lockit::~_Lockit.LIBCPMT ref: 009416DF

std::_Facet_Register.LIBCPMT ref: 00943E03
std::_Lockit::~_Lockit.LIBCPMT ref: 00943E19
Concurrency::cancel_current_task.LIBCPMT ref: 00943E24

Memory Dump Source

Source File: 00000000.00000002.2154781065.0000000000941000.00000020.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2154721774.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154819903.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154849305.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154920448.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154935513.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154950176.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_SKGOzZRZGX.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 37d7b78db1001f6815fc372ad32d94e100fbb4f66dce08bb4ebf06e28235d799
Instruction ID: 89efcb051bf307559a714277efdf97533f2d01997eb8b99fde5171146bb970e4
Opcode Fuzzy Hash: 37d7b78db1001f6815fc372ad32d94e100fbb4f66dce08bb4ebf06e28235d799
Instruction Fuzzy Hash: 5101A272901514ABCB25AB64DD06EAE77A8DFC0760B210149F805A72D1DB74AE41CB80

Function 00944308 Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00944315
int.LIBCPMT ref: 00944328

Part of subcall function 009416B4: std::_Lockit::_Lockit.LIBCPMT ref: 009416C5
Part of subcall function 009416B4: std::_Lockit::~_Lockit.LIBCPMT ref: 009416DF

std::_Facet_Register.LIBCPMT ref: 0094435B
std::_Lockit::~_Lockit.LIBCPMT ref: 00944371
Concurrency::cancel_current_task.LIBCPMT ref: 0094437C

Memory Dump Source

Source File: 00000000.00000002.2154781065.0000000000941000.00000020.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2154721774.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154819903.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154849305.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154920448.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154935513.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154950176.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_SKGOzZRZGX.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 9a2da36856d2d30fdcf22ea073a99bb4ad3a2c562bb5dfaa86346adba8dcde26
Instruction ID: e5bcde30fab04ec8b3804079ae481b4253fe9327b0f7688c12c50a041a0634d0
Opcode Fuzzy Hash: 9a2da36856d2d30fdcf22ea073a99bb4ad3a2c562bb5dfaa86346adba8dcde26
Instruction Fuzzy Hash: C001D636900528ABCB25BF64D906FED7768AFC1B60B110159F805AB2D1EF709E45CBC0

Function 0094507A Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00945081
std::_Lockit::_Lockit.LIBCPMT ref: 0094508C
std::locale::_Setgloballocale.LIBCPMT ref: 009450A7
_Yarn.LIBCPMT ref: 009450BD
std::_Lockit::~_Lockit.LIBCPMT ref: 009450FA

Memory Dump Source

Source File: 00000000.00000002.2154781065.0000000000941000.00000020.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2154721774.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154819903.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154849305.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154920448.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154935513.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154950176.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_SKGOzZRZGX.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$H_prolog3Lockit::_Lockit::~_SetgloballocaleYarnstd::locale::_
String ID:
API String ID: 156189095-0
Opcode ID: 6e82ec98b89cc9d777358b0096657ec228244a24f67cf4a663bd0b558a3548c0
Instruction ID: dc090a4f186f5cb8c85bfc83e4238c4736a5f911920b51c60e6ecf1cd1e7ed73
Opcode Fuzzy Hash: 6e82ec98b89cc9d777358b0096657ec228244a24f67cf4a663bd0b558a3548c0
Instruction Fuzzy Hash: 7801DF75A085649BD70AEF60DC61F7CBBA1BFC9350B158009E81117382CFB4AE01DBC1

Function 0098961A Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00989626

Part of subcall function 00988E77: __getptd_noexit.LIBCMT ref: 00988E7A
Part of subcall function 00988E77: __amsg_exit.LIBCMT ref: 00988E87

__getptd.LIBCMT ref: 0098963D
__amsg_exit.LIBCMT ref: 0098964B
__lock.LIBCMT ref: 0098965B
__updatetlocinfoEx_nolock.LIBCMT ref: 0098966F

Memory Dump Source

Source File: 00000000.00000002.2154849305.000000000096D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2154721774.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154781065.0000000000941000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154819903.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154920448.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154935513.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154950176.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_SKGOzZRZGX.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: d724d9d4d980fd5611dec467c746fa333166a6991964497677ff17d61b2cffb3
Instruction ID: c2dacb5eb4b62ac688a09915b8f07a7e9528da13265b832c36a323a3d52dd61d
Opcode Fuzzy Hash: d724d9d4d980fd5611dec467c746fa333166a6991964497677ff17d61b2cffb3
Instruction Fuzzy Hash: CBF0B432A05710DBDB21BBA85807B2E7390AF80724FAD0149F404AA7D3DF389940DB5A

Function 0094B3A2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,0094B353,00000000,?,009BB6E4,?,?,?,0094B4F6,00000004,InitializeCriticalSectionEx,00964BD8,InitializeCriticalSectionEx), ref: 0094B3AF
GetLastError.KERNEL32(?,0094B353,00000000,?,009BB6E4,?,?,?,0094B4F6,00000004,InitializeCriticalSectionEx,00964BD8,InitializeCriticalSectionEx,00000000,?,0094B2AD), ref: 0094B3B9
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 0094B3E1

Strings

api-ms-, xrefs: 0094B3C6

Memory Dump Source

Source File: 00000000.00000002.2154781065.0000000000941000.00000020.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2154721774.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154819903.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154849305.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154920448.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154935513.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154950176.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_SKGOzZRZGX.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 06618bebcebefa742d33bd249db7dcc720cb769881410c0efdda788742733a0e
Instruction ID: 319459f61e20b51a3b04a796de612066ba1db931a0daa40d2fd15670bdf123ef
Opcode Fuzzy Hash: 06618bebcebefa742d33bd249db7dcc720cb769881410c0efdda788742733a0e
Instruction Fuzzy Hash: A7E04F30288204B7EF211FB2EC4AF193F68AB10B45F108025FA0CE80E1E7B2DA649684

Function 00957747 Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(87E9FD49,00000000,00000000,00000000), ref: 009577AA

Part of subcall function 0095952A: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00958FD3,?,00000000,-00000008), ref: 009595D6

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00957A05
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00957A4D
GetLastError.KERNEL32 ref: 00957AF0

Memory Dump Source

Source File: 00000000.00000002.2154781065.0000000000941000.00000020.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2154721774.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154819903.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154849305.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154920448.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154935513.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154950176.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_SKGOzZRZGX.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: a3016e800fd2a19e42b429d2e847e3154b9b91ff7d320530cadd61ce06483447
Instruction ID: b2f804cc4fdc3af0f31bbc8f3fcb69eb9ae33b2a99e47e16373c0f50824544d5
Opcode Fuzzy Hash: a3016e800fd2a19e42b429d2e847e3154b9b91ff7d320530cadd61ce06483447
Instruction Fuzzy Hash: 90D17975D082589FCF05CFE9D880AADFBB9FF49301F18452AE865EB251D730AA45CB50

Function 0094A371 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0094A438
___AdjustPointer.LIBCMT ref: 0094A45B
___AdjustPointer.LIBCMT ref: 0094A4F7

Memory Dump Source

Source File: 00000000.00000002.2154781065.0000000000941000.00000020.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2154721774.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154819903.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154849305.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154920448.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154935513.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154950176.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_SKGOzZRZGX.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 710bc0cd6455be0b4965655b636a850fd2684e88d1c648d661045eaa611e46d8
Instruction ID: 9c0be43ee19b1b1846cc2791071a3e414552b0dedb0fcd25c7f280a1f73de368
Opcode Fuzzy Hash: 710bc0cd6455be0b4965655b636a850fd2684e88d1c648d661045eaa611e46d8
Instruction Fuzzy Hash: 635126726852069FDB259F95D885FBEB3B8EF40320F24452DE815872A1E771EC40DB92

Function 009606EF Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,00000000,?,0095F713,00000000,00000001,00000000,00000000,?,00957B44,00000000,00000000,00000000), ref: 00960706
GetLastError.KERNEL32(?,0095F713,00000000,00000001,00000000,00000000,?,00957B44,00000000,00000000,00000000,00000000,00000000,?,009580CB,00000000), ref: 00960712

Part of subcall function 009606D8: CloseHandle.KERNEL32(FFFFFFFE,00960722,?,0095F713,00000000,00000001,00000000,00000000,?,00957B44,00000000,00000000,00000000,00000000,00000000), ref: 009606E8

___initconout.LIBCMT ref: 00960722

Part of subcall function 0096069A: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,009606C9,0095F700,00000000,?,00957B44,00000000,00000000,00000000,00000000), ref: 009606AD

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,?,0095F713,00000000,00000001,00000000,00000000,?,00957B44,00000000,00000000,00000000,00000000), ref: 00960737

Memory Dump Source

Source File: 00000000.00000002.2154781065.0000000000941000.00000020.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2154721774.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154819903.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154849305.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154920448.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154935513.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154950176.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_SKGOzZRZGX.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 8566ebfdfb886daaeeb9d81d3360316d6e52b8cac943935ef71777027e123489
Instruction ID: 7d0cb61820e705495f13cf50156b1336430a0ca309862178bb429a2a8ee2fab0
Opcode Fuzzy Hash: 8566ebfdfb886daaeeb9d81d3360316d6e52b8cac943935ef71777027e123489
Instruction Fuzzy Hash: 12F06536559154BBCF221FD6DC08A8E3FA6FF893A1F014114FA1D96130CA728920FF90

Function 0094A060 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 0094A09F
__IsNonwritableInCurrentImage.LIBCMT ref: 0094A153

Strings

csm, xrefs: 0094A13D

Memory Dump Source

Source File: 00000000.00000002.2154781065.0000000000941000.00000020.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2154721774.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154819903.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154849305.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154920448.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154935513.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154950176.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_SKGOzZRZGX.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 47e477f4cace5d62c78ec99d7422bd2d7545c0dfeea5c8fafbf07efc1a9dd56b
Instruction ID: e8700e026cbd83adc036d47572e899cce0ed82ded963c35b1017807dd6cd1c6b
Opcode Fuzzy Hash: 47e477f4cace5d62c78ec99d7422bd2d7545c0dfeea5c8fafbf07efc1a9dd56b
Instruction Fuzzy Hash: C441C434E08218DBCF10DF69C881FAEBBB5AF89318F148155E814AB392D775DE41CB92

Function 0094A96D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 0094A992

Strings

RCC, xrefs: 0094A9AC
MOC, xrefs: 0094A9A4

Memory Dump Source

Source File: 00000000.00000002.2154781065.0000000000941000.00000020.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2154721774.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154819903.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154849305.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154920448.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154935513.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154950176.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_SKGOzZRZGX.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 6ddb76867c2a29f6292b87f8510f783ebac12f7d83956bb0cdc9f90003725a94
Instruction ID: 8d96739efc65e189405cdc988715ece604ba4c022ce0f91fa00b5ac23a4aba47
Opcode Fuzzy Hash: 6ddb76867c2a29f6292b87f8510f783ebac12f7d83956bb0cdc9f90003725a94
Instruction Fuzzy Hash: A6415971940209AFCF16DF98CD81EEEBBBAFF48304F198159FA04A7221E3359950DB52

Function 00984FD8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 0098504A
__aulldiv.LIBCMT ref: 00985058

Strings

@, xrefs: 00985025

Memory Dump Source

Source File: 00000000.00000002.2154849305.000000000096D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2154721774.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154781065.0000000000941000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154819903.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154920448.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154935513.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154950176.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_SKGOzZRZGX.jbxd

Yara matches

Similarity

API ID: __aulldiv
String ID: @
API String ID: 3732870572-2766056989
Opcode ID: 7e71b2cf3ab39a96845f2c5ec6281b05558ac3270fef8c112806fab1e15290c3
Instruction ID: b35c26d1ab892c2aa4e0409833835c09cf9959ac7f6d3e2a4cea2c8d67e3241a
Opcode Fuzzy Hash: 7e71b2cf3ab39a96845f2c5ec6281b05558ac3270fef8c112806fab1e15290c3
Instruction Fuzzy Hash: 43215CB1E44208ABEB00EFD4CC49FAEB7B9FB45B00F104609F605BB280C77969058BA5

Function 0096E0F8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 0096E130
__aulldiv.LIBCMT ref: 0096E13E

Strings

@, xrefs: 0096E10B

Memory Dump Source

Source File: 00000000.00000002.2154849305.000000000096D000.00000004.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2154721774.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154781065.0000000000941000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154819903.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154920448.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154935513.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154950176.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_SKGOzZRZGX.jbxd

Yara matches

Similarity

API ID: __aulldiv
String ID: @
API String ID: 3732870572-2766056989
Opcode ID: e3d9931386e0fa91028f4e7641da7fda79c4023127bcc5196728e9d9e144d5c4
Instruction ID: b630e0103e3d74daf37c6b184000b285678db4664d1242adc18b7a05ff0b2cd4
Opcode Fuzzy Hash: e3d9931386e0fa91028f4e7641da7fda79c4023127bcc5196728e9d9e144d5c4
Instruction Fuzzy Hash: F9014BB4944308FBEB10EBE0CC4AB9DBB78EB41701F208449E60477280D6B459469B59

Function 009415DF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 009415E6
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0094161E

Part of subcall function 00945178: _Yarn.LIBCPMT ref: 00945197
Part of subcall function 00945178: _Yarn.LIBCPMT ref: 009451BB

Strings

bad locale name, xrefs: 0094162C

Memory Dump Source

Source File: 00000000.00000002.2154781065.0000000000941000.00000020.00000001.01000000.00000003.sdmp, Offset: 00940000, based on PE: true

Associated: 00000000.00000002.2154721774.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154819903.0000000000963000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154849305.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154920448.00000000009BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154935513.00000000009BB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2154950176.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_SKGOzZRZGX.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: cc5506982c48ff91524108f019bf656c5f1249f8fdbadc7a418852a73c74fa10
Instruction ID: a13ca33a241684943d6b74dbf5be022b7bb0c55cb084ce10bc4c4e4e293998ae
Opcode Fuzzy Hash: cc5506982c48ff91524108f019bf656c5f1249f8fdbadc7a418852a73c74fa10
Instruction Fuzzy Hash: D9F01775509B909E83319FBA8481947FBE4BE683103948A2FE0DEC3A12D730E404CB6A

Analysis Process: MSBuild.exePID: 6544, Parent PID: 5636COMMON

Execution Graph

Execution Coverage:	19%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.2%
Total number of Nodes:	1598
Total number of Limit Nodes:	4

Executed Functions

Function 004045C0 Relevance: 112.1, APIs: 34, Strings: 30, Instructions: 114
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045CC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045D7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045E2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045ED
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045F8
GetProcessHeap.KERNEL32(00000000,?,?,0000000F,?,004169FB), ref: 00404607
RtlAllocateHeap.NTDLL(00000000,?,0000000F,?,004169FB), ref: 0040460E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040461C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404627
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404632
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040463D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404648
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040465C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404667
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404672
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040467D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404688
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046B1
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046BC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046C7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046D2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046DD
strlen.MSVCRT ref: 004046F0
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404718
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404723
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040472E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404739
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404744
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404754
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040475F
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040476A
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404775
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404780
VirtualProtect.KERNELBASE(?,00000004,00000100,00000000), ref: 0040479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404643

Memory Dump Source

Source File: 00000002.00000002.2474401417.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrlen$Heap$AllocateProcessProtectVirtualstrlen
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 2127927946-2218711628
Opcode ID: 5acfa23b78d647d16e3131d476f18804c650b7bf61bc6c67ff7474173f5a2b8f
Instruction ID: d74624c404fea8bc3833097cd15bfd8a5e03d1640ee24043f2693d34696df282
Opcode Fuzzy Hash: 5acfa23b78d647d16e3131d476f18804c650b7bf61bc6c67ff7474173f5a2b8f
Instruction Fuzzy Hash: DF41A979740624EBC71C9FE5EC89B997F60AB8C712BA0C062F90299190C7FAD5119B3D

Function 00418680 Relevance: 6.1, APIs: 4, Instructions: 77
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,004205B7), ref: 004186CA
Process32First.KERNEL32(?,00000128), ref: 004186DE
Process32Next.KERNEL32(?,00000128), ref: 004186F3
CloseHandle.KERNELBASE(?), ref: 00418761

Memory Dump Source

Source File: 00000002.00000002.2474401417.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: a565577679dd8a0504a1d15f914896fe3659e154cb8e13ffca774fc0674d62c6
Instruction ID: 8f5abf7c5654a811b9b3f094c7d3948ba22bca0c3321aba4e2188e2e86b1b5ea
Opcode Fuzzy Hash: a565577679dd8a0504a1d15f914896fe3659e154cb8e13ffca774fc0674d62c6
Instruction Fuzzy Hash: F7315E71902218ABCB24EF95DC45FEEB778EF45714F10419EF10AA21A0DF386A85CFA5

Function 00417B90 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNELBASE(?,00000002,?,00000200), ref: 00417C62

Strings

/ , xrefs: 00417C7F

Memory Dump Source

Source File: 00000002.00000002.2474401417.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: /
API String ID: 2299586839-4001269591
Opcode ID: 08381a4b7f1aa01ac9a5d03d4b0a0666cc02ab67458fdc9de76e0bd8478d1419
Instruction ID: 4337a3d4516c1007e731de4e6e4702528bfdb1ea37c67bd3aa396c5a1b158d15
Opcode Fuzzy Hash: 08381a4b7f1aa01ac9a5d03d4b0a0666cc02ab67458fdc9de76e0bd8478d1419
Instruction Fuzzy Hash: 6B415E71941118ABDB24DB94DC99FEEB378FF44714F20419AE10962281DB382FC6CFA5

Function 00417A30 Relevance: 1.5, APIs: 1, Instructions: 49timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNELBASE(?,?,?,?,00000000,00000000,?,?,00000000,?,00420E10,00000000,?,00000000,00000000,?), ref: 00417A7D

Memory Dump Source

Source File: 00000002.00000002.2474401417.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID:
API String ID: 565725191-0
Opcode ID: b881c6b0ead1d296197200307cca27ecd4ed8ab0e7bcc50e28ea7705d7869b14
Instruction ID: 8af700d3b0e32b47e9d6ddd9198ddf9a5cfc8e3ba9127fd648bfb7377b14e362
Opcode Fuzzy Hash: b881c6b0ead1d296197200307cca27ecd4ed8ab0e7bcc50e28ea7705d7869b14
Instruction Fuzzy Hash: 461152B1A45228EFEB108B54DC45F9AB7B8FB05711F10439AE516932C0D7785A40CF55

Function 00417850 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041789F

Memory Dump Source

Source File: 00000002.00000002.2474401417.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 98be1400a0f13b17dcfec3579e84c662f1c1c1bd9e35413721d24a5daf15813c
Instruction ID: ff9f3fb77af2488786a742b30a7a77c7a6675fe12b7944dcc27658a291e6e945
Opcode Fuzzy Hash: 98be1400a0f13b17dcfec3579e84c662f1c1c1bd9e35413721d24a5daf15813c
Instruction Fuzzy Hash: 08F04FB5D44208AFC710DFD8DD49BAEBBB8EB05711F10025AFA05A2680C77815448BA2

Function 00401160 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,?,00416A17,00420AEF), ref: 0040116A

Memory Dump Source

Source File: 00000002.00000002.2474401417.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 5e169adc815d3d5e963ffc5450d2c06f987a57c1971b55ed15331b47ed99491e
Instruction ID: a8b5f4e8781596c88644d8aa2969b9d6e82c50da38cf1cac8898b5ca04c80d98
Opcode Fuzzy Hash: 5e169adc815d3d5e963ffc5450d2c06f987a57c1971b55ed15331b47ed99491e
Instruction Fuzzy Hash: F4D05E7C94030CEBCB14EFE0D9496DDBB79FB0D311F001559ED0572340EA306481CAA6

Function 00419C10 Relevance: 18.2, APIs: 8, Strings: 2, Instructions: 684
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A03D
LoadLibraryA.KERNELBASE(?,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A04E
LoadLibraryA.KERNELBASE(?,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A060
LoadLibraryA.KERNELBASE(?,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A072
LoadLibraryA.KERNELBASE(?,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A083
LoadLibraryA.KERNELBASE(?,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A095
LoadLibraryA.KERNELBASE(?,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A0A7
LoadLibraryA.KERNELBASE(?,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A0B8

Strings

InternetSetOptionA, xrefs: 0041A5E5
HttpQueryInfoA, xrefs: 0041A5FC

Memory Dump Source

Source File: 00000002.00000002.2474401417.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 1029625771-1775429166
Opcode ID: 62050089a8b8835eafd1d37742ef1b979ae5b20786234f8d6d940be7715c0619
Instruction ID: b148544ec257a615b167952e2e9b89b3667e8f5620887ecf26b211dda149ff7d
Opcode Fuzzy Hash: 62050089a8b8835eafd1d37742ef1b979ae5b20786234f8d6d940be7715c0619
Instruction Fuzzy Hash: 02621DBD5C0200BFD364DFE8EE889A63BFBF74E701714A61AE609C3264D6399441DB52

Function 00405100 Relevance: 17.1, APIs: 3, Strings: 8, Instructions: 569
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

memcpy.MSVCRT(?,00000000,00000000), ref: 0040578F
memcpy.MSVCRT(?), ref: 004057B6
memcpy.MSVCRT(?), ref: 004057F1

Strings

------, xrefs: 00405297
------, xrefs: 0040563B
", xrefs: 004055C4
------, xrefs: 004053B7
--, xrefs: 00405280
------, xrefs: 004054F9
", xrefs: 00405482
", xrefs: 00405706

Memory Dump Source

Source File: 00000002.00000002.2474401417.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ??2@memcpy$CrackInternet
String ID: ------$"$"$"$--$------$------$------
API String ID: 2445727885-2774362122
Opcode ID: 8235bc1225a5e175669867b2abb12fe628427973e28784d23146d92d1409c7f3
Instruction ID: d07ba18edd097c444f0f2b194d739d2ed1db848351cdebbd5bd0839dcb06e227
Opcode Fuzzy Hash: 8235bc1225a5e175669867b2abb12fe628427973e28784d23146d92d1409c7f3
Instruction Fuzzy Hash: DA3262B1921118ABDB14FBA1DC91FEE7378BF14714F40415EF10662092DF782A9ACF69

Function 00418320 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 196
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00020019,00000000,004205B6), ref: 004183A4
RegEnumKeyExA.KERNELBASE(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00418426
RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00020019,00000000), ref: 0041847B

Strings

- , xrefs: 004185A3
?, xrefs: 0041837A
%s\%s, xrefs: 0041844D

Memory Dump Source

Source File: 00000002.00000002.2474401417.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Open$Enum
String ID: - $%s\%s$?
API String ID: 462099255-3278919252
Opcode ID: dd6617512d8e06e62f9c4619fa979c9d7048b8557595c82cd813ea9da7bb7c9e
Instruction ID: f03ee3f6de4a678c4a24becac03c3675d5d4362b87af83515ad79f9b006405b7
Opcode Fuzzy Hash: dd6617512d8e06e62f9c4619fa979c9d7048b8557595c82cd813ea9da7bb7c9e
Instruction Fuzzy Hash: B4813E75911118ABEB24DF50CD81FEAB7B9FF08714F008299E109A6180DF756BC6CFA5

Function 00406280 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 191
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

InternetOpenA.WININET(00420DFE,00000001,00000000,00000000,00000000,00420DFB), ref: 004062E1
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406335
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004063D1

Strings

ERROR, xrefs: 00406407
ERROR, xrefs: 004064C9
GET, xrefs: 0040637C

Memory Dump Source

Source File: 00000002.00000002.2474401417.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ??2@Internet$ConnectCrackHttpOpenRequestSend
String ID: ERROR$ERROR$GET
API String ID: 3905982082-2509457195
Opcode ID: 460f558118b4083d41359c156125f26ce9f22fb94ebe107836e013dd45d71b95
Instruction ID: 4c22ad93782da972e928cd377ef6cc95e5ae9f8df18decad01f21c65d1bf8a87
Opcode Fuzzy Hash: 460f558118b4083d41359c156125f26ce9f22fb94ebe107836e013dd45d71b95
Instruction Fuzzy Hash: C1718075A00218ABDB24EFE0DC49BEE7775FB44700F10816AF50A6B1D0DBB86A85CF56

Function 00418100 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE(00000040,00000040,00000000), ref: 00418158
__aulldiv.LIBCMT ref: 00418172
__aulldiv.LIBCMT ref: 00418180

Strings

@, xrefs: 0041814D
%d MB, xrefs: 004181A3

Memory Dump Source

Source File: 00000002.00000002.2474401417.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: __aulldiv$GlobalMemoryStatus
String ID: %d MB$@
API String ID: 2185283323-3474575989
Opcode ID: 7e71b2cf3ab39a96845f2c5ec6281b05558ac3270fef8c112806fab1e15290c3
Instruction ID: 96825d9750bf8db03c9b3ba7d6dfdbb869a7567600a83181e99cf30d3b71d0f4
Opcode Fuzzy Hash: 7e71b2cf3ab39a96845f2c5ec6281b05558ac3270fef8c112806fab1e15290c3
Instruction Fuzzy Hash: CD210BB1E44218BBDB00DFD5CC49FAEB7B9FB45B14F104609F605BB280D77869018BA9

Function 004047B0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

Strings

<, xrefs: 004047C9

Memory Dump Source

Source File: 00000002.00000002.2474401417.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ??2@$CrackInternet
String ID: <
API String ID: 676793843-4251816714
Opcode ID: c386c9d0d73067ea41f4377aeaa2fd448281082c22fa9440fc98d6664c6993a8
Instruction ID: 59ffd934fb977a93d501bba2862ecb1df6a0defd032b503e5e890a78b3955a81
Opcode Fuzzy Hash: c386c9d0d73067ea41f4377aeaa2fd448281082c22fa9440fc98d6664c6993a8
Instruction Fuzzy Hash: 712149B5D00219ABDF10DFA5E849BDD7B74FF04320F008229F925A7290EB706A15CF95

Function 00419860 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 212
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?,?,00416A00), ref: 00419A9A
LoadLibraryA.KERNELBASE(?,?,00416A00), ref: 00419AAB
LoadLibraryA.KERNELBASE(?,?,00416A00), ref: 00419ACF

Strings

NtQueryInformationProcess, xrefs: 00419BAA

Memory Dump Source

Source File: 00000002.00000002.2474401417.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 1029625771-2781105232
Opcode ID: 5241b63200b37b02610696a8d235fc94b134fee8225fd0051d7d8784b632fee7
Instruction ID: 20ebc6b46c949eaa7f25e90fb8197bb2e58582eade08509f86bd82c1d7e4afd5
Opcode Fuzzy Hash: 5241b63200b37b02610696a8d235fc94b134fee8225fd0051d7d8784b632fee7
Instruction Fuzzy Hash: 55A14DBD5C4240BFE354EFE8ED889963BFBF74E301704661AE605C3264D639A841DB12

Function 00417500 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 106
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041757F

Strings

:, xrefs: 0041755C
C, xrefs: 0041754C
\, xrefs: 00417560

Memory Dump Source

Source File: 00000002.00000002.2474401417.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: InformationVolume
String ID: :$C$\
API String ID: 2039140958-3809124531
Opcode ID: ed3ca360dd794ca93df171aa1d69aa55e8069c6d35c7c4129d84d5da30dc5272
Instruction ID: 2fa5a76c25c4840d12821100fc964cf287d391274576238511e757cc0c078ff1
Opcode Fuzzy Hash: ed3ca360dd794ca93df171aa1d69aa55e8069c6d35c7c4129d84d5da30dc5272
Instruction Fuzzy Hash: BF41A2B5D44248ABDB10DF94DC45BEEBBB9EF08714F10019DF50967280D778AA84CBA9

Function 00401220 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE(00000040,?,00000000,00000040), ref: 0040123E
__aulldiv.LIBCMT ref: 00401258
__aulldiv.LIBCMT ref: 00401266

Strings

@, xrefs: 00401233

Memory Dump Source

Source File: 00000002.00000002.2474401417.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: __aulldiv$GlobalMemoryStatus
String ID: @
API String ID: 2185283323-2766056989
Opcode ID: e3d9931386e0fa91028f4e7641da7fda79c4023127bcc5196728e9d9e144d5c4
Instruction ID: f2ded3d157cb35307e0b39d430c96622be3dd75f8d5744ac0086d878f352425a
Opcode Fuzzy Hash: e3d9931386e0fa91028f4e7641da7fda79c4023127bcc5196728e9d9e144d5c4
Instruction Fuzzy Hash: 5901FBB0D84308BAEB10DBE4DC49B9EBB78AB15705F20809EE705B62D0D6785585879D

Function 004183DC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNELBASE(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00418426
RegOpenKeyExA.KERNELBASE(00000000,?,00000000,00020019,00000000), ref: 0041847B
RegQueryValueExA.KERNELBASE(00000000,?,00000000,000F003F,?,00000400), ref: 004184EC
RegQueryValueExA.KERNELBASE(00000000,?,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00420B34), ref: 00418599
RegCloseKey.KERNELBASE(00000000), ref: 00418608

Strings

%s\%s, xrefs: 0041844D

Memory Dump Source

Source File: 00000002.00000002.2474401417.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseEnumOpen
String ID: %s\%s
API String ID: 2041898428-4073750446
Opcode ID: 2745a0ba8eb15d3c1f0b65b5c657a669296e82b89610ecc7bb468d10700aed3a
Instruction ID: cdbcbf4b9f8a1ecee5159c9abe2ba9d8dffcfa3e02281556f53420590b8fae77
Opcode Fuzzy Hash: 2745a0ba8eb15d3c1f0b65b5c657a669296e82b89610ecc7bb468d10700aed3a
Instruction Fuzzy Hash: 7B210A75940218AFDB24DB54DC85FE9B3B9FB48704F00C199E60996140DF756A85CFD4

Function 00417690 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000002,?,00000000,00020119,00000000), ref: 004176DD
RegQueryValueExA.KERNELBASE(00000000,?,00000000,00000000,?,000000FF), ref: 004176FE

Strings

Windows 11, xrefs: 004176BD

Memory Dump Source

Source File: 00000002.00000002.2474401417.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: OpenQueryValue
String ID: Windows 11
API String ID: 4153817207-2517555085
Opcode ID: 31b5ee67880bd1f967030e6ea3d78f3b54130d435c20b4c8c69cbeacade70eac
Instruction ID: 0438ef7ee9a5fbee92b010be2e89678c99e6505f2a73f727aa840deaa157456b
Opcode Fuzzy Hash: 31b5ee67880bd1f967030e6ea3d78f3b54130d435c20b4c8c69cbeacade70eac
Instruction Fuzzy Hash: E0018FBDA80204BFE700DBE0DD49FAEB7BDEB09700F004055FA05D7290E674A9408B55

Function 00417720 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000002,?,00000000,00020119,004176B9), ref: 0041775B
RegQueryValueExA.KERNELBASE(004176B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0041777A

Strings

CurrentBuildNumber, xrefs: 00417771

Memory Dump Source

Source File: 00000002.00000002.2474401417.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: OpenQueryValue
String ID: CurrentBuildNumber
API String ID: 4153817207-1022791448
Opcode ID: 43a46ff31c4728249bb55ffe5b6c0263db84e810ad24588de6037cbf7116cf65
Instruction ID: 98fe8272c38af2577472084bebc30d651685970d5c5bfe2bd2220dad028592af
Opcode Fuzzy Hash: 43a46ff31c4728249bb55ffe5b6c0263db84e810ad24588de6037cbf7116cf65
Instruction Fuzzy Hash: 0F0144BDA80308BFE710DFE0DC49FAEB7B9EB44704F104159FA05A7281DA7455408F51

Function 00404FB0 Relevance: 3.1, APIs: 2, Instructions: 82memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00404FD1
KiUserExceptionDispatcher.NTDLL(00000000,?,00000001), ref: 0040508A

Memory Dump Source

Source File: 00000002.00000002.2474401417.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AllocateDispatcherExceptionHeapUser
String ID:
API String ID: 3515689010-0
Opcode ID: 6cf967ef785bb23c697623f5c6a033393d0fc44cd8035483208646c558320f55
Instruction ID: cb0899809939a0b3ab7ef321ba077ef70f04c27eec1e373fde9f1e9505320bf0
Opcode Fuzzy Hash: 6cf967ef785bb23c697623f5c6a033393d0fc44cd8035483208646c558320f55
Instruction Fuzzy Hash: 2A3108B8A40218ABDB20CF94DC85BDDB7B5EB48704F1081E9F709B7281C7746AC58F99

Function 00417E00 Relevance: 3.1, APIs: 2, Instructions: 58registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000002,?,00000000,00020119,?), ref: 00417E5E
RegQueryValueExA.KERNELBASE(?,?,00000000,00000000,000000FF,000000FF), ref: 00417E7F

Memory Dump Source

Source File: 00000002.00000002.2474401417.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: OpenQueryValue
String ID:
API String ID: 4153817207-0
Opcode ID: f2207629c624761bbe8885f03498d73c435f9e088398b1cc221a346ec08661e3
Instruction ID: f35b37edc560d93cca1bbeb044924e1a71a0ba88b9c12cde0d27c4035fcf8d53
Opcode Fuzzy Hash: f2207629c624761bbe8885f03498d73c435f9e088398b1cc221a346ec08661e3
Instruction Fuzzy Hash: 01114CB5A84205FFD710CFD4DD4AFBBBBB9EB09B10F10425AF605A7280D77858018BA6

Function 004169F0 Relevance: 1.6, APIs: 1, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00401160: GetSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,?,00416A17,00420AEF), ref: 0040116A

Part of subcall function 00401110: VirtualAllocExNuma.KERNELBASE(00000000,?,?,00416A1C), ref: 00401132

Part of subcall function 00401220: GlobalMemoryStatusEx.KERNELBASE(00000040,?,00000000,00000040), ref: 0040123E
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401258
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401266

GetUserDefaultLCID.KERNELBASE ref: 00416A26

Part of subcall function 00417850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041789F

Part of subcall function 004178E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0041792F

Memory Dump Source

Source File: 00000002.00000002.2474401417.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: NameUser__aulldiv$AllocComputerDefaultGlobalInfoMemoryNumaStatusSystemVirtual
String ID:
API String ID: 3178950686-0
Opcode ID: 89bd8792c9ea463fe5cd0678b04f38b1ba409c67d9b77676339e57910a337a73
Instruction ID: 00249ead6714b3af85de48d5768f0cff66b99727dd84f15ff7ce73ce32af2852
Opcode Fuzzy Hash: 89bd8792c9ea463fe5cd0678b04f38b1ba409c67d9b77676339e57910a337a73
Instruction Fuzzy Hash: 63316175940208AADB04FBF2DC56BEE7339AF04354F10452EF102A61D2DF7C6996C6AE

Function 004178E0 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

GetComputerNameA.KERNEL32(?,00000104), ref: 0041792F

Memory Dump Source

Source File: 00000002.00000002.2474401417.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: 655548885853275668edecfa1cfdfba2d4285fba1d09bdc7eb36c2d1d55ec877
Instruction ID: 452d18c19ae851532a1d010ea63a4611fd0250a2e86211d30d2d96ca9096ca29
Opcode Fuzzy Hash: 655548885853275668edecfa1cfdfba2d4285fba1d09bdc7eb36c2d1d55ec877
Instruction Fuzzy Hash: 220186F1A48204EFD700DF94DD45BAABBB8FB05B11F10425AF545E3280C37859448BA6

Function 00417ED0 Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(00420E2C), ref: 00417F00

Memory Dump Source

Source File: 00000002.00000002.2474401417.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 6e48eb6c373aebad151474fa646ebf8a74f2430de7cecad2b643f906b25ca64a
Instruction ID: 2fbe6902627a031950d7a3fa851ef95510e90209490a35db063d7eb50f57f6da
Opcode Fuzzy Hash: 6e48eb6c373aebad151474fa646ebf8a74f2430de7cecad2b643f906b25ca64a
Instruction Fuzzy Hash: 53F0F6B5A44218FBC710CF84DC45FEAF7BCF744710F50066AF50592280D37929408BD5

Function 00419470 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 004194A5

Memory Dump Source

Source File: 00000002.00000002.2474401417.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: FileModuleName
String ID:
API String ID: 514040917-0
Opcode ID: 5dd3e3c532ac976404615b3816d87456bc90bb789159ce0b3212725986e21d85
Instruction ID: 2eda5d4ec063f04fe8048fb8b0a850fc323e1bbd58c3ab932ea79d0f281d5f74
Opcode Fuzzy Hash: 5dd3e3c532ac976404615b3816d87456bc90bb789159ce0b3212725986e21d85
Instruction Fuzzy Hash: BEF03A7994020CFBDB15DFA4DC4AFEA7778EB08310F004498BA1997290D6B4AE85CB95

Function 00401110 Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualAllocExNuma.KERNELBASE(00000000,?,?,00416A1C), ref: 00401132

Memory Dump Source

Source File: 00000002.00000002.2474401417.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AllocNumaVirtual
String ID:
API String ID: 4233825816-0
Opcode ID: 3cbd8cc13bf7dc70ab035dff78f9dd202cda3002ce084c09b8f89ce2de56700b
Instruction ID: 516f97497d3ee46bc55051264f2a31c9d8efacdbd59bd60d04d859dfb32d17c4
Opcode Fuzzy Hash: 3cbd8cc13bf7dc70ab035dff78f9dd202cda3002ce084c09b8f89ce2de56700b
Instruction Fuzzy Hash: 76E08674985308FFE7106BE09C0AB0976B9EB05B05F101055F7087A1D0C6B826009699

Function 004010A0 Relevance: 1.3, APIs: 1, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,17C841C0,00003000,00000004,?,?,?,0040114E,?,?,00416A1C), ref: 004010B3

Memory Dump Source

Source File: 00000002.00000002.2474401417.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8ce35272a596f1cdf5aa55b7e6bb44489e409ba54c945097ad2cb9ba566d6231
Instruction ID: e05e9ea69c75ff17789b13d2c0695db9e8f3777892ad192db41722de5b6306ee
Opcode Fuzzy Hash: 8ce35272a596f1cdf5aa55b7e6bb44489e409ba54c945097ad2cb9ba566d6231
Instruction Fuzzy Hash: F2F052B1681208BBE7109BA4AC49FABB3E8E305B14F301408F500E3380C5319E00CAA4

Non-executed Functions

Function 0041B33A Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0041BBA2
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0041BBB7
UnhandledExceptionFilter.KERNEL32(0041F2A8), ref: 0041BBC2
GetCurrentProcess.KERNEL32(C0000409), ref: 0041BBDE
TerminateProcess.KERNEL32(00000000), ref: 0041BBE5

Memory Dump Source

Source File: 00000002.00000002.2474401417.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 1cd9910441f070b69687b64f652d04a4c8002016f1137d447a2cc91201b04508
Instruction ID: 2759986af63cf1bc905e0f8428f5e2b998159022a12c47e0d709fe691c65c3be
Opcode Fuzzy Hash: 1cd9910441f070b69687b64f652d04a4c8002016f1137d447a2cc91201b04508
Instruction Fuzzy Hash: E921A3BC9002059FDB10DF69FD89A963BE4FB0A314F50403AE90A87264DBB45981EF4D

Function 00410250 Relevance: 26.6, APIs: 3, Strings: 12, Instructions: 363stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 0041031B
memset.MSVCRT ref: 004106DD

Part of subcall function 004188E0: malloc.MSVCRT ref: 004188E8
Part of subcall function 004188E0: strncpy.MSVCRT ref: 00418903

strtok_s.MSVCRT ref: 00410679

Strings

profile: null, xrefs: 00410568
<Port>, xrefs: 004103C6
NA, xrefs: 004102CC, 004102F2, 004102CF, 004102F5
url: , xrefs: 00410577
<User>, xrefs: 00410410
login: , xrefs: 004105CA
browser: FileZilla, xrefs: 00410559
NA, xrefs: 0041072E, 004106AF, 004106B2
password: , xrefs: 004105FB
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 004102A4
<Pass encoding="base64">, xrefs: 0041045A
<Host>, xrefs: 0041037C

Memory Dump Source

Source File: 00000002.00000002.2474401417.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: strtok_s$mallocmemsetstrncpy
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$NA$NA$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 2676359353-514892060
Opcode ID: 5617bd6bc83757f25327082bfbfb60fa8d0a6348b7b524702c500f70768eef60
Instruction ID: d15eb70b6d553ab1cc94bc99ca27928082ec116ada4a7d19c18b432e65637ade
Opcode Fuzzy Hash: 5617bd6bc83757f25327082bfbfb60fa8d0a6348b7b524702c500f70768eef60
Instruction Fuzzy Hash: 86D16D75A41208ABCB04FBF1DD86EEE7379FF14314F50441EF102A6091DE78AA96CB69

Function 00410A60 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 205stringprocesssynchronizationCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00410C1C
lstrcatA.KERNEL32(?,00000000), ref: 00410C35
lstrcatA.KERNEL32(?,00420D7C), ref: 00410C47
lstrcatA.KERNEL32(?,00000000), ref: 00410C5D
lstrcatA.KERNEL32(?,00420D80), ref: 00410C6F
lstrcatA.KERNEL32(?,00000000), ref: 00410C88
lstrcatA.KERNEL32(?,00420D84), ref: 00410C9A
lstrlenA.KERNEL32(?), ref: 00410CA7
memset.MSVCRT ref: 00410CCD
memset.MSVCRT ref: 00410CE1
CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000020,00000000,00000000,?,?,00000000,?,00420D88,?,00000000), ref: 00410D5A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00410D66

Strings

.exe, xrefs: 00410A95

Memory Dump Source

Source File: 00000002.00000002.2474401417.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$memset$CreateObjectProcessSingleWaitlstrlen
String ID: .exe
API String ID: 2214552867-4119554291
Opcode ID: 6364e5e739fe9739766a1ce8d8c7e5a183e8e2bdcb2e6e6671a0d6d634042010
Instruction ID: 8c4414bd7b792449c86a3c64e171a12ac7102eaeec46e1acf96b3d3d4dd6cf75
Opcode Fuzzy Hash: 6364e5e739fe9739766a1ce8d8c7e5a183e8e2bdcb2e6e6671a0d6d634042010
Instruction Fuzzy Hash: A78194B55111186BCB14FBA1CD52FEE7338AF44308F40419EB30A66082DE786AD9CF6E

Function 00414D70 Relevance: 21.1, APIs: 4, Strings: 10, Instructions: 119COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00414D87
memset.MSVCRT ref: 00414E13
memset.MSVCRT ref: 00414E9F
memset.MSVCRT ref: 00414F2B

Strings

*.*, xrefs: 00414E64
Azure\.IdentityService, xrefs: 00414EEB
\.azure\, xrefs: 00414DC1
Azure\.azure, xrefs: 00414DD3
*.*, xrefs: 00414DD8
\.aws\, xrefs: 00414E4D
msal.cache, xrefs: 00414EF0
\.IdentityService\, xrefs: 00414ED9
zaA, xrefs: 00414DF1, 00414E7D, 00414F09, 00414F34, 00414DF4, 00414E80, 00414F0C
Azure\.aws, xrefs: 00414E5F

Memory Dump Source

Source File: 00000002.00000002.2474401417.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: memset
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache$zaA
API String ID: 2221118986-156832076
Opcode ID: 63500b277e5d8c6ba40ed9413d1edfa83572fad66260e383529a6b6b95d2c298
Instruction ID: 18812f4626155d1e2a42465cb68794f5c6847905bec5d07e7ac1139e0e5490f3
Opcode Fuzzy Hash: 63500b277e5d8c6ba40ed9413d1edfa83572fad66260e383529a6b6b95d2c298
Instruction Fuzzy Hash: 3141D6B9A4031467C710F7B0EC47FDD3738AB64704F404459B645660C2EEB897D98B9A

Function 004170D0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 136COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00064000), ref: 004170DE
OpenProcess.KERNEL32(001FFFFF,00000000,0041730D,004205BD), ref: 0041711C
memset.MSVCRT ref: 0041716A
??_V@YAXPAX@Z.MSVCRT(?), ref: 004172BE

Strings

sA, xrefs: 004172AE, 00417179, 0041717C
65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0041718C
sA, xrefs: 00417111

Memory Dump Source

Source File: 00000002.00000002.2474401417.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: OpenProcessmemset
String ID: sA$sA$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 1606381396-2614523144
Opcode ID: a73ac6e1bb2c91b578430d02177e5a2f8beb51943881740cc90b8311f986bdaf
Instruction ID: ffe5c4151d56689e238fca5affca6521033e0b5082b25a646ea50ffb364ad3ac
Opcode Fuzzy Hash: a73ac6e1bb2c91b578430d02177e5a2f8beb51943881740cc90b8311f986bdaf
Instruction Fuzzy Hash: 71515FB0D04218ABDB14EB91DD85BEEB774AF04304F1040AEE61576281EB786AC9CF5D

Function 004138B0 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 250COMMON

Download Yara Rule

Strings

%s\*, xrefs: 004138C0
%s\%s, xrefs: 0041397A
%s\%s\%s, xrefs: 00413A4A
%s%s, xrefs: 00413AAD
%s\%s, xrefs: 00413A6F
!=A, xrefs: 00413C82, 00413C45, 00413B69, 00413909, 00413B6C, 00413C48

Memory Dump Source

Source File: 00000002.00000002.2474401417.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID:
String ID: !=A$%s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 0-817767981
Opcode ID: c3ad0e5f37a6afd264e19c98f003c489031be70fef7a74d9d5741692706db697
Instruction ID: 6b32dcbabd2ae606338a05af88a65253e6d0136fcb4401239c8972690a9ca057
Opcode Fuzzy Hash: c3ad0e5f37a6afd264e19c98f003c489031be70fef7a74d9d5741692706db697
Instruction Fuzzy Hash: 45A182B5A40218ABDB20DFA4DC85FEA7379BF45301F04458DB50D96181EB789B84CF66

Function 00405960 Relevance: 11.0, APIs: 2, Strings: 5, Instructions: 493COMMON

Download Yara Rule

APIs

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

memcpy.MSVCRT(?,00000000,00000000), ref: 00405EC6
memcpy.MSVCRT(?), ref: 00405EFE

Strings

", xrefs: 00405CD5
", xrefs: 00405E16
------, xrefs: 00405A96
------, xrefs: 00405C0B
------, xrefs: 00405D4C

Memory Dump Source

Source File: 00000002.00000002.2474401417.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ??2@$memcpy$CrackInternet
String ID: "$"$------$------$------
API String ID: 4271525049-2180234286
Opcode ID: 4205a6c64491eede6f2c0190817c01b6d1188d899bee5cc8d5380a99dbe7c93c
Instruction ID: 7b5b204680124ce1d4beb717fdfef1c68a0c63715f2d18b0248442adb904f056
Opcode Fuzzy Hash: 4205a6c64491eede6f2c0190817c01b6d1188d899bee5cc8d5380a99dbe7c93c
Instruction Fuzzy Hash: 20124071821118ABCB15FBA1DC95FEEB378BF14314F50419EB10A62091DF782B9ACF69

Function 00409E10 Relevance: 10.7, APIs: 3, Strings: 4, Instructions: 167COMMON

Download Yara Rule

APIs

memcmp.MSVCRT(?,v20,00000003), ref: 00409E2D

Part of subcall function 00410A60: memset.MSVCRT ref: 00410C1C
Part of subcall function 00410A60: lstrcatA.KERNEL32(?,00000000), ref: 00410C35
Part of subcall function 00410A60: lstrcatA.KERNEL32(?,00420D7C), ref: 00410C47
Part of subcall function 00410A60: lstrcatA.KERNEL32(?,00000000), ref: 00410C5D
Part of subcall function 00410A60: lstrcatA.KERNEL32(?,00420D80), ref: 00410C6F

memcmp.MSVCRT(?,v10,00000003), ref: 00409EAF
memset.MSVCRT ref: 00409EE8

Strings

ERROR_RUN_EXTRACTOR, xrefs: 00409E67
v10, xrefs: 00409EA3
v20, xrefs: 00409E21
@, xrefs: 00409EF1

Memory Dump Source

Source File: 00000002.00000002.2474401417.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$memcmpmemset
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 1976689032-1096346117
Opcode ID: cf3bd8b6a91d7380b4fcfdc4a2eaf8d3038d72e2fe7c69aa23c32b41aba9b41f
Instruction ID: cfc602575c7eb8b90e75612a825b183f0a0020e5ceb1952e76b28d7f8d83ce04
Opcode Fuzzy Hash: cf3bd8b6a91d7380b4fcfdc4a2eaf8d3038d72e2fe7c69aa23c32b41aba9b41f
Instruction Fuzzy Hash: C9615F30A00248EBCB24EFA5DD96FED7775AF44304F408029F90A6F1D1DB786A56CB5A

Function 00401310 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 139COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00401327
memset.MSVCRT ref: 00401516

Strings

SOFTWARE\monero-project\monero-core, xrefs: 00401335
.keys, xrefs: 0040136B
wallet_path, xrefs: 00401330
\Monero\wallet.keys, xrefs: 0040138D

Memory Dump Source

Source File: 00000002.00000002.2474401417.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: memset
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 2221118986-218353709
Opcode ID: cf61a2f323856c46ff2e2e2879a4bb7527e8331aca03d31e6698724a443a2e3c
Instruction ID: 2d64d6a561879fca44fb71c04a0a84c7ebf7a9ed2d970630d286a4d87e6dc5bb
Opcode Fuzzy Hash: cf61a2f323856c46ff2e2e2879a4bb7527e8331aca03d31e6698724a443a2e3c
Instruction Fuzzy Hash: 955165B1D5011897CB15FB61DD91FED733CAF54304F4041ADB60A62092EE385BDACBAA

Function 004152C0 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 138stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406280: InternetOpenA.WININET(00420DFE,00000001,00000000,00000000,00000000,00420DFB), ref: 004062E1
Part of subcall function 00406280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406335
Part of subcall function 00406280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004063D1

strtok.MSVCRT(00000000,?), ref: 0041539E

Strings

ERROR, xrefs: 0041530A
ERROR, xrefs: 00415432
ERROR, xrefs: 004154A9
ERROR, xrefs: 004153B9
ERROR, xrefs: 0041546F

Memory Dump Source

Source File: 00000002.00000002.2474401417.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internet$ConnectHttpOpenRequestSendstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 632984754-1526165396
Opcode ID: 4a2ea036609cd15b672270c35ab07a18dfd7f62b3a06473966441f12aab465d2
Instruction ID: 2e955e57ea7f1c083e6e45f715f374ff83ee784ca3e0e9be4ff8c8b21657e330
Opcode Fuzzy Hash: 4a2ea036609cd15b672270c35ab07a18dfd7f62b3a06473966441f12aab465d2
Instruction Fuzzy Hash: 1A514130911108EBCB14FF61CD92AED7779AF50358F50402EF80A6B591DF386B96CB6A

Function 0041B38C Relevance: 9.1, APIs: 6, Instructions: 98COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 0041B39A

Part of subcall function 0041AFAC: __mtinitlocknum.LIBCMT ref: 0041AFC2
Part of subcall function 0041AFAC: __amsg_exit.LIBCMT ref: 0041AFCE
Part of subcall function 0041AFAC: EnterCriticalSection.KERNEL32(?,?,?,0041AC60,0000000E,0042A0E0,0000000C,0041AC2A), ref: 0041AFD6

DecodePointer.KERNEL32(0042A120,00000020,0041B4DD,?,00000001,00000000,?,0041B4FF,000000FF,?,0041AFD3,00000011,?,?,0041AC60,0000000E), ref: 0041B3D6
DecodePointer.KERNEL32(?,0041B4FF,000000FF,?,0041AFD3,00000011,?,?,0041AC60,0000000E,0042A0E0,0000000C,0041AC2A), ref: 0041B3E7

Part of subcall function 0041BE35: EncodePointer.KERNEL32(00000000,0041C063,004495B8,00000314,00000000,?,?,?,?,?,0041B707,004495B8,Microsoft Visual C++ Runtime Library,00012010), ref: 0041BE37

DecodePointer.KERNEL32(-00000004,?,0041B4FF,000000FF,?,0041AFD3,00000011,?,?,0041AC60,0000000E,0042A0E0,0000000C,0041AC2A), ref: 0041B40D
DecodePointer.KERNEL32(?,0041B4FF,000000FF,?,0041AFD3,00000011,?,?,0041AC60,0000000E,0042A0E0,0000000C,0041AC2A), ref: 0041B420
DecodePointer.KERNEL32(?,0041B4FF,000000FF,?,0041AFD3,00000011,?,?,0041AC60,0000000E,0042A0E0,0000000C,0041AC2A), ref: 0041B42A

Memory Dump Source

Source File: 00000002.00000002.2474401417.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$CriticalEncodeEnterSection__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2005412495-0
Opcode ID: 0b0bc3cab5f7049983f26cd80e00dd0aa4f75dbf31a2a29bc74296bdc4549019
Instruction ID: 13f01492c0df899e955246e6d1acdef18d299a0ed6057d30a0a2a93d2b0efa88
Opcode Fuzzy Hash: 0b0bc3cab5f7049983f26cd80e00dd0aa4f75dbf31a2a29bc74296bdc4549019
Instruction Fuzzy Hash: D6312874901349DFDF109FA9C9452DEBAF1FF48314F14802BE414A6262CBB94895DFAE

Function 0041C9DE Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041C9EA

Part of subcall function 0041BF9F: __getptd_noexit.LIBCMT ref: 0041BFA2
Part of subcall function 0041BF9F: __amsg_exit.LIBCMT ref: 0041BFAF

__amsg_exit.LIBCMT ref: 0041CA0A
__lock.LIBCMT ref: 0041CA1A
InterlockedDecrement.KERNEL32(?), ref: 0041CA37
free.MSVCRT ref: 0041CA4A
InterlockedIncrement.KERNEL32(0042B558), ref: 0041CA62

Memory Dump Source

Source File: 00000002.00000002.2474401417.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lockfree
String ID:
API String ID: 634100517-0
Opcode ID: 8fe1d07e46c7f7a05b9aade772f191e19f6fe2cab31bcbc29ba7bdc60f9379df
Instruction ID: 83df0cd24f2ef528265bdd767f82c36d0b02d0b672a998c6c347af455cc5eb0e
Opcode Fuzzy Hash: 8fe1d07e46c7f7a05b9aade772f191e19f6fe2cab31bcbc29ba7bdc60f9379df
Instruction Fuzzy Hash: DF01C431A817299BC722EB669C857DE77A0BF04794F01811BE80467390C72C69D2CBDD

Function 00416F00 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00416F1F
??_U@YAPAXI@Z.MSVCRT(00000000,?,?,?,?,?,?,?,?,0041719A,00000000,65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30,00000000,00000000), ref: 00416F4D

Part of subcall function 00416BD0: strlen.MSVCRT ref: 00416BE1
Part of subcall function 00416BD0: strlen.MSVCRT ref: 00416C05

VirtualQueryEx.KERNEL32(?,00000000,?,0000001C), ref: 00416F92
??_V@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041719A), ref: 004170B3

Part of subcall function 00416DE0: ReadProcessMemory.KERNEL32(00000000,00000000,?,?,00000000,00064000,00064000,00000000,00000004), ref: 00416DF8

Strings

@, xrefs: 00416FA6

Memory Dump Source

Source File: 00000002.00000002.2474401417.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: strlen$MemoryProcessQueryReadVirtual
String ID: @
API String ID: 2950663791-2766056989
Opcode ID: 0d89010186691ec5492239175b82a1a91f8bc2a2393b87c9978cf9f8736f9be8
Instruction ID: da6ee04ed372484ea639f8c5ae6d2cf8ded6d6947598eb42fecba3fc0a9bdd2e
Opcode Fuzzy Hash: 0d89010186691ec5492239175b82a1a91f8bc2a2393b87c9978cf9f8736f9be8
Instruction Fuzzy Hash: 27511CB5E041099BDB04CF98D981AEFBBB5FF88304F108559F919A7340D738EA51CBA5

Function 0041C742 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041C74E

Part of subcall function 0041BF9F: __getptd_noexit.LIBCMT ref: 0041BFA2
Part of subcall function 0041BF9F: __amsg_exit.LIBCMT ref: 0041BFAF

__getptd.LIBCMT ref: 0041C765
__amsg_exit.LIBCMT ref: 0041C773
__lock.LIBCMT ref: 0041C783
__updatetlocinfoEx_nolock.LIBCMT ref: 0041C797

Memory Dump Source

Source File: 00000002.00000002.2474401417.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 3d7c1e79db36087730c99ab0a6624c72b46b4ffdd1162626bf4921dca9482436
Instruction ID: 8b8854a621eee9d40ba0401ebc9f05e8605540fb6beb74f1d93a4957509c98f2
Opcode Fuzzy Hash: 3d7c1e79db36087730c99ab0a6624c72b46b4ffdd1162626bf4921dca9482436
Instruction Fuzzy Hash: 1AF09632A817119BD7207BB95C867DE33A09F00728F24414FF414A62D2CBAC59D28E9E

Function 00409CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

memcmp.MSVCRT(?,DPAPI,00000005), ref: 00409D92

Part of subcall function 00409B60: memcpy.MSVCRT(?,?,?), ref: 00409BC6

Strings

DPAPI, xrefs: 00409D89
, xrefs: 00409DC1
"encrypted_key":", xrefs: 00409D30

Memory Dump Source

Source File: 00000002.00000002.2474401417.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: memcmpmemcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 1784268899-738592651
Opcode ID: 858bb5d36e7e37b9704747d5b8cf33c67ecf781cccc3ca8f5e8d480075c2e052
Instruction ID: 5ad523267ed72994677b79ea1d9dce7d7822fbf486e040e59600fa97cf483dfd
Opcode Fuzzy Hash: 858bb5d36e7e37b9704747d5b8cf33c67ecf781cccc3ca8f5e8d480075c2e052
Instruction Fuzzy Hash: D53155B5D10109ABCB04EBE4DC85AEF77B8BF44304F14452AE915B7282E7389E04CBA5

Function 004117A0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 160stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 004117E8
strtok_s.MSVCRT ref: 004119A8

Strings

block, xrefs: 004117B7

Memory Dump Source

Source File: 00000002.00000002.2474401417.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: strtok_s
String ID: block
API String ID: 3330995566-2199623458
Opcode ID: 04f02f922f7740013fe83ed2a8f854d15328f230cbde421a22dc870209397cee
Instruction ID: 00bb13bb87ecd4f31d5cbb7361e66ee12f2c4d363b15aa8138e6c51e0cba8311
Opcode Fuzzy Hash: 04f02f922f7740013fe83ed2a8f854d15328f230cbde421a22dc870209397cee
Instruction Fuzzy Hash: AC517DB4A10209EFCB04DFA1D954BFE77B6BF44304F10804AE516A7361D778E992CB6A

Function 004072D0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 149COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00407314
task.LIBCPMTD ref: 00407555

Part of subcall function 00409240: vsprintf_s.MSVCRT ref: 0040925B

Strings

Password, xrefs: 00407401

Memory Dump Source

Source File: 00000002.00000002.2474401417.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: memsettaskvsprintf_s
String ID: Password
API String ID: 2675463923-3434357891
Opcode ID: 5be579466c40cef3c45c052574d28d43fb537906c51874de2e9a9a2bc2377bc3
Instruction ID: ef12ebdd473109685825b75701b45193a1214ac884297e43e73859b9717fa869
Opcode Fuzzy Hash: 5be579466c40cef3c45c052574d28d43fb537906c51874de2e9a9a2bc2377bc3
Instruction Fuzzy Hash: B8614DB5D0416C9BDB24DB50CD41BDAB7B8BF44304F0081EAE689A6281DB746FC9CFA5

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SKGOzZRZGX.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MSBuild.exe_faac6578d9eb4145cf24c623c8a7076a595e99_473dd2bc_25526f99-51e3-4fed-be84-a8b4399a509e\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SKGOzZRZGX.exe_e684d2ca82731b98552a3bb17475e5bde46424c_43b18d07_41c4bfc4-9f02-41b8-a05b-620d2eae153a\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER54A4.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5512.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5571.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFB25.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFC00.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFC21.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Windows Analysis Report
SKGOzZRZGX.exe

Function 00942021 Relevance: 7.6, APIs: 1, Strings: 3, Instructions: 631
memoryCOMMON

Function 00958E2E Relevance: 4.7, APIs: 3, Instructions: 202
COMMON

Function 0095A3A6 Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Function 00956368 Relevance: 3.0, APIs: 2, Instructions: 34
COMMONLIBRARYCODE

Function 00959FAA Relevance: 1.6, APIs: 1, Instructions: 147
COMMON