Edit tour

Windows Analysis Report
#U0415Sh#U0430rk.exe

Overview

General Information

Sample name:	#U0415Sh#U0430rk.exe renamed because original name is a hash value
Original sample name:	Shrk.exe
Analysis ID:	1532883
MD5:	1adda3c7508b412fbb8c72eaa9eea548
SHA1:	f0fa7109b70acd790750ac5e9fbfe6e3f5dc7fa7
SHA256:	aa6b466f7c6f6d52a0a3eb780551b1e759bb96fd197d4eccee2d2a90252decdf
Tags:	exeuser-4k95m
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected RedLine Stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE / OLE file has an invalid certificate

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

#U0415Sh#U0430rk.exe (PID: 7304 cmdline: "C:\Users\user\Desktop\#U0415Sh#U0430rk.exe" MD5: 1ADDA3C7508B412FBB8C72EAA9EEA548)

MSBuild.exe (PID: 7356 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

WerFault.exe (PID: 7452 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7304 -s 296 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": "185.196.9.26:6302", "Bot Id": "bMi", "Authorization Header": "296c18e34d670ae41d67c9e09e2546b7"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1851791281.0000000000F1B000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000001.00000002.1784795621.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: #U0415Sh#U0430rk.exe PID: 7304	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 7356	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 7356	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.#U0415Sh#U0430rk.exe.f1bb40.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.#U0415Sh#U0430rk.exe.f1bb40.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
1.2.MSBuild.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.#U0415Sh#U0430rk.exe.ef0000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Suricata Signatures

ET MALWARE Redline Stealer TCP CnC - Id1Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-14T04:44:01.118474+0200	2043234	1	A Network Trojan was detected	185.196.9.26	6302	192.168.2.4	49733	TCP

ET MALWARE Redline Stealer TCP CnC Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-14T04:44:00.926524+0200	2043231	1	A Network Trojan was detected	192.168.2.4	49733	185.196.9.26	6302	TCP
2024-10-14T04:44:06.156955+0200	2043231	1	A Network Trojan was detected	192.168.2.4	49733	185.196.9.26	6302	TCP
2024-10-14T04:44:07.949887+0200	2043231	1	A Network Trojan was detected	192.168.2.4	49733	185.196.9.26	6302	TCP
2024-10-14T04:44:08.180390+0200	2043231	1	A Network Trojan was detected	192.168.2.4	49733	185.196.9.26	6302	TCP

ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-14T04:44:06.353471+0200	2046056	1	A Network Trojan was detected	185.196.9.26	6302	192.168.2.4	49733	TCP

ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-14T04:44:00.926524+0200	2046045	1	A Network Trojan was detected	192.168.2.4	49733	185.196.9.26	6302	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: RedLine {"C2 url": "185.196.9.26:6302", "Bot Id": "bMi", "Authorization Header": "296c18e34d670ae41d67c9e09e2546b7"}

Multi AV Scanner detection for domain / URL

Source: 185.196.9.26:6302

Virustotal: Detection: 13%

Perma Link

Multi AV Scanner detection for submitted file

Source: #U0415Sh#U0430rk.exe	ReversingLabs: Detection: 39%
Source: #U0415Sh#U0430rk.exe	Virustotal: Detection: 38%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: #U0415Sh#U0430rk.exe

Joe Sandbox ML: detected

Source: #U0415Sh#U0430rk.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49759 version: TLS 1.2

Source: #U0415Sh#U0430rk.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\#U0415Sh#U0430rk.exe

Code function: 0_2_00F07C3B FindFirstFileExW,FindNextFileW,FindClose,FindClose,

0_2_00F07C3B

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2043231 - Severity 1 - ET MALWARE Redline Stealer TCP CnC Activity : 192.168.2.4:49733 -> 185.196.9.26:6302
Source: Network traffic	Suricata IDS: 2046045 - Severity 1 - ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) : 192.168.2.4:49733 -> 185.196.9.26:6302
Source: Network traffic	Suricata IDS: 2043234 - Severity 1 - ET MALWARE Redline Stealer TCP CnC - Id1Response : 185.196.9.26:6302 -> 192.168.2.4:49733
Source: Network traffic	Suricata IDS: 2046056 - Severity 1 - ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) : 185.196.9.26:6302 -> 192.168.2.4:49733

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 185.196.9.26:6302

Source: global traffic

TCP traffic: 192.168.2.4:49733 -> 185.196.9.26:6302

Source: Joe Sandbox View

IP Address: 185.196.9.26 185.196.9.26

Source: Joe Sandbox View

ASN Name: SIMPLECARRIERCH SIMPLECARRIERCH

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.26
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.198.32
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.198.32

Source: #U0415Sh#U0430rk.exe	String found in binary or memory: http://aia.entrust.net/ts1-chain256.cer01
Source: #U0415Sh#U0430rk.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: #U0415Sh#U0430rk.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: #U0415Sh#U0430rk.exe	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: #U0415Sh#U0430rk.exe	String found in binary or memory: http://crl.entrust.net/ts1ca.crl0
Source: #U0415Sh#U0430rk.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: #U0415Sh#U0430rk.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: #U0415Sh#U0430rk.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: #U0415Sh#U0430rk.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: #U0415Sh#U0430rk.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: #U0415Sh#U0430rk.exe	String found in binary or memory: http://ocsp.entrust.net02
Source: #U0415Sh#U0430rk.exe	String found in binary or memory: http://ocsp.entrust.net03
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rmX
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000003003000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000003003000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000003003000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000003003000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3ResponseD
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: Amcache.hve.4.dr	String found in binary or memory: http://upx.sf.net
Source: #U0415Sh#U0430rk.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: #U0415Sh#U0430rk.exe	String found in binary or memory: http://www.entrust.net/rpa03
Source: MSBuild.exe, 00000001.00000002.1789728700.0000000004106000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1786962909.000000000333F000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1786962909.000000000339D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: #U0415Sh#U0430rk.exe, #U0415Sh#U0430rk.exe, 00000000.00000002.1851791281.0000000000F1B000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1784795621.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: MSBuild.exe, 00000001.00000002.1789728700.0000000004106000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1786962909.000000000333F000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1786962909.000000000339D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: MSBuild.exe, 00000001.00000002.1789728700.0000000004106000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1786962909.000000000333F000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1786962909.000000000339D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: MSBuild.exe, 00000001.00000002.1789728700.0000000004106000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1786962909.000000000333F000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1786962909.000000000339D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: MSBuild.exe, 00000001.00000002.1789728700.0000000004106000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1786962909.000000000333F000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1786962909.000000000339D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: MSBuild.exe, 00000001.00000002.1786962909.000000000333F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: MSBuild.exe, 00000001.00000002.1789728700.0000000004106000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1786962909.000000000339D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabS
Source: MSBuild.exe, 00000001.00000002.1789728700.0000000004106000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1786962909.000000000333F000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1786962909.000000000339D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: MSBuild.exe, 00000001.00000002.1789728700.0000000004106000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1786962909.000000000333F000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1786962909.000000000339D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: #U0415Sh#U0430rk.exe	String found in binary or memory: https://www.entrust.net/rpa0
Source: MSBuild.exe, 00000001.00000002.1789728700.0000000004106000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1786962909.000000000333F000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1786962909.000000000339D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49759 version: TLS 1.2

Source: C:\Users\user\Desktop\#U0415Sh#U0430rk.exe	Code function: 0_2_00EF58F5	0_2_00EF58F5
Source: C:\Users\user\Desktop\#U0415Sh#U0430rk.exe	Code function: 0_2_00EFE190	0_2_00EFE190
Source: C:\Users\user\Desktop\#U0415Sh#U0430rk.exe	Code function: 0_2_00EF1AC2	0_2_00EF1AC2
Source: C:\Users\user\Desktop\#U0415Sh#U0430rk.exe	Code function: 0_2_00EFB25E	0_2_00EFB25E
Source: C:\Users\user\Desktop\#U0415Sh#U0430rk.exe	Code function: 0_2_00F02D9D	0_2_00F02D9D
Source: C:\Users\user\Desktop\#U0415Sh#U0430rk.exe	Code function: 0_2_00F0B551	0_2_00F0B551
Source: C:\Users\user\Desktop\#U0415Sh#U0430rk.exe	Code function: 0_2_00EF1D0A	0_2_00EF1D0A
Source: C:\Users\user\Desktop\#U0415Sh#U0430rk.exe	Code function: 0_2_00F06E51	0_2_00F06E51
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0102DC74	1_2_0102DC74

Source: C:\Users\user\Desktop\#U0415Sh#U0430rk.exe

Code function: String function: 00EF61F0 appears 52 times

Source: C:\Users\user\Desktop\#U0415Sh#U0430rk.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7304 -s 296

Source: #U0415Sh#U0430rk.exe

Static PE information: invalid certificate

Source: #U0415Sh#U0430rk.exe	Binary or memory string: OriginalFilename vs #U0415Sh#U0430rk.exe
Source: #U0415Sh#U0430rk.exe, 00000000.00000002.1851874526.0000000000F66000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameLandings.exe8 vs #U0415Sh#U0430rk.exe

Source: #U0415Sh#U0430rk.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: #U0415Sh#U0430rk.exe

Static PE information: Section: .data ZLIB complexity 0.989956724877451

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/6@0/1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File created: C:\Users\user\AppData\Local\SystemCache

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7304

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\567b49d5-edbb-40fe-88f5-e8aa324c8e58

Jump to behavior

Source: #U0415Sh#U0430rk.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'

Source: C:\Users\user\Desktop\#U0415Sh#U0430rk.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: #U0415Sh#U0430rk.exe	ReversingLabs: Detection: 39%
Source: #U0415Sh#U0430rk.exe	Virustotal: Detection: 38%

Source: unknown	Process created: C:\Users\user\Desktop\#U0415Sh#U0430rk.exe "C:\Users\user\Desktop\#U0415Sh#U0430rk.exe"
Source: C:\Users\user\Desktop\#U0415Sh#U0430rk.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\#U0415Sh#U0430rk.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7304 -s 296
Source: C:\Users\user\Desktop\#U0415Sh#U0430rk.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior

Source: C:\Users\user\Desktop\#U0415Sh#U0430rk.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0415Sh#U0430rk.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: #U0415Sh#U0430rk.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: #U0415Sh#U0430rk.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: C:\Users\user\Desktop\#U0415Sh#U0430rk.exe	Code function: 0_2_00EF1F88 push eax; ret		0_2_00EF1FE4
Source: C:\Users\user\Desktop\#U0415Sh#U0430rk.exe	Code function: 0_2_00EF570F push ecx; ret		0_2_00EF5722

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 1020000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 2DA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 2BD0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 512			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 1043			Jump to behavior

Source: C:\Users\user\Desktop\#U0415Sh#U0430rk.exe

API coverage: 5.2 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7692	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7696	Thread sleep count: 512 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7696	Thread sleep count: 1043 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7376	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\#U0415Sh#U0430rk.exe

Code function: 0_2_00F07C3B FindFirstFileExW,FindNextFileW,FindClose,FindClose,

0_2_00F07C3B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: Amcache.hve.4.dr	Binary or memory string: VMware
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.4.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.4.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.4.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: MSBuild.exe, 00000001.00000002.1786300603.000000000110F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlli#
Source: Amcache.hve.4.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.4.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.4.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.4.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.4.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.4.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.4.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.4.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.4.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.4.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\#U0415Sh#U0430rk.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\#U0415Sh#U0430rk.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\#U0415Sh#U0430rk.exe

Code function: 0_2_00EFBE0F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00EFBE0F

Source: C:\Users\user\Desktop\#U0415Sh#U0430rk.exe	Code function: 0_2_00F02B19 mov eax, dword ptr fs:[00000030h]	0_2_00F02B19
Source: C:\Users\user\Desktop\#U0415Sh#U0430rk.exe	Code function: 0_2_00EF1FEA mov edi, dword ptr fs:[00000030h]	0_2_00EF1FEA
Source: C:\Users\user\Desktop\#U0415Sh#U0430rk.exe	Code function: 0_2_00F02B5D mov eax, dword ptr fs:[00000030h]	0_2_00F02B5D
Source: C:\Users\user\Desktop\#U0415Sh#U0430rk.exe	Code function: 0_2_00EFF4C6 mov ecx, dword ptr fs:[00000030h]	0_2_00EFF4C6

Source: C:\Users\user\Desktop\#U0415Sh#U0430rk.exe

Code function: 0_2_00F0ACE2 GetProcessHeap,

0_2_00F0ACE2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\#U0415Sh#U0430rk.exe	Code function: 0_2_00EF6120 SetUnhandledExceptionFilter,	0_2_00EF6120
Source: C:\Users\user\Desktop\#U0415Sh#U0430rk.exe	Code function: 0_2_00EF5C64 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00EF5C64
Source: C:\Users\user\Desktop\#U0415Sh#U0430rk.exe	Code function: 0_2_00EFBE0F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00EFBE0F
Source: C:\Users\user\Desktop\#U0415Sh#U0430rk.exe	Code function: 0_2_00EF5F93 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00EF5F93

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\#U0415Sh#U0430rk.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\#U0415Sh#U0430rk.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\#U0415Sh#U0430rk.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\#U0415Sh#U0430rk.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\#U0415Sh#U0430rk.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 432000	Jump to behavior
Source: C:\Users\user\Desktop\#U0415Sh#U0430rk.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 450000	Jump to behavior
Source: C:\Users\user\Desktop\#U0415Sh#U0430rk.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: C4D008	Jump to behavior

Source: C:\Users\user\Desktop\#U0415Sh#U0430rk.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"

Jump to behavior

Source: C:\Users\user\Desktop\#U0415Sh#U0430rk.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00F0A8AB
Source: C:\Users\user\Desktop\#U0415Sh#U0430rk.exe	Code function: GetLocaleInfoW,	0_2_00F0A9B1
Source: C:\Users\user\Desktop\#U0415Sh#U0430rk.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00F0AA80
Source: C:\Users\user\Desktop\#U0415Sh#U0430rk.exe	Code function: EnumSystemLocalesW,	0_2_00F01A66
Source: C:\Users\user\Desktop\#U0415Sh#U0430rk.exe	Code function: EnumSystemLocalesW,	0_2_00F0A3BE
Source: C:\Users\user\Desktop\#U0415Sh#U0430rk.exe	Code function: EnumSystemLocalesW,	0_2_00F0A4A4
Source: C:\Users\user\Desktop\#U0415Sh#U0430rk.exe	Code function: EnumSystemLocalesW,	0_2_00F0A409
Source: C:\Users\user\Desktop\#U0415Sh#U0430rk.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00F0A52F
Source: C:\Users\user\Desktop\#U0415Sh#U0430rk.exe	Code function: GetLocaleInfoW,	0_2_00F0A782
Source: C:\Users\user\Desktop\#U0415Sh#U0430rk.exe	Code function: GetLocaleInfoW,	0_2_00F01F50

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\#U0415Sh#U0430rk.exe

Code function: 0_2_00EF51AF GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,GetSystemTimeAsFileTime,

0_2_00EF51AF

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: MsMpEng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.#U0415Sh#U0430rk.exe.f1bb40.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.#U0415Sh#U0430rk.exe.f1bb40.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.#U0415Sh#U0430rk.exe.ef0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1851791281.0000000000F1B000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1784795621.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: #U0415Sh#U0430rk.exe PID: 7304, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7356, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7356, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.#U0415Sh#U0430rk.exe.f1bb40.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.#U0415Sh#U0430rk.exe.f1bb40.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.#U0415Sh#U0430rk.exe.ef0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1851791281.0000000000F1B000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1784795621.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: #U0415Sh#U0430rk.exe PID: 7304, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7356, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	311 Process Injection	1 Masquerading	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	261 Security Software Discovery	Remote Desktop Protocol	2 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	251 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	311 Process Injection	NTDS	251 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Software Packing	DCSync	124 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
#U0415Sh#U0430rk.exe	39%	ReversingLabs	Win32.Trojan.RedLineSteal
#U0415Sh#U0430rk.exe	38%	Virustotal		Browse
#U0415Sh#U0430rk.exe	100%	Joe Sandbox ML

Domains

Source	Detection	Scanner	Link
bg.microsoft.map.fastly.net	0%	Virustotal	Browse
s-part-0017.t-0009.t-msedge.net	0%	Virustotal	Browse
fp2e7a.wpc.phicdn.net	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	0%	URL Reputation	safe
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/sc	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	0%	URL Reputation	safe
http://www.entrust.net/rpa03	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/trust	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	0%	URL Reputation	safe
http://crl.entrust.net/2048ca.crl0	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	0%	URL Reputation	safe
https://www.entrust.net/rpa0	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	0%	URL Reputation	safe
http://ocsp.entrust.net03	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	0%	URL Reputation	safe
http://ocsp.entrust.net02	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust	0%	URL Reputation	safe
http://tempuri.org/Entity/Id23ResponseD	1%	Virustotal		Browse
http://tempuri.org/	0%	Virustotal		Browse
http://tempuri.org/Entity/Id12Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id21Response	4%	Virustotal		Browse
http://tempuri.org/Entity/Id2Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id5	2%	Virustotal		Browse
http://tempuri.org/Entity/Id8	1%	Virustotal		Browse
http://tempuri.org/Entity/Id4	1%	Virustotal		Browse
http://tempuri.org/Entity/Id6	1%	Virustotal		Browse
http://tempuri.org/Entity/Id7	1%	Virustotal		Browse
http://tempuri.org/Entity/Id15Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id6Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id19Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id20	1%	Virustotal		Browse
http://tempuri.org/Entity/Id9Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id9	3%	Virustotal		Browse
http://tempuri.org/Entity/Id22	1%	Virustotal		Browse
http://tempuri.org/Entity/Id23	1%	Virustotal		Browse
http://tempuri.org/Entity/Id1ResponseD	1%	Virustotal		Browse
http://tempuri.org/Entity/Id21	1%	Virustotal		Browse
http://tempuri.org/Entity/Id24	1%	Virustotal		Browse
http://tempuri.org/Entity/Id1Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id24Response	1%	Virustotal		Browse
http://tempuri.org/Entity/Id13	1%	Virustotal		Browse
http://tempuri.org/Entity/Id12	1%	Virustotal		Browse
http://tempuri.org/Entity/Id11	1%	Virustotal		Browse
http://tempuri.org/Entity/Id16Response	2%	Virustotal		Browse
http://tempuri.org/Entity/Id15	1%	Virustotal		Browse
http://tempuri.org/Entity/Id14	1%	Virustotal		Browse
http://tempuri.org/Entity/Id16	1%	Virustotal		Browse
http://tempuri.org/Entity/Id10	1%	Virustotal		Browse
http://tempuri.org/Entity/Id18	1%	Virustotal		Browse
http://tempuri.org/Entity/Id19	1%	Virustotal		Browse
http://tempuri.org/Entity/Id10Response	2%	Virustotal		Browse
185.196.9.26:6302	14%	Virustotal		Browse
http://tempuri.org/Entity/Id17	1%	Virustotal		Browse
http://tempuri.org/Entity/Id5Response	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	0%, Virustotal, Browse	unknown
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	0%, Virustotal, Browse	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
185.196.9.26:6302	true	14%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/chrome_newtab	MSBuild.exe, 00000001.00000002.1786962909.000000000333F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	MSBuild.exe, 00000001.00000002.1789728700.0000000004106000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1786962909.000000000333F000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1786962909.000000000339D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id23ResponseD	MSBuild.exe, 00000001.00000002.1786962909.0000000003003000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id12Response	MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse	unknown
http://tempuri.org/	MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://tempuri.org/Entity/Id2Response	MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id21Response	MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false	4%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id9	MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false	3%, Virustotal, Browse	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id8	MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://tempuri.org/Entity/Id5	MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id4	MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://tempuri.org/Entity/Id7	MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://tempuri.org/Entity/Id6	MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id19Response	MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse	unknown
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat	MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id15Response	MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id6Response	MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ip.sb/ip	#U0415Sh#U0430rk.exe, #U0415Sh#U0430rk.exe, 00000000.00000002.1851791281.0000000000F1B000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1784795621.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/sc	MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id1ResponseD	MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.entrust.net/rpa03	#U0415Sh#U0430rk.exe	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id9Response	MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	MSBuild.exe, 00000001.00000002.1789728700.0000000004106000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1786962909.000000000333F000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1786962909.000000000339D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id20	MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://tempuri.org/Entity/Id21	MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://tempuri.org/Entity/Id22	MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id23	MSBuild.exe, 00000001.00000002.1786962909.0000000003003000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id24	MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id24Response	MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
https://www.ecosia.org/newtab/	MSBuild.exe, 00000001.00000002.1789728700.0000000004106000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1786962909.000000000333F000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1786962909.000000000339D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id1Response	MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust	MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id10	MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://tempuri.org/Entity/Id11	MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://tempuri.org/Entity/Id12	MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://tempuri.org/Entity/Id16Response	MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id13	MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://tempuri.org/Entity/Id14	MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://tempuri.org/Entity/Id15	MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://tempuri.org/Entity/Id16	MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id17	MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://tempuri.org/Entity/Id18	MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://tempuri.org/Entity/Id5Response	MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://crl.entrust.net/2048ca.crl0	#U0415Sh#U0430rk.exe	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id19	MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.entrust.net/rpa0	#U0415Sh#U0430rk.exe	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id10Response	MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id8Response	MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.entrust.net03	#U0415Sh#U0430rk.exe	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.entrust.net02	#U0415Sh#U0430rk.exe	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	MSBuild.exe, 00000001.00000002.1786962909.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1	MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	MSBuild.exe, 00000001.00000002.1789728700.0000000004106000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1786962909.000000000333F000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.1786962909.000000000339D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust	MSBuild.exe, 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.196.9.26	unknown	Switzerland		42624	SIMPLECARRIERCH	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1532883
Start date and time:	2024-10-14 04:43:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	#U0415Sh#U0430rk.exe renamed because original name is a hash value
Original Sample Name:	Shrk.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/6@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 86% Number of executed functions: 18 Number of non-executed functions: 47
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 40.126.31.69, 20.190.159.71, 40.126.31.67, 20.190.159.68, 40.126.31.73, 20.190.159.75, 20.190.159.0, 40.126.31.71, 199.232.210.172, 192.229.221.95, 172.202.163.200, 20.42.65.92, 52.165.164.15, 13.85.23.206, 20.189.173.21, 40.69.42.241
Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, ctldl.windowsupdate.com.delivery.microsoft.com, slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, www.tm.v4.a.prd.aadg.trafficmanager.net, ctldl.windowsupdate.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, onedsblobprdeus17.eastus.cloudapp.azure.com, ocsp.digicert.com, login.live.com, ocsp.edge.digicert.com, blobcollector.events.data.trafficmanager.net, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, onedsblobprdwus16.westus.cloudapp.azure.com, azureedge-t-prod.trafficmanager.net, umwatson.events.data.microsoft.com, wu-b-net.trafficmanager.net, www.tm.lg.prod.aadmsa.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
22:44:06	API Interceptor	9x Sleep call for process: MSBuild.exe modified
22:44:14	API Interceptor	1x Sleep call for process: WerFault.exe modified

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_#U0415Sh#U0430rk_4374819b0365f6888fbc19b060573179d2634f_bd242e1d_6c909fbb-e48c-4691-952e-96518334b0cd\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7307610574087591
Encrypted:	false
SSDEEP:	96:iWk8FQJ4l+RsIhuoI7RT6tQXIDcQvc6QcEVcw3cE//JR+HbHg/8BRTf3Oy1H3a9V:i18sbRI0BU/gjuGzuiFkZ24IO8iH
MD5:	3ABA4C2820DB52B59242FF2E77DC9755
SHA1:	18081FABEF1CE2554DE6E9DAA1BA8BF45FEC9DAA
SHA-256:	37B250C23A227B1321F1AC2D1176D78A18B97D08CA2EAD9D08CA47DED4305709
SHA-512:	AA21CFD69189839CE4D450FA413D12700868AC77EFA867AE7821B02E032AC8F3EC7F449E05904E79EEC0AF6E8115C02DDDE6D755848E7F841E94985F51EB2E5E
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.3.3.4.7.4.3.8.9.5.2.0.9.1.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.3.3.4.7.4.3.9.4.5.2.0.8.6.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.c.9.0.9.f.b.b.-.e.4.8.c.-.4.6.9.1.-.9.5.2.e.-.9.6.5.1.8.3.3.4.b.0.c.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.9.c.e.3.b.c.3.-.9.e.8.8.-.4.e.9.b.-.8.6.b.0.-.1.2.b.8.6.1.a.7.4.d.3.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.#.U.0.4.1.5.S.h.#.U.0.4.3.0.r.k...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.8.8.-.0.0.0.1.-.0.0.1.4.-.8.f.0.b.-.f.6.e.9.e.2.1.d.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.c.4.b.6.7.a.5.2.a.c.4.a.0.2.d.2.0.c.5.4.c.0.5.5.7.2.5.b.d.8.1.7.0.0.0.0.f.f.f.f.!.0.0.0.0.f.0.f.a.7.1.0.9.b.7.0.a.c.d.7.9.0.7.5.0.a.c.5.e.9.f.b.f.e.6.e.3.f.5.d.c.7.f.a.7.!.#.U.0.4.1.5.S.h.#.U.0.4.3.0.r.k...e.x.e.....T.a.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF90D.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Mon Oct 14 02:43:59 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	43434
Entropy (8bit):	1.6578209787935803
Encrypted:	false
SSDEEP:	96:5O8DJN6HlJJVAwgEuutiS6ri7X9WMwfDeXCiJ+IASwXBqNjWmwrQWIkWI+QkIGDB:LDW70E+Owf24/AtfvD2ELA
MD5:	F069AFC18C42A58DA7FD8123E6F08A9F
SHA1:	C76A286EE51084F76E5A5CA0AF4D8CC9B8640D59
SHA-256:	FC9303A7D1CC0792EF43357CD6881BE46D443E5EF5CA27EA7C91D5AFF7DDB8A2
SHA-512:	350A61FAEA3B08391C4D9D201D78D5D3B22F3FC286890B39F0AB3E871E6357E57AD1F3A354C4926200BC8E50CDAB0FC8982960765DAD67A6DD918516508E091D
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .......o..g........................0...........4...~!..........T.......8...........T.......................................................................................................................eJ..............GenuineIntel............T...........l..g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF9AA.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8430
Entropy (8bit):	3.7017719043639645
Encrypted:	false
SSDEEP:	192:R6l7wVeJ2li6qKc6Y9USU9zFd7gmfSAprY89bbusfxpm:R6lXJ56C6YOSU9zFRgmfSwbtfO
MD5:	F3AE1136CBEC4A2131BA912EDFBA260A
SHA1:	76498F0B2D429AB26B1C6D86C1C4B89C64382A61
SHA-256:	53A9B52A31F1204BEC52476283D4A8F06B87F2570792D591998860600F09E1FD
SHA-512:	84DFDF5CA4FF715F3EBF8BA3F08234451E2D9E8EF7D4E654B71A1DC3765D76F314F85267019B0A0B8BE39F923A81F94CBDACDE609C96E9F710376B728301A81D
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.3.0.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFA19.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4750
Entropy (8bit):	4.497901359922846
Encrypted:	false
SSDEEP:	48:cvIwWl8zscJg77aI9+BWpW8VYXYm8M4JSSHFJoW+q8vESzQaYBo/NgZed:uIjfaI7UQ7VfJJKkK2Zed
MD5:	A3A4739F2AE2CB46B46D7A49A49BCC27
SHA1:	10035CA21BE41C69BC151612D340BFB2B3728404
SHA-256:	E8457592F24D68ABA39A54428D04CCFCDDB403F98FFC38300A406AEFFE063B19
SHA-512:	15245FDE5F3CF4131B38CF5401520E0A136CD4AD4DC8F6CF7E826B34AFF0FA0B31ED63C5DCC889DDFD542554C3E4B3405E157B2F35B3C42EE755D9EC0EA83209
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="542506" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MSBuild.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3094
Entropy (8bit):	5.33145931749415
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymTqdqlq7qqjqcEZ5D:Pq5qHwCYqh3qtI6eqzxP0atTqdqlq7qV
MD5:	3FD5C0634443FB2EF2796B9636159CB6
SHA1:	366DDE94AEFCFFFAB8E03AD8B448E05D7489EB48
SHA-256:	58307E94C67E2348F5A838DE4FF668983B38B7E9A3B1D61535D3A392814A57D6
SHA-512:	8535E7C0777C6B0876936D84BDE2BDC59963CF0954D4E50D65808E6E806E8B131DF5DB8FA0E030FAE2702143A7C3A70698A2B9A80519C9E2FFC286A71F0B797C
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465534128011299
Encrypted:	false
SSDEEP:	6144:jIXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uNgdwBCswSby:0XD94+WlLZMM6YFHy+y
MD5:	75118DCA62DC76637CD4DB5357FF2B84
SHA1:	7A46016AF5A533366084BA42B60F2B619F9A0BB7
SHA-256:	2110505B26C7B0C8C4940320A32181403122C7BA04CAC9000A912EA58AEDA5EC
SHA-512:	0E38E7BD600F4070C905CE0F170557E1A16D28DE29000FAF6259676670AD695ED1447658901D57587D1844F396DDF6D98314DEA7CA3F7ACF3BB36AEE908E9C87
Malicious:	false
Reputation:	low
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.r~...................................................................................................................................................................................................................................................................................................................................................i.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.6860434661630945
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	#U0415Sh#U0430rk.exe
File size:	501'800 bytes
MD5:	1adda3c7508b412fbb8c72eaa9eea548
SHA1:	f0fa7109b70acd790750ac5e9fbfe6e3f5dc7fa7
SHA256:	aa6b466f7c6f6d52a0a3eb780551b1e759bb96fd197d4eccee2d2a90252decdf
SHA512:	a0514afd947b96208250fa35dfd703c3d291f61de15e973fa2e4356ad0188a0375d3f6cfdd57ee9cf50d1c3fa4c5d1da92a817989754d84ae1fde36cc0a37d41
SSDEEP:	12288:dHUAVgQ9m0Sxt3Q5sJJfwGDyJsuxT5a1yY5e74eEO:d0AVg7BZQ5sJJYOybaoY5Ujt
TLSH:	EFB4F111B5C0C036D53722320AF4DA745B7EB9300EA69DCFA7644F7A4F346D29A31A6B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e..o!..<!..<!..<...=-..<...=...<...=4..<1M.=4..<1M.=3..<...=$..<!..<Z..<1M.=u..<iL.= ..<iL.= ..<Rich!..<................PE..L..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4054b4
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x670C19DD [Sun Oct 13 19:05:01 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	b7ebfc2ac31d5223dc33b9386c1e726b

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	13/01/2023 00:00:00 16/01/2026 23:59:59
Subject Chain	CN=NVIDIA Corporation, OU=2-J, O=NVIDIA Corporation, L=Santa Clara, S=California, C=US
Version:	3
Thumbprint MD5:	5F1B6B6C408DB2B4D60BAA489E9A0E5A
Thumbprint SHA-1:	15F760D82C79D22446CC7D4806540BF632B1E104
Thumbprint SHA-256:	28AF76241322F210DA473D9569EFF6F27124C4CA9F43933DA547E8D068B0A95D
Serial:	0997C56CAA59055394D9A9CDB8BEEB56

Entrypoint Preview

Instruction
call 00007F19FCFE90BFh
jmp 00007F19FCFE851Fh
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
cmp edx, esi
je 00007F19FCFE86BBh
mov ecx, dword ptr [ebp+0Ch]
cmp ecx, dword ptr [edx+0Ch]
jc 00007F19FCFE86ACh
mov eax, dword ptr [edx+08h]
add eax, dword ptr [edx+0Ch]
cmp ecx, eax
jc 00007F19FCFE86AEh
add edx, 28h
cmp edx, esi
jne 00007F19FCFE868Ch
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 00007F19FCFE869Bh
push esi
call 00007F19FCFE93D2h
test eax, eax
je 00007F19FCFE86C2h
mov eax, dword ptr fs:[00000018h]
mov esi, 00477B54h
mov edx, dword ptr [eax+04h]
jmp 00007F19FCFE86A6h
cmp edx, eax
je 00007F19FCFE86B2h
xor eax, eax
mov ecx, edx
lock cmpxchg dword ptr [esi], ecx
test eax, eax
jne 00007F19FCFE8692h
xor al, al
pop esi
ret
mov al, 01h
pop esi
ret
push ebp
mov ebp, esp
cmp dword ptr [ebp+08h], 00000000h
jne 00007F19FCFE86A9h
mov byte ptr [00477B58h], 00000001h
call 00007F19FCFE8A51h
call 00007F19FCFEB985h
test al, al
jne 00007F19FCFE86A6h
xor al, al
pop ebp
ret
call 00007F19FCFF430Fh
test al, al
jne 00007F19FCFE86ACh
push 00000000h
call 00007F19FCFEB98Ch
pop ecx
jmp 00007F19FCFE868Bh
mov al, 01h
pop ebp
ret
push ebp
mov ebp, esp
cmp byte ptr [00477B59h], 00000000h
je 00007F19FCFE86A6h
mov al, 01h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2a678	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x78200	0x2628
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7a000	0x1aac	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x28c58	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x28b98	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x21000	0x158	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1f734	0x1f800	396b0c9705754f2c0db38817d5b624fa	False	0.5866660466269841	data	6.639646725710149	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x21000	0x9e62	0xa000	2c5e55ef258e06f6f25c93e8f6305894	False	0.43466796875	data	4.94473140840123	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2b000	0x4d774	0x4c800	3f8691256b2f24d8fd2681a076dd6166	False	0.989956724877451	data	7.990409001629863	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0x79000	0x4	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x7a000	0x1aac	0x1c00	2d4e210c1db056057f8e7a35b81cb1c7	False	0.7306082589285714	data	6.414609674682977	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL

Import

USER32.dll

ShowWindow

KERNEL32.dll

GetStartupInfoW, CreateFileW, CloseHandle, GetConsoleWindow, MultiByteToWideChar, GetStringTypeW, WideCharToMultiByte, GetCurrentThreadId, WaitForSingleObjectEx, GetExitCodeThread, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, LCMapStringEx, ReleaseSRWLockExclusive, AcquireSRWLockExclusive, TryAcquireSRWLockExclusive, WakeAllConditionVariable, QueryPerformanceCounter, GetSystemTimeAsFileTime, GetModuleHandleW, GetProcAddress, GetCPInfo, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, GetCurrentProcessId, InitializeSListHead, IsDebuggerPresent, WriteConsoleW, HeapSize, RaiseException, RtlUnwind, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, CreateThread, ExitThread, FreeLibraryAndExitThread, GetModuleHandleExW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, HeapAlloc, HeapFree, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileType, GetFileSizeEx, SetFilePointerEx, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, GetProcessHeap, ReadConsoleW

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-14T04:44:00.926524+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49733	185.196.9.26	6302	TCP
2024-10-14T04:44:00.926524+0200	2046045	ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	1	192.168.2.4	49733	185.196.9.26	6302	TCP
2024-10-14T04:44:01.118474+0200	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	1	185.196.9.26	6302	192.168.2.4	49733	TCP
2024-10-14T04:44:06.156955+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49733	185.196.9.26	6302	TCP
2024-10-14T04:44:06.353471+0200	2046056	ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)	1	185.196.9.26	6302	192.168.2.4	49733	TCP
2024-10-14T04:44:07.949887+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49733	185.196.9.26	6302	TCP
2024-10-14T04:44:08.180390+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.4	49733	185.196.9.26	6302	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 14, 2024 04:44:00.234483004 CEST	49733	6302	192.168.2.4	185.196.9.26
Oct 14, 2024 04:44:00.239588976 CEST	6302	49733	185.196.9.26	192.168.2.4
Oct 14, 2024 04:44:00.239814997 CEST	49733	6302	192.168.2.4	185.196.9.26
Oct 14, 2024 04:44:00.248795986 CEST	49733	6302	192.168.2.4	185.196.9.26
Oct 14, 2024 04:44:00.253645897 CEST	6302	49733	185.196.9.26	192.168.2.4
Oct 14, 2024 04:44:00.341341972 CEST	49675	443	192.168.2.4	173.222.162.32
Oct 14, 2024 04:44:00.897825003 CEST	6302	49733	185.196.9.26	192.168.2.4
Oct 14, 2024 04:44:00.926523924 CEST	49733	6302	192.168.2.4	185.196.9.26
Oct 14, 2024 04:44:00.931567907 CEST	6302	49733	185.196.9.26	192.168.2.4
Oct 14, 2024 04:44:01.118474007 CEST	6302	49733	185.196.9.26	192.168.2.4
Oct 14, 2024 04:44:01.169583082 CEST	49733	6302	192.168.2.4	185.196.9.26
Oct 14, 2024 04:44:06.156955004 CEST	49733	6302	192.168.2.4	185.196.9.26
Oct 14, 2024 04:44:06.161909103 CEST	6302	49733	185.196.9.26	192.168.2.4
Oct 14, 2024 04:44:06.353344917 CEST	6302	49733	185.196.9.26	192.168.2.4
Oct 14, 2024 04:44:06.353367090 CEST	6302	49733	185.196.9.26	192.168.2.4
Oct 14, 2024 04:44:06.353382111 CEST	6302	49733	185.196.9.26	192.168.2.4
Oct 14, 2024 04:44:06.353395939 CEST	6302	49733	185.196.9.26	192.168.2.4
Oct 14, 2024 04:44:06.353446960 CEST	49733	6302	192.168.2.4	185.196.9.26
Oct 14, 2024 04:44:06.353446960 CEST	49733	6302	192.168.2.4	185.196.9.26
Oct 14, 2024 04:44:06.353471041 CEST	6302	49733	185.196.9.26	192.168.2.4
Oct 14, 2024 04:44:06.403858900 CEST	49733	6302	192.168.2.4	185.196.9.26
Oct 14, 2024 04:44:07.567322016 CEST	49733	6302	192.168.2.4	185.196.9.26
Oct 14, 2024 04:44:07.572428942 CEST	6302	49733	185.196.9.26	192.168.2.4
Oct 14, 2024 04:44:07.572446108 CEST	6302	49733	185.196.9.26	192.168.2.4
Oct 14, 2024 04:44:07.572474957 CEST	6302	49733	185.196.9.26	192.168.2.4
Oct 14, 2024 04:44:07.572489023 CEST	6302	49733	185.196.9.26	192.168.2.4
Oct 14, 2024 04:44:07.572498083 CEST	49733	6302	192.168.2.4	185.196.9.26
Oct 14, 2024 04:44:07.572500944 CEST	6302	49733	185.196.9.26	192.168.2.4
Oct 14, 2024 04:44:07.572557926 CEST	49733	6302	192.168.2.4	185.196.9.26
Oct 14, 2024 04:44:07.572571039 CEST	6302	49733	185.196.9.26	192.168.2.4
Oct 14, 2024 04:44:07.572585106 CEST	6302	49733	185.196.9.26	192.168.2.4
Oct 14, 2024 04:44:07.572597027 CEST	6302	49733	185.196.9.26	192.168.2.4
Oct 14, 2024 04:44:07.572608948 CEST	6302	49733	185.196.9.26	192.168.2.4
Oct 14, 2024 04:44:07.572633028 CEST	49733	6302	192.168.2.4	185.196.9.26
Oct 14, 2024 04:44:07.572685003 CEST	6302	49733	185.196.9.26	192.168.2.4
Oct 14, 2024 04:44:07.577415943 CEST	6302	49733	185.196.9.26	192.168.2.4
Oct 14, 2024 04:44:07.577429056 CEST	6302	49733	185.196.9.26	192.168.2.4
Oct 14, 2024 04:44:07.577522039 CEST	6302	49733	185.196.9.26	192.168.2.4
Oct 14, 2024 04:44:07.577533960 CEST	6302	49733	185.196.9.26	192.168.2.4
Oct 14, 2024 04:44:07.577555895 CEST	6302	49733	185.196.9.26	192.168.2.4
Oct 14, 2024 04:44:07.577568054 CEST	6302	49733	185.196.9.26	192.168.2.4
Oct 14, 2024 04:44:07.577581882 CEST	6302	49733	185.196.9.26	192.168.2.4
Oct 14, 2024 04:44:07.577634096 CEST	6302	49733	185.196.9.26	192.168.2.4
Oct 14, 2024 04:44:07.577874899 CEST	6302	49733	185.196.9.26	192.168.2.4
Oct 14, 2024 04:44:07.577982903 CEST	6302	49733	185.196.9.26	192.168.2.4
Oct 14, 2024 04:44:07.949192047 CEST	6302	49733	185.196.9.26	192.168.2.4
Oct 14, 2024 04:44:07.949887037 CEST	49733	6302	192.168.2.4	185.196.9.26
Oct 14, 2024 04:44:07.954816103 CEST	6302	49733	185.196.9.26	192.168.2.4
Oct 14, 2024 04:44:08.142761946 CEST	6302	49733	185.196.9.26	192.168.2.4
Oct 14, 2024 04:44:08.180389881 CEST	49733	6302	192.168.2.4	185.196.9.26
Oct 14, 2024 04:44:39.310393095 CEST	49731	80	192.168.2.4	192.229.211.108
Oct 14, 2024 04:44:39.310538054 CEST	49732	80	192.168.2.4	2.23.198.32
Oct 14, 2024 04:44:39.316135883 CEST	80	49731	192.229.211.108	192.168.2.4
Oct 14, 2024 04:44:39.316240072 CEST	49731	80	192.168.2.4	192.229.211.108
Oct 14, 2024 04:44:39.316625118 CEST	80	49732	2.23.198.32	192.168.2.4
Oct 14, 2024 04:44:39.316806078 CEST	49732	80	192.168.2.4	2.23.198.32
Oct 14, 2024 04:44:54.283665895 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:54.283704996 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:54.283787966 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:54.284131050 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:54.284142971 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:54.976000071 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:54.976098061 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:54.978168011 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:54.978176117 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:54.978663921 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:54.990777969 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:55.035407066 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:55.098440886 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:55.098505974 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:55.098550081 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:55.098582029 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:55.098611116 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:55.098640919 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:55.098669052 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:55.376854897 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:55.376887083 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:55.377026081 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:55.377106905 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:55.377140045 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:55.377156019 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:55.377168894 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:55.377226114 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:55.382582903 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:55.382627964 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:55.382675886 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:55.382682085 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:55.382718086 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:55.386735916 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:55.386785030 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:55.386809111 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:55.386816025 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:55.386857033 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:55.388118982 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:55.388159037 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:55.388191938 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:55.388199091 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:55.388231993 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:55.389954090 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:55.390000105 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:55.390027046 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:55.390033960 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:55.390069962 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:55.391103029 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:55.391141891 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:55.391177893 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:55.391185045 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:55.391211987 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:55.393130064 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:55.393177986 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:55.393202066 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:55.393208981 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:55.393253088 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:55.395070076 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:55.395117044 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:55.395159960 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:55.395164967 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:55.395191908 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:55.396612883 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:55.396660089 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:55.396684885 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:55.396692991 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:55.396734953 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:55.397948980 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:55.397988081 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:55.398020029 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:55.398025990 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:55.398055077 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:55.398739100 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:55.398786068 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:55.398807049 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:55.398813963 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:55.398849964 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:55.399118900 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:55.399192095 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:55.399199963 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:55.399250031 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:55.399252892 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:55.399307013 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:55.399399996 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:55.399415016 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:55.399447918 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:55.399454117 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:55.447849989 CEST	49748	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:55.447880030 CEST	443	49748	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:55.447987080 CEST	49748	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:55.448919058 CEST	49749	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:55.449018955 CEST	443	49749	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:55.449094057 CEST	49749	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:55.451042891 CEST	49751	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:55.451050997 CEST	443	49751	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:55.451065063 CEST	49750	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:55.451086044 CEST	443	49750	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:55.451137066 CEST	49751	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:55.451176882 CEST	49750	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:55.451533079 CEST	49750	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:55.451569080 CEST	443	49750	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:55.451690912 CEST	49748	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:55.451703072 CEST	443	49748	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:55.451940060 CEST	49749	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:55.451965094 CEST	443	49749	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:55.452199936 CEST	49751	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:55.452209949 CEST	443	49751	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:55.453469038 CEST	49752	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:55.453505993 CEST	443	49752	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:55.453587055 CEST	49752	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:55.453753948 CEST	49752	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:55.453768969 CEST	443	49752	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.123655081 CEST	443	49752	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.123768091 CEST	443	49748	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.123821020 CEST	443	49751	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.124131918 CEST	49752	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:56.124144077 CEST	443	49752	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.124545097 CEST	49752	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:56.124551058 CEST	443	49752	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.124742985 CEST	49748	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:56.124759912 CEST	443	49748	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.125071049 CEST	49748	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:56.125073910 CEST	443	49748	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.125233889 CEST	49751	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:56.125242949 CEST	443	49751	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.125684977 CEST	49751	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:56.125689030 CEST	443	49751	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.127353907 CEST	443	49750	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.127927065 CEST	49750	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:56.128010988 CEST	443	49750	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.128492117 CEST	49750	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:56.128506899 CEST	443	49750	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.147701025 CEST	443	49749	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.148195982 CEST	49749	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:56.148257017 CEST	443	49749	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.148663044 CEST	49749	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:56.148678064 CEST	443	49749	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.225087881 CEST	443	49751	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.225111961 CEST	443	49751	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.225205898 CEST	49751	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:56.225227118 CEST	443	49751	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.225450993 CEST	49751	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:56.225455999 CEST	443	49751	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.225466013 CEST	49751	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:56.225469112 CEST	443	49751	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.225476027 CEST	443	49751	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.225616932 CEST	443	49748	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.225673914 CEST	443	49748	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.225737095 CEST	49748	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:56.225743055 CEST	443	49748	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.225791931 CEST	49748	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:56.225796938 CEST	443	49748	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.225828886 CEST	49748	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:56.225831985 CEST	443	49748	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.225853920 CEST	49748	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:56.225857019 CEST	443	49748	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.225858927 CEST	443	49748	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.226428986 CEST	443	49752	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.226569891 CEST	443	49752	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.226638079 CEST	49752	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:56.226670980 CEST	49752	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:56.226691008 CEST	443	49752	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.226701975 CEST	49752	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:56.226710081 CEST	443	49752	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.228949070 CEST	49753	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:56.229020119 CEST	443	49753	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.229062080 CEST	49754	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:56.229080915 CEST	443	49754	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.229118109 CEST	49753	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:56.229175091 CEST	49754	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:56.229219913 CEST	443	49750	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.229265928 CEST	443	49750	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.229298115 CEST	49753	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:56.229325056 CEST	443	49753	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.229346991 CEST	49754	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:56.229368925 CEST	443	49754	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.229372025 CEST	49750	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:56.229430914 CEST	443	49750	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.229492903 CEST	49750	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:56.229513884 CEST	443	49750	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.229540110 CEST	49750	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:56.229540110 CEST	49750	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:56.229556084 CEST	443	49750	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.229593992 CEST	443	49750	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.229610920 CEST	49750	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:56.229643106 CEST	443	49750	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.230781078 CEST	49755	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:56.230807066 CEST	443	49755	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.230871916 CEST	49755	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:56.231061935 CEST	49755	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:56.231077909 CEST	443	49755	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.231328964 CEST	49756	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:56.231431961 CEST	443	49756	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.231520891 CEST	49756	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:56.231683016 CEST	49756	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:56.231719017 CEST	443	49756	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.256416082 CEST	443	49749	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.256557941 CEST	443	49749	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.256634951 CEST	49749	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:56.256685972 CEST	49749	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:56.256711006 CEST	443	49749	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.256736040 CEST	49749	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:56.256747007 CEST	443	49749	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.258904934 CEST	49757	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:56.258989096 CEST	443	49757	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.259275913 CEST	49757	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:56.259275913 CEST	49757	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:56.259402037 CEST	443	49757	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.888499022 CEST	443	49753	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.889403105 CEST	49753	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:56.889442921 CEST	443	49753	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.889729023 CEST	49753	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:56.889740944 CEST	443	49753	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.900983095 CEST	443	49755	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.901700020 CEST	49755	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:56.901730061 CEST	443	49755	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.901979923 CEST	49755	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:56.902005911 CEST	443	49755	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.913846016 CEST	443	49757	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.914366007 CEST	49757	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:56.914386034 CEST	443	49757	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.914726019 CEST	49757	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:56.914731026 CEST	443	49757	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.932023048 CEST	443	49756	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.932095051 CEST	443	49754	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.932703972 CEST	49756	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:56.932764053 CEST	443	49756	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.932787895 CEST	49754	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:56.932823896 CEST	443	49754	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.933201075 CEST	49756	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:56.933217049 CEST	443	49756	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.933240891 CEST	49754	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:56.933253050 CEST	443	49754	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.989995956 CEST	443	49753	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.990151882 CEST	443	49753	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.990421057 CEST	49753	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:56.990421057 CEST	49753	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:56.990923882 CEST	49753	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:56.990963936 CEST	443	49753	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.999058008 CEST	49758	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:56.999089956 CEST	443	49758	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:56.999166965 CEST	49758	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:56.999289989 CEST	49758	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:56.999303102 CEST	443	49758	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.003477097 CEST	443	49755	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.003612041 CEST	443	49755	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.003679037 CEST	49755	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.003798962 CEST	49755	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.003819942 CEST	443	49755	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.003856897 CEST	49755	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.003864050 CEST	443	49755	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.005996943 CEST	49759	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.006088972 CEST	443	49759	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.006190062 CEST	49759	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.006380081 CEST	49759	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.006413937 CEST	443	49759	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.016448975 CEST	443	49757	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.016585112 CEST	443	49757	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.016663074 CEST	49757	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.016695023 CEST	49757	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.016706944 CEST	443	49757	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.016737938 CEST	49757	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.016745090 CEST	443	49757	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.018774033 CEST	49760	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.018795013 CEST	443	49760	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.018888950 CEST	49760	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.019074917 CEST	49760	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.019103050 CEST	443	49760	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.039324999 CEST	443	49754	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.039484024 CEST	443	49754	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.039592028 CEST	49754	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.039674997 CEST	49754	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.039704084 CEST	443	49754	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.039731026 CEST	49754	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.039746046 CEST	443	49754	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.040127993 CEST	443	49756	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.040270090 CEST	443	49756	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.040476084 CEST	49756	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.040477037 CEST	49756	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.040477037 CEST	49756	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.042159081 CEST	49761	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.042191982 CEST	443	49761	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.042202950 CEST	49762	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.042212009 CEST	443	49762	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.042265892 CEST	49761	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.042309046 CEST	49762	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.042408943 CEST	49762	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.042424917 CEST	443	49762	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.042561054 CEST	49761	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.042572021 CEST	443	49761	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.341634989 CEST	49756	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.341711044 CEST	443	49756	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.659073114 CEST	443	49759	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.659871101 CEST	49759	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.659931898 CEST	443	49759	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.660392046 CEST	49759	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.660406113 CEST	443	49759	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.666254997 CEST	443	49760	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.672919035 CEST	49760	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.672986031 CEST	443	49760	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.673805952 CEST	49760	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.673858881 CEST	443	49760	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.688617945 CEST	443	49758	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.689146996 CEST	49758	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.689177036 CEST	443	49758	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.689692020 CEST	49758	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.689698935 CEST	443	49758	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.707247019 CEST	443	49762	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.707633972 CEST	49762	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.707644939 CEST	443	49762	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.708035946 CEST	49762	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.708040953 CEST	443	49762	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.720693111 CEST	443	49761	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.721035957 CEST	49761	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.721049070 CEST	443	49761	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.721404076 CEST	49761	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.721409082 CEST	443	49761	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.760371923 CEST	443	49759	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.760435104 CEST	443	49759	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.760545969 CEST	49759	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.760857105 CEST	49759	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.760902882 CEST	443	49759	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.760936022 CEST	49759	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.760952950 CEST	443	49759	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.764739990 CEST	49763	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.764785051 CEST	443	49763	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.764882088 CEST	49763	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.765077114 CEST	49763	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.765110970 CEST	443	49763	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.770731926 CEST	443	49760	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.770884991 CEST	443	49760	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.771003962 CEST	49760	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.771065950 CEST	49760	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.771079063 CEST	443	49760	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.771116018 CEST	49760	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.771126986 CEST	443	49760	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.773287058 CEST	49764	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.773319960 CEST	443	49764	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.773400068 CEST	49764	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.773525953 CEST	49764	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.773552895 CEST	443	49764	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.799194098 CEST	443	49758	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.799259901 CEST	443	49758	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.799495935 CEST	49758	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.799598932 CEST	49758	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.799623013 CEST	443	49758	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.799653053 CEST	49758	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.799659967 CEST	443	49758	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.801829100 CEST	49765	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.801891088 CEST	443	49765	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.801996946 CEST	49765	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.802109957 CEST	49765	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.802136898 CEST	443	49765	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.825808048 CEST	443	49761	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.825879097 CEST	443	49761	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.826015949 CEST	49761	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.827724934 CEST	49761	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.827733040 CEST	443	49761	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.827811003 CEST	49761	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.827816010 CEST	443	49761	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.829046965 CEST	443	49762	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.829211950 CEST	443	49762	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.829279900 CEST	49762	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.829631090 CEST	49766	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.829657078 CEST	49762	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.829660892 CEST	443	49762	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.829684973 CEST	443	49766	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.829699039 CEST	49762	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.829704046 CEST	443	49762	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.829787970 CEST	49766	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.830291986 CEST	49766	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.830324888 CEST	443	49766	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.831428051 CEST	49767	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.831468105 CEST	443	49767	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:57.831554890 CEST	49767	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.831650019 CEST	49767	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:57.831664085 CEST	443	49767	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:58.453696966 CEST	443	49765	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:58.454406023 CEST	49765	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:58.454453945 CEST	443	49765	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:58.454988003 CEST	49765	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:58.454999924 CEST	443	49765	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:58.470998049 CEST	443	49764	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:58.475646019 CEST	49764	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:58.475673914 CEST	443	49764	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:58.478190899 CEST	443	49763	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:58.480006933 CEST	49764	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:58.480031967 CEST	443	49764	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:58.480272055 CEST	49763	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:58.480330944 CEST	443	49763	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:58.480465889 CEST	49763	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:58.480482101 CEST	443	49763	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:58.495821953 CEST	443	49766	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:58.498707056 CEST	49766	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:58.498744965 CEST	443	49766	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:58.499452114 CEST	443	49767	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:58.503000975 CEST	49766	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:58.503014088 CEST	443	49766	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:58.511951923 CEST	49767	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:58.511980057 CEST	443	49767	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:58.520220041 CEST	49767	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:58.520245075 CEST	443	49767	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:58.555656910 CEST	443	49765	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:58.555809975 CEST	443	49765	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:58.556010962 CEST	49765	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:58.559649944 CEST	49765	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:58.559649944 CEST	49765	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:58.559684992 CEST	443	49765	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:58.559706926 CEST	443	49765	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:58.579355001 CEST	49768	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:58.579406023 CEST	443	49768	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:58.579518080 CEST	49768	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:58.581621885 CEST	443	49764	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:58.581751108 CEST	443	49764	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:58.581904888 CEST	49764	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:58.582565069 CEST	443	49763	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:58.582662106 CEST	443	49763	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:58.582968950 CEST	49763	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:58.587873936 CEST	49768	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:58.587893009 CEST	443	49768	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:58.588234901 CEST	49764	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:58.588234901 CEST	49764	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:58.588265896 CEST	443	49764	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:58.588284016 CEST	443	49764	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:58.602571011 CEST	443	49766	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:58.602627039 CEST	443	49766	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:58.602683067 CEST	49769	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:58.602766991 CEST	443	49769	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:58.602847099 CEST	49766	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:58.602881908 CEST	49769	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:58.606892109 CEST	49766	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:58.606900930 CEST	443	49766	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:58.607075930 CEST	49766	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:58.607081890 CEST	443	49766	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:58.607251883 CEST	49769	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:58.607333899 CEST	443	49769	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:58.607726097 CEST	49763	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:58.607819080 CEST	443	49763	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:58.607882023 CEST	49763	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:58.607901096 CEST	443	49763	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:58.620733976 CEST	443	49767	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:58.620904922 CEST	443	49767	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:58.621109962 CEST	49767	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:58.621459961 CEST	49767	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:58.621459961 CEST	49767	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:58.621479988 CEST	443	49767	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:58.621494055 CEST	443	49767	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:58.629146099 CEST	49770	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:58.629229069 CEST	443	49770	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:58.629323006 CEST	49770	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:58.629479885 CEST	49770	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:58.629518986 CEST	443	49770	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:58.630670071 CEST	49771	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:58.630692959 CEST	443	49771	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:58.630748987 CEST	49771	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:58.630996943 CEST	49771	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:58.631011009 CEST	443	49771	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:58.632019043 CEST	49772	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:58.632055044 CEST	443	49772	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:58.632113934 CEST	49772	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:58.632189989 CEST	49772	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:58.632199049 CEST	443	49772	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:59.251878023 CEST	443	49768	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:59.252523899 CEST	49768	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:59.252541065 CEST	443	49768	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:59.253258944 CEST	49768	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:59.253267050 CEST	443	49768	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:59.262557983 CEST	443	49769	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:59.262991905 CEST	49769	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:59.263020992 CEST	443	49769	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:59.263612986 CEST	49769	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:59.263638973 CEST	443	49769	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:59.279285908 CEST	443	49770	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:59.279727936 CEST	49770	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:59.279787064 CEST	443	49770	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:59.280044079 CEST	49770	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:59.280060053 CEST	443	49770	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:59.288209915 CEST	443	49771	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:59.288647890 CEST	49771	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:59.288657904 CEST	443	49771	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:59.288928986 CEST	49771	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:59.288933992 CEST	443	49771	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:59.309237957 CEST	443	49772	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:59.309511900 CEST	49772	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:59.309537888 CEST	443	49772	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:59.309901953 CEST	49772	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:59.309909105 CEST	443	49772	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:59.652929068 CEST	443	49768	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:59.653013945 CEST	443	49768	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:59.653095961 CEST	443	49769	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:59.653151989 CEST	443	49769	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:59.653234959 CEST	49768	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:59.653330088 CEST	49769	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:59.653425932 CEST	443	49772	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:59.653448105 CEST	443	49770	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:59.653471947 CEST	443	49771	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:59.653476000 CEST	443	49772	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:59.653599977 CEST	49768	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:59.653599977 CEST	49768	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:59.653603077 CEST	49772	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:59.653620958 CEST	443	49768	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:59.653631926 CEST	443	49768	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:59.653662920 CEST	443	49771	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:59.653685093 CEST	443	49770	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:59.653779030 CEST	49771	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:59.653899908 CEST	49769	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:59.653899908 CEST	49769	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:59.653899908 CEST	49770	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:59.653954029 CEST	443	49769	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:59.653973103 CEST	443	49769	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:59.654474020 CEST	49770	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:59.654483080 CEST	443	49770	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:59.654495001 CEST	49770	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:59.654500961 CEST	443	49770	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:59.654541016 CEST	49772	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:59.654558897 CEST	443	49772	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:59.654592037 CEST	49772	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:59.654598951 CEST	443	49772	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:59.655550957 CEST	49771	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:59.655550957 CEST	49771	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:59.655559063 CEST	443	49771	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:59.655561924 CEST	443	49771	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:59.658303022 CEST	49773	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:59.658344030 CEST	443	49773	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:59.658521891 CEST	49774	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:59.658529997 CEST	443	49774	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:59.658600092 CEST	49773	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:59.658731937 CEST	49774	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:59.658731937 CEST	49773	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:59.658756971 CEST	443	49773	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:59.659320116 CEST	49775	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:59.659346104 CEST	443	49775	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:59.659416914 CEST	49775	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:59.659521103 CEST	49775	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:59.659534931 CEST	443	49775	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:59.659847021 CEST	49776	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:59.659909964 CEST	443	49776	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:59.659950972 CEST	49774	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:59.659965992 CEST	443	49774	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:59.659986973 CEST	49776	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:59.660048008 CEST	49776	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:59.660063982 CEST	443	49776	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:59.660569906 CEST	49777	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:59.660612106 CEST	443	49777	13.107.246.45	192.168.2.4
Oct 14, 2024 04:44:59.660687923 CEST	49777	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:59.660856009 CEST	49777	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:44:59.660881042 CEST	443	49777	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:00.316781044 CEST	443	49773	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:00.317555904 CEST	49773	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:00.317586899 CEST	443	49773	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:00.317883015 CEST	49773	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:00.317892075 CEST	443	49773	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:00.319474936 CEST	443	49776	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:00.319848061 CEST	49776	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:00.319868088 CEST	443	49776	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:00.320415974 CEST	49776	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:00.320421934 CEST	443	49776	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:00.320785999 CEST	443	49775	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:00.321106911 CEST	49775	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:00.321130037 CEST	443	49775	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:00.321449995 CEST	49775	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:00.321456909 CEST	443	49775	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:00.345832109 CEST	443	49774	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:00.346259117 CEST	49774	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:00.346287966 CEST	443	49774	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:00.346734047 CEST	49774	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:00.346740007 CEST	443	49774	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:00.354340076 CEST	443	49777	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:00.354618073 CEST	49777	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:00.354640961 CEST	443	49777	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:00.355036974 CEST	49777	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:00.355042934 CEST	443	49777	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:00.591748953 CEST	443	49775	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:00.591804981 CEST	443	49773	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:00.591819048 CEST	443	49775	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:00.591939926 CEST	443	49776	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:00.591957092 CEST	443	49773	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:00.591984034 CEST	443	49774	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:00.592032909 CEST	49775	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:00.592083931 CEST	443	49774	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:00.592096090 CEST	443	49776	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:00.592144966 CEST	49773	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:00.592144966 CEST	49774	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:00.592181921 CEST	49776	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:00.592264891 CEST	49776	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:00.592266083 CEST	49776	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:00.592295885 CEST	443	49776	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:00.592319012 CEST	443	49776	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:00.592436075 CEST	49773	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:00.592436075 CEST	49773	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:00.592436075 CEST	49774	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:00.592436075 CEST	49774	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:00.592472076 CEST	443	49773	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:00.592489004 CEST	443	49773	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:00.592499018 CEST	443	49774	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:00.592509031 CEST	443	49774	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:00.593489885 CEST	49775	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:00.593512058 CEST	443	49775	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:00.593545914 CEST	49775	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:00.593553066 CEST	443	49775	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:00.596384048 CEST	49778	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:00.596427917 CEST	443	49778	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:00.596611023 CEST	49778	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:00.596676111 CEST	49779	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:00.596728086 CEST	443	49779	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:00.596801996 CEST	49779	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:00.596839905 CEST	49780	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:00.596884966 CEST	443	49780	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:00.596945047 CEST	49780	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:00.597114086 CEST	49778	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:00.597136021 CEST	443	49778	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:00.597206116 CEST	49779	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:00.597234011 CEST	443	49779	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:00.597266912 CEST	49780	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:00.597285032 CEST	443	49780	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:00.597824097 CEST	49781	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:00.597908974 CEST	443	49781	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:00.597996950 CEST	49781	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:00.598174095 CEST	49781	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:00.598225117 CEST	443	49781	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:00.688916922 CEST	443	49777	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:00.689110041 CEST	443	49777	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:00.689173937 CEST	49777	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:00.689268112 CEST	49777	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:00.689285040 CEST	443	49777	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:00.689321995 CEST	49777	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:00.689330101 CEST	443	49777	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:00.691885948 CEST	49782	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:00.691967964 CEST	443	49782	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:00.692061901 CEST	49782	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:00.692229033 CEST	49782	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:00.692264080 CEST	443	49782	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:01.278666973 CEST	443	49778	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:01.280900002 CEST	443	49780	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:01.298064947 CEST	443	49781	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:01.299030066 CEST	49778	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:01.299042940 CEST	443	49778	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:01.303772926 CEST	49778	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:01.303783894 CEST	443	49778	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:01.304034948 CEST	49780	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:01.304065943 CEST	443	49780	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:01.307363987 CEST	443	49779	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:01.308284998 CEST	49780	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:01.308298111 CEST	443	49780	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:01.308537006 CEST	49779	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:01.308589935 CEST	443	49779	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:01.308867931 CEST	49779	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:01.308880091 CEST	443	49779	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:01.315237045 CEST	49781	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:01.315296888 CEST	443	49781	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:01.315727949 CEST	49781	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:01.315782070 CEST	443	49781	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:01.369220972 CEST	443	49782	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:01.380136967 CEST	49782	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:01.380193949 CEST	443	49782	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:01.384058952 CEST	49782	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:01.384111881 CEST	443	49782	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:01.402667046 CEST	443	49778	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:01.402810097 CEST	443	49778	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:01.402869940 CEST	49778	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:01.403202057 CEST	49778	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:01.403209925 CEST	443	49778	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:01.403218985 CEST	49778	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:01.403223038 CEST	443	49778	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:01.405395985 CEST	443	49780	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:01.405530930 CEST	443	49780	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:01.405692101 CEST	49780	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:01.407373905 CEST	49780	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:01.407402992 CEST	443	49780	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:01.407437086 CEST	49780	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:01.407444954 CEST	443	49780	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:01.412997007 CEST	443	49779	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:01.413058996 CEST	443	49779	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:01.413130045 CEST	49779	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:01.414968967 CEST	49779	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:01.414968967 CEST	49779	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:01.414999962 CEST	443	49779	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:01.415023088 CEST	443	49779	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:01.415153980 CEST	443	49781	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:01.415272951 CEST	443	49781	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:01.415343046 CEST	49781	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:01.419157028 CEST	49781	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:01.419157982 CEST	49781	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:01.419199944 CEST	443	49781	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:01.419228077 CEST	443	49781	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:01.457591057 CEST	49783	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:01.457634926 CEST	443	49783	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:01.457710981 CEST	49783	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:01.458410025 CEST	49783	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:01.458426952 CEST	443	49783	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:01.459676981 CEST	49784	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:01.459712029 CEST	443	49784	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:01.459777117 CEST	49784	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:01.459968090 CEST	49784	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:01.459985018 CEST	443	49784	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:01.461522102 CEST	49785	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:01.461561918 CEST	443	49785	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:01.461632967 CEST	49785	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:01.462230921 CEST	49785	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:01.462248087 CEST	443	49785	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:01.463151932 CEST	49786	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:01.463161945 CEST	443	49786	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:01.463219881 CEST	49786	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:01.463591099 CEST	49786	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:01.463603020 CEST	443	49786	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:01.481122017 CEST	443	49782	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:01.481194019 CEST	443	49782	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:01.481319904 CEST	49782	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:01.493663073 CEST	49782	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:01.493663073 CEST	49782	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:01.493727922 CEST	443	49782	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:01.493765116 CEST	443	49782	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:01.531980038 CEST	49787	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:01.532021046 CEST	443	49787	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:01.532089949 CEST	49787	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:01.532254934 CEST	49787	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:01.532273054 CEST	443	49787	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.119091034 CEST	443	49785	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.119743109 CEST	49785	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:02.119761944 CEST	443	49785	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.120286942 CEST	49785	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:02.120292902 CEST	443	49785	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.120889902 CEST	443	49786	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.121315002 CEST	49786	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:02.121329069 CEST	443	49786	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.121694088 CEST	49786	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:02.121699095 CEST	443	49786	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.122812033 CEST	443	49784	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.123533010 CEST	443	49783	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.124103069 CEST	49784	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:02.124145985 CEST	443	49784	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.124706984 CEST	49784	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:02.124749899 CEST	443	49784	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.124924898 CEST	49783	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:02.124953032 CEST	443	49783	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.125701904 CEST	49783	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:02.125708103 CEST	443	49783	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.195203066 CEST	443	49787	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.195835114 CEST	49787	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:02.195867062 CEST	443	49787	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.196816921 CEST	49787	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:02.196844101 CEST	443	49787	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.218591928 CEST	443	49785	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.218720913 CEST	443	49785	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.218786001 CEST	49785	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:02.218900919 CEST	49785	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:02.218918085 CEST	443	49785	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.218930006 CEST	49785	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:02.218936920 CEST	443	49785	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.220993996 CEST	443	49786	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.221134901 CEST	443	49786	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.221194029 CEST	49786	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:02.221647978 CEST	49786	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:02.221653938 CEST	443	49786	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.223264933 CEST	49788	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:02.223364115 CEST	443	49788	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.223681927 CEST	49788	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:02.224905968 CEST	49788	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:02.224961042 CEST	443	49788	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.225003958 CEST	443	49784	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.225168943 CEST	443	49784	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.225346088 CEST	49784	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:02.225673914 CEST	49784	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:02.225673914 CEST	49784	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:02.225708008 CEST	443	49784	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.225724936 CEST	443	49784	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.226380110 CEST	49789	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:02.226408958 CEST	443	49789	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.226470947 CEST	49789	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:02.226737022 CEST	443	49783	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.226880074 CEST	443	49783	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.226937056 CEST	49783	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:02.227765083 CEST	49789	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:02.227776051 CEST	443	49789	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.228919983 CEST	49783	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:02.228938103 CEST	443	49783	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.228950977 CEST	49783	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:02.228956938 CEST	443	49783	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.230978966 CEST	49790	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:02.230986118 CEST	443	49790	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.232851028 CEST	49790	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:02.232851028 CEST	49790	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:02.232867956 CEST	443	49790	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.233997107 CEST	49791	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:02.234086037 CEST	443	49791	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.234428883 CEST	49791	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:02.234428883 CEST	49791	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:02.234560966 CEST	443	49791	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.299459934 CEST	443	49787	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.299541950 CEST	443	49787	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.299623013 CEST	49787	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:02.299777985 CEST	49787	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:02.299798012 CEST	443	49787	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.299812078 CEST	49787	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:02.299819946 CEST	443	49787	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.302503109 CEST	49792	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:02.302593946 CEST	443	49792	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.302694082 CEST	49792	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:02.302860975 CEST	49792	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:02.302897930 CEST	443	49792	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.890424013 CEST	443	49789	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.890958071 CEST	49789	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:02.890995026 CEST	443	49789	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.891684055 CEST	49789	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:02.891689062 CEST	443	49789	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.891740084 CEST	443	49790	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.892142057 CEST	49790	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:02.892149925 CEST	443	49790	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.892674923 CEST	49790	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:02.892678022 CEST	443	49790	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.904633999 CEST	443	49791	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.905100107 CEST	49791	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:02.905183077 CEST	443	49791	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.905740976 CEST	49791	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:02.905755043 CEST	443	49791	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.919253111 CEST	443	49788	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.919675112 CEST	49788	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:02.919697046 CEST	443	49788	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.920447111 CEST	49788	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:02.920461893 CEST	443	49788	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.990823030 CEST	443	49792	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.991460085 CEST	49792	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:02.991518974 CEST	443	49792	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.991528988 CEST	443	49789	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.991708994 CEST	443	49789	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.991780996 CEST	49789	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:02.991872072 CEST	49792	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:02.991887093 CEST	443	49792	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.991893053 CEST	49789	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:02.991910934 CEST	443	49789	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.991926908 CEST	49789	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:02.991931915 CEST	443	49789	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.994896889 CEST	49793	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:02.994956017 CEST	443	49793	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:02.995063066 CEST	49793	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:02.995227098 CEST	49793	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:02.995249987 CEST	443	49793	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.037982941 CEST	443	49790	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.037997007 CEST	443	49788	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.038058996 CEST	443	49791	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.038096905 CEST	443	49788	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.038141012 CEST	443	49792	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.038180113 CEST	49788	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.038217068 CEST	443	49791	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.038239956 CEST	443	49792	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.038252115 CEST	443	49790	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.038285017 CEST	49791	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.038312912 CEST	49792	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.039278984 CEST	49790	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.106479883 CEST	49790	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.106504917 CEST	443	49790	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.106534004 CEST	49790	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.106540918 CEST	443	49790	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.107652903 CEST	49792	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.107654095 CEST	49792	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.107728004 CEST	443	49792	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.107758045 CEST	443	49792	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.108540058 CEST	49788	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.108618975 CEST	443	49788	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.108654022 CEST	49788	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.108673096 CEST	443	49788	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.109370947 CEST	49791	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.109384060 CEST	443	49791	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.109411001 CEST	49791	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.109421015 CEST	443	49791	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.113085985 CEST	49794	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.113130093 CEST	443	49794	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.113220930 CEST	49794	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.114636898 CEST	49795	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.114690065 CEST	443	49795	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.114778042 CEST	49795	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.114794970 CEST	49794	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.114811897 CEST	443	49794	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.116080046 CEST	49796	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.116122007 CEST	443	49796	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.116194963 CEST	49796	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.116326094 CEST	49796	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.116338015 CEST	443	49796	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.117470026 CEST	49797	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.117558002 CEST	443	49797	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.117633104 CEST	49797	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.117824078 CEST	49795	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.117856979 CEST	443	49795	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.117933035 CEST	49797	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.117971897 CEST	443	49797	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.698894978 CEST	443	49793	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.700006962 CEST	49793	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.700038910 CEST	443	49793	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.700663090 CEST	49793	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.700670004 CEST	443	49793	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.764096975 CEST	49723	80	192.168.2.4	199.232.214.172
Oct 14, 2024 04:45:04.764276981 CEST	49724	80	192.168.2.4	199.232.214.172
Oct 14, 2024 04:45:04.767224073 CEST	443	49794	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.768062115 CEST	49794	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.768090010 CEST	443	49794	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.768712044 CEST	49794	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.768718958 CEST	443	49794	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.769961119 CEST	80	49723	199.232.214.172	192.168.2.4
Oct 14, 2024 04:45:04.770042896 CEST	49723	80	192.168.2.4	199.232.214.172
Oct 14, 2024 04:45:04.770742893 CEST	80	49724	199.232.214.172	192.168.2.4
Oct 14, 2024 04:45:04.770827055 CEST	49724	80	192.168.2.4	199.232.214.172
Oct 14, 2024 04:45:04.772855043 CEST	443	49795	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.772958040 CEST	443	49796	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.773508072 CEST	49796	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.773528099 CEST	443	49796	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.773782969 CEST	49795	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.773844004 CEST	443	49795	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.774072886 CEST	49796	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.774080992 CEST	443	49796	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.775206089 CEST	49795	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.775221109 CEST	443	49795	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.803021908 CEST	443	49793	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.803180933 CEST	443	49793	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.803280115 CEST	49793	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.803411007 CEST	49793	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.803411007 CEST	49793	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.803428888 CEST	443	49793	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.803437948 CEST	443	49793	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.808564901 CEST	49798	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.808655024 CEST	443	49798	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.808829069 CEST	49798	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.809293985 CEST	49798	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.809329033 CEST	443	49798	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.809452057 CEST	443	49797	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.810154915 CEST	49797	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.810174942 CEST	443	49797	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.810725927 CEST	49797	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.810736895 CEST	443	49797	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.867605925 CEST	443	49794	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.867671967 CEST	443	49794	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.867753983 CEST	49794	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.868175030 CEST	49794	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.868192911 CEST	443	49794	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.868212938 CEST	49794	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.868218899 CEST	443	49794	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.873042107 CEST	49799	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.873075962 CEST	443	49799	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.873212099 CEST	49799	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.873555899 CEST	49799	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.873573065 CEST	443	49799	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.873795033 CEST	443	49796	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.873851061 CEST	443	49796	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.873934984 CEST	49796	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.873975039 CEST	443	49795	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.874103069 CEST	443	49795	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.874172926 CEST	49796	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.874182940 CEST	443	49796	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.874221087 CEST	49795	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.874222994 CEST	49796	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.874229908 CEST	443	49796	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.874569893 CEST	49795	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.874600887 CEST	443	49795	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.874629974 CEST	49795	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.874644041 CEST	443	49795	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.877326012 CEST	49800	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.877347946 CEST	443	49800	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.877484083 CEST	49800	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.877593994 CEST	49800	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.877600908 CEST	443	49800	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.878729105 CEST	49801	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.878765106 CEST	443	49801	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.878901005 CEST	49801	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.879211903 CEST	49801	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.879230022 CEST	443	49801	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.916363001 CEST	443	49797	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.916435003 CEST	443	49797	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.916533947 CEST	49797	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.916971922 CEST	49797	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.916986942 CEST	443	49797	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.922373056 CEST	49802	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.922385931 CEST	443	49802	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:04.922530890 CEST	49802	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.922871113 CEST	49802	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:04.922884941 CEST	443	49802	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:05.503968954 CEST	443	49798	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:05.504658937 CEST	49798	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:05.504702091 CEST	443	49798	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:05.505165100 CEST	49798	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:05.505202055 CEST	443	49798	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:05.547321081 CEST	443	49799	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:05.547792912 CEST	49799	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:05.547815084 CEST	443	49799	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:05.548208952 CEST	49799	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:05.548214912 CEST	443	49799	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:05.550781012 CEST	443	49800	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:05.551136017 CEST	49800	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:05.551160097 CEST	443	49800	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:05.551378012 CEST	49800	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:05.551388979 CEST	443	49800	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:05.597326040 CEST	443	49801	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:05.597707033 CEST	49801	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:05.597754955 CEST	443	49801	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:05.597868919 CEST	443	49802	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:05.598109007 CEST	49802	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:05.598139048 CEST	443	49802	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:05.598186970 CEST	49801	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:05.598196983 CEST	443	49801	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:05.598514080 CEST	49802	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:05.598522902 CEST	443	49802	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:05.616365910 CEST	443	49798	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:05.616548061 CEST	443	49798	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:05.616625071 CEST	49798	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:05.616677046 CEST	49798	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:05.616694927 CEST	443	49798	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:05.616736889 CEST	49798	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:05.616744995 CEST	443	49798	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:05.619434118 CEST	49803	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:05.619478941 CEST	443	49803	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:05.619786978 CEST	49803	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:05.619786978 CEST	49803	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:05.619832993 CEST	443	49803	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:05.651355982 CEST	443	49800	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:05.651549101 CEST	443	49800	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:05.651684999 CEST	49800	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:05.651684999 CEST	49800	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:05.651684999 CEST	49800	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:05.654050112 CEST	49804	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:05.654086113 CEST	443	49804	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:05.654165983 CEST	49804	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:05.654366016 CEST	49804	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:05.654386044 CEST	443	49804	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:05.659713030 CEST	443	49799	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:05.659775972 CEST	443	49799	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:05.659828901 CEST	49799	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:05.659919024 CEST	49799	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:05.659936905 CEST	443	49799	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:05.659950018 CEST	49799	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:05.659956932 CEST	443	49799	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:05.661947012 CEST	49805	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:05.661990881 CEST	443	49805	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:05.662070990 CEST	49805	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:05.662183046 CEST	49805	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:05.662200928 CEST	443	49805	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:05.699476957 CEST	443	49802	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:05.699539900 CEST	443	49802	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:05.699750900 CEST	49802	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:05.699750900 CEST	49802	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:05.700855970 CEST	49802	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:05.700895071 CEST	443	49802	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:05.701409101 CEST	49806	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:05.701423883 CEST	443	49806	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:05.701486111 CEST	49806	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:05.701597929 CEST	49806	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:05.701602936 CEST	443	49806	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:05.704019070 CEST	443	49801	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:05.704096079 CEST	443	49801	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:05.704148054 CEST	49801	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:05.704194069 CEST	49801	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:05.704194069 CEST	49801	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:05.704210043 CEST	443	49801	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:05.704231977 CEST	443	49801	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:05.705842972 CEST	49807	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:05.705874920 CEST	443	49807	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:05.705940962 CEST	49807	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:05.706056118 CEST	49807	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:05.706070900 CEST	443	49807	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:05.966689110 CEST	49800	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:05.966711044 CEST	443	49800	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:06.273332119 CEST	443	49803	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:06.273983002 CEST	49803	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:06.274002075 CEST	443	49803	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:06.274436951 CEST	49803	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:06.274446011 CEST	443	49803	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:06.331629992 CEST	443	49805	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:06.332304001 CEST	49805	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:06.332324982 CEST	443	49805	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:06.332540035 CEST	49805	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:06.332545042 CEST	443	49805	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:06.336997986 CEST	443	49804	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:06.337459087 CEST	49804	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:06.337471008 CEST	443	49804	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:06.337708950 CEST	49804	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:06.337713003 CEST	443	49804	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:06.350488901 CEST	443	49806	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:06.350733042 CEST	49806	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:06.350747108 CEST	443	49806	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:06.351041079 CEST	49806	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:06.351043940 CEST	443	49806	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:06.354123116 CEST	443	49807	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:06.354434013 CEST	49807	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:06.354440928 CEST	443	49807	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:06.354880095 CEST	49807	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:06.354882956 CEST	443	49807	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:06.373959064 CEST	443	49803	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:06.374094009 CEST	443	49803	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:06.374155998 CEST	49803	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:06.374250889 CEST	49803	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:06.374273062 CEST	443	49803	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:06.374308109 CEST	49803	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:06.374317884 CEST	443	49803	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:06.377051115 CEST	49808	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:06.377091885 CEST	443	49808	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:06.377186060 CEST	49808	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:06.377300024 CEST	49808	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:06.377307892 CEST	443	49808	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:06.434556007 CEST	443	49805	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:06.434725046 CEST	443	49805	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:06.434802055 CEST	49805	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:06.434957981 CEST	49805	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:06.434969902 CEST	443	49805	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:06.434978962 CEST	49805	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:06.434983969 CEST	443	49805	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:06.437397003 CEST	49809	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:06.437429905 CEST	443	49809	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:06.437506914 CEST	49809	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:06.437721014 CEST	49809	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:06.437738895 CEST	443	49809	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:06.444525003 CEST	443	49804	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:06.444667101 CEST	443	49804	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:06.444736004 CEST	49804	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:06.444761992 CEST	49804	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:06.444777966 CEST	443	49804	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:06.444853067 CEST	49804	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:06.444933891 CEST	443	49804	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:06.446896076 CEST	49810	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:06.446908951 CEST	443	49810	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:06.446985006 CEST	49810	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:06.447081089 CEST	49810	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:06.447088957 CEST	443	49810	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:06.451684952 CEST	443	49806	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:06.451754093 CEST	443	49806	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:06.451807976 CEST	49806	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:06.451931000 CEST	49806	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:06.451935053 CEST	443	49806	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:06.451944113 CEST	49806	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:06.451948881 CEST	443	49806	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:06.456115961 CEST	443	49807	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:06.456203938 CEST	443	49807	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:06.456267118 CEST	49807	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:06.462048054 CEST	49807	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:06.462048054 CEST	49807	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:06.462066889 CEST	443	49807	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:06.462080002 CEST	443	49807	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:06.462985039 CEST	49811	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:06.463037014 CEST	443	49811	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:06.463104963 CEST	49811	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:06.463413954 CEST	49811	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:06.463433027 CEST	443	49811	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:06.464494944 CEST	49812	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:06.464529991 CEST	443	49812	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:06.464590073 CEST	49812	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:06.464835882 CEST	49812	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:06.464849949 CEST	443	49812	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.071459055 CEST	443	49808	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.079694986 CEST	49808	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.079746008 CEST	443	49808	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.080049992 CEST	49808	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.080058098 CEST	443	49808	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.093375921 CEST	443	49809	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.095051050 CEST	49809	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.095072031 CEST	443	49809	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.095443964 CEST	49809	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.095449924 CEST	443	49809	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.101984024 CEST	443	49810	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.102579117 CEST	49810	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.102587938 CEST	443	49810	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.102948904 CEST	49810	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.102953911 CEST	443	49810	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.117778063 CEST	443	49811	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.118712902 CEST	49811	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.118760109 CEST	443	49811	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.120212078 CEST	49811	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.120228052 CEST	443	49811	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.124525070 CEST	443	49812	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.136670113 CEST	49812	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.136699915 CEST	443	49812	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.137051105 CEST	49812	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.137057066 CEST	443	49812	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.183253050 CEST	443	49808	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.183427095 CEST	443	49808	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.183630943 CEST	49808	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.183689117 CEST	49808	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.183689117 CEST	49808	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.183717012 CEST	443	49808	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.183732986 CEST	443	49808	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.186693907 CEST	49813	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.186796904 CEST	443	49813	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.186883926 CEST	49813	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.187002897 CEST	49813	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.187026024 CEST	443	49813	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.193845034 CEST	443	49809	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.194000959 CEST	443	49809	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.194107056 CEST	49809	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.194143057 CEST	49809	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.194159985 CEST	443	49809	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.194173098 CEST	49809	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.194180012 CEST	443	49809	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.196480989 CEST	49814	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.196501970 CEST	443	49814	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.196594954 CEST	49814	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.196722984 CEST	49814	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.196748972 CEST	443	49814	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.203051090 CEST	443	49810	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.203195095 CEST	443	49810	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.203249931 CEST	49810	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.203324080 CEST	49810	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.203332901 CEST	443	49810	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.203352928 CEST	49810	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.203357935 CEST	443	49810	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.205462933 CEST	49815	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.205497980 CEST	443	49815	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.205559015 CEST	49815	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.205714941 CEST	49815	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.205725908 CEST	443	49815	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.218199968 CEST	443	49811	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.218350887 CEST	443	49811	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.218410015 CEST	49811	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.218480110 CEST	49811	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.218480110 CEST	49811	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.218512058 CEST	443	49811	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.218537092 CEST	443	49811	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.220331907 CEST	49816	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.220357895 CEST	443	49816	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.220423937 CEST	49816	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.220567942 CEST	49816	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.220582008 CEST	443	49816	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.236087084 CEST	443	49812	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.236186981 CEST	443	49812	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.236241102 CEST	49812	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.236291885 CEST	49812	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.236299992 CEST	443	49812	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.236324072 CEST	49812	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.236327887 CEST	443	49812	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.238246918 CEST	49817	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.238287926 CEST	443	49817	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.238346100 CEST	49817	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.238437891 CEST	49817	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.238452911 CEST	443	49817	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.810759068 CEST	443	49817	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.811290979 CEST	49817	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.811336994 CEST	443	49817	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.811743975 CEST	49817	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.811750889 CEST	443	49817	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.851445913 CEST	443	49814	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.852027893 CEST	49814	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.852080107 CEST	443	49814	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.852519989 CEST	49814	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.852535009 CEST	443	49814	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.871265888 CEST	443	49813	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.871665001 CEST	49813	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.871680975 CEST	443	49813	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.872196913 CEST	49813	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.872206926 CEST	443	49813	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.877732992 CEST	443	49816	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.878047943 CEST	49816	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.878073931 CEST	443	49816	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.878400087 CEST	49816	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.878406048 CEST	443	49816	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.906857967 CEST	443	49815	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.907265902 CEST	49815	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.907334089 CEST	443	49815	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.907613039 CEST	49815	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.907627106 CEST	443	49815	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.945641994 CEST	443	49817	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.945713043 CEST	443	49817	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.945872068 CEST	49817	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.945911884 CEST	49817	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.945935011 CEST	443	49817	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.945946932 CEST	49817	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.945954084 CEST	443	49817	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.948613882 CEST	49818	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.948641062 CEST	443	49818	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.948712111 CEST	49818	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.948826075 CEST	49818	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.948841095 CEST	443	49818	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.964315891 CEST	443	49814	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.964462996 CEST	443	49814	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.964658022 CEST	49814	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.964658022 CEST	49814	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.964658022 CEST	49814	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.966176987 CEST	49819	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.966228008 CEST	443	49819	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.966308117 CEST	49819	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.966420889 CEST	49819	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.966443062 CEST	443	49819	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.976171017 CEST	443	49813	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.976313114 CEST	443	49813	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.976386070 CEST	49813	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.976568937 CEST	49813	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.976568937 CEST	49813	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.976598978 CEST	443	49813	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.976624012 CEST	443	49813	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.978010893 CEST	49820	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.978074074 CEST	443	49820	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.978156090 CEST	49820	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.978257895 CEST	49820	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.978277922 CEST	443	49820	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.980488062 CEST	443	49816	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.980623007 CEST	443	49816	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.980691910 CEST	49816	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.980714083 CEST	49816	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.980727911 CEST	443	49816	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.980740070 CEST	49816	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.980746031 CEST	443	49816	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.982201099 CEST	49821	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.982240915 CEST	443	49821	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:07.982336044 CEST	49821	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.982454062 CEST	49821	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:07.982465029 CEST	443	49821	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:08.013803005 CEST	443	49815	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:08.014015913 CEST	443	49815	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:08.014090061 CEST	49815	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:08.014143944 CEST	49815	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:08.014143944 CEST	49815	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:08.014178991 CEST	443	49815	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:08.014202118 CEST	443	49815	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:08.015840054 CEST	49822	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:08.015883923 CEST	443	49822	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:08.015985012 CEST	49822	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:08.016110897 CEST	49822	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:08.016127110 CEST	443	49822	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:08.169794083 CEST	49814	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:08.169816971 CEST	443	49814	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:08.520966053 CEST	443	49818	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:08.521569014 CEST	49818	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:08.521605968 CEST	443	49818	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:08.522042036 CEST	49818	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:08.522048950 CEST	443	49818	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:08.627028942 CEST	443	49818	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:08.627104998 CEST	443	49818	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:08.627257109 CEST	49818	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:08.627504110 CEST	49818	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:08.627522945 CEST	443	49818	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:08.627533913 CEST	49818	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:08.627541065 CEST	443	49818	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:08.630491972 CEST	49823	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:08.630580902 CEST	443	49823	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:08.630681038 CEST	49823	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:08.630810976 CEST	49823	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:08.630847931 CEST	443	49823	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:08.633069992 CEST	443	49820	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:08.633475065 CEST	49820	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:08.633486986 CEST	443	49820	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:08.633904934 CEST	49820	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:08.633910894 CEST	443	49820	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:08.643136978 CEST	443	49821	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:08.643727064 CEST	49821	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:08.643759012 CEST	443	49821	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:08.644268990 CEST	49821	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:08.644280910 CEST	443	49821	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:08.648714066 CEST	443	49819	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:08.649070024 CEST	49819	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:08.649091959 CEST	443	49819	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:08.649596930 CEST	49819	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:08.649604082 CEST	443	49819	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:08.698395967 CEST	443	49822	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:08.699219942 CEST	49822	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:08.699232101 CEST	443	49822	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:08.699604988 CEST	49822	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:08.699610949 CEST	443	49822	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:08.734992027 CEST	443	49820	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:08.735132933 CEST	443	49820	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:08.735198975 CEST	49820	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:08.735321045 CEST	49820	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:08.735321045 CEST	49820	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:08.735349894 CEST	443	49820	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:08.735372066 CEST	443	49820	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:08.737432957 CEST	49824	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:08.737478018 CEST	443	49824	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:08.737557888 CEST	49824	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:08.737665892 CEST	49824	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:08.737679958 CEST	443	49824	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:08.749931097 CEST	443	49821	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:08.750056028 CEST	443	49821	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:08.750127077 CEST	49821	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:08.750159979 CEST	49821	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:08.750159979 CEST	49821	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:08.750180960 CEST	443	49821	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:08.750193119 CEST	443	49821	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:08.751868010 CEST	49825	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:08.751890898 CEST	443	49825	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:08.751966000 CEST	49825	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:08.752068996 CEST	49825	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:08.752080917 CEST	443	49825	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:08.753676891 CEST	443	49819	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:08.753825903 CEST	443	49819	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:08.753885984 CEST	49819	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:08.753926039 CEST	49819	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:08.753926992 CEST	49819	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:08.753942966 CEST	443	49819	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:08.753953934 CEST	443	49819	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:08.755494118 CEST	49826	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:08.755502939 CEST	443	49826	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:08.755585909 CEST	49826	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:08.755703926 CEST	49826	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:08.755716085 CEST	443	49826	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:08.807996988 CEST	443	49822	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:08.808178902 CEST	443	49822	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:08.808279991 CEST	49822	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:08.808316946 CEST	49822	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:08.808322906 CEST	443	49822	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:08.808356047 CEST	49822	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:08.808361053 CEST	443	49822	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:08.809871912 CEST	49827	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:08.809963942 CEST	443	49827	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:08.810059071 CEST	49827	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:08.810154915 CEST	49827	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:08.810177088 CEST	443	49827	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:09.285185099 CEST	443	49823	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:09.285758018 CEST	49823	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:09.285841942 CEST	443	49823	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:09.286578894 CEST	49823	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:09.286595106 CEST	443	49823	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:09.385672092 CEST	443	49823	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:09.385691881 CEST	443	49823	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:09.385745049 CEST	443	49823	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:09.385854959 CEST	49823	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:09.385970116 CEST	49823	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:09.386415005 CEST	49823	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:09.386459112 CEST	443	49823	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:09.386490107 CEST	49823	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:09.386504889 CEST	443	49823	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:09.389322042 CEST	49828	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:09.389359951 CEST	443	49828	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:09.389452934 CEST	49828	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:09.389594078 CEST	49828	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:09.389600992 CEST	443	49828	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:09.409629107 CEST	443	49825	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:09.410259962 CEST	49825	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:09.410279036 CEST	443	49825	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:09.410703897 CEST	49825	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:09.410712004 CEST	443	49825	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:09.424016953 CEST	443	49826	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:09.424366951 CEST	49826	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:09.424375057 CEST	443	49826	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:09.424791098 CEST	49826	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:09.424796104 CEST	443	49826	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:09.430605888 CEST	443	49824	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:09.430919886 CEST	49824	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:09.430954933 CEST	443	49824	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:09.431235075 CEST	49824	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:09.431241035 CEST	443	49824	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:09.480200052 CEST	443	49827	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:09.492146969 CEST	49827	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:09.492208958 CEST	443	49827	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:09.492825031 CEST	49827	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:09.492840052 CEST	443	49827	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:09.510597944 CEST	443	49825	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:09.510727882 CEST	443	49825	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:09.510793924 CEST	49825	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:09.513627052 CEST	49825	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:09.513645887 CEST	443	49825	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:09.513659000 CEST	49825	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:09.513667107 CEST	443	49825	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:09.516916990 CEST	49829	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:09.516971111 CEST	443	49829	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:09.517035961 CEST	49829	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:09.517237902 CEST	49829	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:09.517245054 CEST	443	49829	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:09.528330088 CEST	443	49826	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:09.528389931 CEST	443	49826	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:09.528441906 CEST	49826	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:09.528450012 CEST	443	49826	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:09.528477907 CEST	443	49826	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:09.528528929 CEST	49826	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:09.528721094 CEST	49826	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:09.528727055 CEST	443	49826	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:09.528738976 CEST	49826	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:09.528743982 CEST	443	49826	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:09.538156986 CEST	49830	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:09.538170099 CEST	443	49830	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:09.538243055 CEST	49830	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:09.538439035 CEST	49830	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:09.538451910 CEST	443	49830	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:09.555912971 CEST	443	49824	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:09.556090117 CEST	443	49824	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:09.556160927 CEST	49824	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:09.567858934 CEST	49824	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:09.567895889 CEST	443	49824	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:09.567924976 CEST	49824	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:09.567939043 CEST	443	49824	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:09.571757078 CEST	49831	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:09.571791887 CEST	443	49831	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:09.571880102 CEST	49831	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:09.572030067 CEST	49831	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:09.572046995 CEST	443	49831	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:09.630604029 CEST	443	49827	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:09.630657911 CEST	443	49827	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:09.630786896 CEST	49827	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:09.630825043 CEST	443	49827	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:09.630858898 CEST	443	49827	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:09.630899906 CEST	49827	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:09.630932093 CEST	49827	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:09.631088972 CEST	49827	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:09.631088972 CEST	49827	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:09.631118059 CEST	443	49827	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:09.631140947 CEST	443	49827	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:09.633697987 CEST	49832	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:09.633789062 CEST	443	49832	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:09.633872032 CEST	49832	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:09.634054899 CEST	49832	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:09.634104013 CEST	443	49832	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:10.095376015 CEST	443	49828	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:10.096257925 CEST	49828	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:10.096297026 CEST	443	49828	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:10.096926928 CEST	49828	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:10.096935034 CEST	443	49828	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:10.189590931 CEST	443	49829	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:10.190254927 CEST	49829	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:10.190272093 CEST	443	49829	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:10.190787077 CEST	49829	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:10.190790892 CEST	443	49829	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:10.204238892 CEST	443	49828	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:10.204269886 CEST	443	49828	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:10.204339027 CEST	443	49828	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:10.204339027 CEST	49828	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:10.204406977 CEST	49828	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:10.204605103 CEST	49828	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:10.204631090 CEST	443	49828	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:10.204644918 CEST	49828	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:10.204653025 CEST	443	49828	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:10.208225012 CEST	49833	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:10.208271980 CEST	443	49833	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:10.208462000 CEST	49833	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:10.208525896 CEST	49833	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:10.208542109 CEST	443	49833	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:10.210218906 CEST	443	49830	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:10.210567951 CEST	49830	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:10.210580111 CEST	443	49830	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:10.211081982 CEST	49830	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:10.211086035 CEST	443	49830	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:10.226640940 CEST	443	49831	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:10.227152109 CEST	49831	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:10.227179050 CEST	443	49831	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:10.227962017 CEST	49831	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:10.227967978 CEST	443	49831	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:10.287257910 CEST	443	49832	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:10.287846088 CEST	49832	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:10.287877083 CEST	443	49832	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:10.288537025 CEST	49832	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:10.288542986 CEST	443	49832	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:10.291604042 CEST	443	49829	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:10.291765928 CEST	443	49829	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:10.291830063 CEST	49829	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:10.291961908 CEST	49829	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:10.291976929 CEST	443	49829	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:10.292016983 CEST	49829	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:10.292022943 CEST	443	49829	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:10.295671940 CEST	49834	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:10.295766115 CEST	443	49834	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:10.295874119 CEST	49834	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:10.296192884 CEST	49834	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:10.296277046 CEST	443	49834	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:10.314136028 CEST	443	49830	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:10.314270973 CEST	443	49830	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:10.314336061 CEST	49830	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:10.314429045 CEST	49830	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:10.314435959 CEST	443	49830	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:10.314445972 CEST	49830	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:10.314450026 CEST	443	49830	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:10.317379951 CEST	49835	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:10.317408085 CEST	443	49835	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:10.317476034 CEST	49835	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:10.317662001 CEST	49835	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:10.317675114 CEST	443	49835	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:10.328053951 CEST	443	49831	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:10.328227043 CEST	443	49831	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:10.328290939 CEST	49831	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:10.328429937 CEST	49831	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:10.328453064 CEST	443	49831	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:10.328464985 CEST	49831	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:10.328471899 CEST	443	49831	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:10.331258059 CEST	49836	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:10.331322908 CEST	443	49836	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:10.331418991 CEST	49836	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:10.331603050 CEST	49836	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:10.331629038 CEST	443	49836	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:10.389010906 CEST	443	49832	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:10.389169931 CEST	443	49832	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:10.389257908 CEST	49832	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:10.389425993 CEST	49832	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:10.389437914 CEST	443	49832	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:10.389451981 CEST	49832	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:10.389457941 CEST	443	49832	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:10.392153025 CEST	49837	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:10.392188072 CEST	443	49837	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:10.392345905 CEST	49837	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:10.392446041 CEST	49837	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:10.392465115 CEST	443	49837	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:10.858753920 CEST	443	49833	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:10.859729052 CEST	49833	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:10.859790087 CEST	443	49833	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:10.860277891 CEST	49833	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:10.860292912 CEST	443	49833	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:10.959176064 CEST	443	49834	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:10.959705114 CEST	49834	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:10.959789038 CEST	443	49834	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:10.960325003 CEST	49834	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:10.960359097 CEST	443	49834	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:10.962243080 CEST	443	49833	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:10.962413073 CEST	443	49833	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:10.962481022 CEST	49833	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:10.962531090 CEST	49833	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:10.962578058 CEST	443	49833	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:10.962613106 CEST	49833	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:10.962627888 CEST	443	49833	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:10.965686083 CEST	49838	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:10.965728045 CEST	443	49838	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:10.965811014 CEST	49838	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:10.965965033 CEST	49838	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:10.965976000 CEST	443	49838	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:10.998851061 CEST	443	49835	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:10.999368906 CEST	49835	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:10.999411106 CEST	443	49835	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:10.999979973 CEST	49835	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:10.999985933 CEST	443	49835	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.024637938 CEST	443	49836	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.025084019 CEST	49836	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.025110960 CEST	443	49836	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.025945902 CEST	49836	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.025954008 CEST	443	49836	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.054975986 CEST	443	49837	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.055797100 CEST	49837	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.055819035 CEST	443	49837	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.056490898 CEST	49837	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.056497097 CEST	443	49837	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.062109947 CEST	443	49834	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.062306881 CEST	443	49834	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.062380075 CEST	49834	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.062433958 CEST	49834	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.062433958 CEST	49834	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.062465906 CEST	443	49834	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.062489033 CEST	443	49834	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.064881086 CEST	49839	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.064939022 CEST	443	49839	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.065030098 CEST	49839	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.065139055 CEST	49839	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.065161943 CEST	443	49839	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.103224039 CEST	443	49835	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.103368044 CEST	443	49835	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.103492022 CEST	49835	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.103701115 CEST	49835	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.103718042 CEST	443	49835	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.103730917 CEST	49835	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.103739977 CEST	443	49835	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.105978966 CEST	49840	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.106010914 CEST	443	49840	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.106087923 CEST	49840	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.106199980 CEST	49840	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.106211901 CEST	443	49840	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.131675005 CEST	443	49836	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.131850958 CEST	443	49836	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.131936073 CEST	49836	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.132005930 CEST	49836	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.132005930 CEST	49836	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.132035971 CEST	443	49836	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.132060051 CEST	443	49836	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.134665966 CEST	49841	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.134696960 CEST	443	49841	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.134771109 CEST	49841	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.134898901 CEST	49841	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.134907961 CEST	443	49841	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.156658888 CEST	443	49837	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.156817913 CEST	443	49837	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.156893015 CEST	49837	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.156932116 CEST	49837	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.156951904 CEST	443	49837	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.156965971 CEST	49837	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.156972885 CEST	443	49837	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.159208059 CEST	49842	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.159216881 CEST	443	49842	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.159281969 CEST	49842	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.159425020 CEST	49842	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.159436941 CEST	443	49842	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.616242886 CEST	443	49838	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.616920948 CEST	49838	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.616935015 CEST	443	49838	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.617549896 CEST	49838	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.617557049 CEST	443	49838	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.717622042 CEST	443	49838	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.717690945 CEST	443	49838	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.717760086 CEST	49838	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.717978001 CEST	49838	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.717995882 CEST	443	49838	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.718008995 CEST	49838	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.718014956 CEST	443	49838	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.718565941 CEST	443	49839	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.718961000 CEST	49839	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.719005108 CEST	443	49839	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.719575882 CEST	49839	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.719592094 CEST	443	49839	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.721504927 CEST	49843	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.721545935 CEST	443	49843	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.721640110 CEST	49843	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.721820116 CEST	49843	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.721832037 CEST	443	49843	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.760258913 CEST	443	49840	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.760688066 CEST	49840	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.760694981 CEST	443	49840	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.761307955 CEST	49840	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.761311054 CEST	443	49840	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.793492079 CEST	443	49841	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.793972969 CEST	49841	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.793992043 CEST	443	49841	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.794608116 CEST	49841	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.794611931 CEST	443	49841	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.812624931 CEST	443	49842	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.813074112 CEST	49842	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.813096046 CEST	443	49842	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.813586950 CEST	49842	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.813592911 CEST	443	49842	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.818240881 CEST	443	49839	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.819024086 CEST	443	49839	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.819168091 CEST	443	49839	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.819200993 CEST	49839	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.819262981 CEST	49839	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.819327116 CEST	49839	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.819359064 CEST	443	49839	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.819400072 CEST	49839	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.819413900 CEST	443	49839	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.821846008 CEST	49844	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.821882010 CEST	443	49844	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.821964025 CEST	49844	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.822119951 CEST	49844	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.822135925 CEST	443	49844	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.860790014 CEST	443	49840	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.860932112 CEST	443	49840	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.861190081 CEST	49840	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.861253023 CEST	49840	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.861260891 CEST	443	49840	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.861305952 CEST	49840	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.861310959 CEST	443	49840	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.863957882 CEST	49845	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.864046097 CEST	443	49845	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.864236116 CEST	49845	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.864326954 CEST	49845	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.864346981 CEST	443	49845	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.900048971 CEST	443	49841	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.900122881 CEST	443	49841	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.900178909 CEST	49841	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.900201082 CEST	443	49841	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.900244951 CEST	443	49841	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.900295019 CEST	49841	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.900387049 CEST	49841	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.900397062 CEST	443	49841	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.900408030 CEST	49841	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.900412083 CEST	443	49841	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.902905941 CEST	49846	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.902992010 CEST	443	49846	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.903284073 CEST	49846	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.903284073 CEST	49846	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.903362036 CEST	443	49846	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.915848017 CEST	443	49842	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.916146994 CEST	443	49842	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.916213036 CEST	49842	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.916240931 CEST	49842	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.916245937 CEST	443	49842	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.916255951 CEST	49842	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.916260004 CEST	443	49842	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.918761015 CEST	49847	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.918775082 CEST	443	49847	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:11.918849945 CEST	49847	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.918970108 CEST	49847	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:11.918982029 CEST	443	49847	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:12.416413069 CEST	443	49843	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:12.417294025 CEST	49843	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:12.417335987 CEST	443	49843	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:12.417964935 CEST	49843	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:12.417969942 CEST	443	49843	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:12.491911888 CEST	443	49844	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:12.492486000 CEST	49844	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:12.492500067 CEST	443	49844	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:12.493050098 CEST	49844	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:12.493056059 CEST	443	49844	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:12.523597956 CEST	443	49843	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:12.523673058 CEST	443	49843	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:12.523736954 CEST	49843	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:12.523957968 CEST	49843	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:12.523972034 CEST	443	49843	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:12.523979902 CEST	49843	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:12.523984909 CEST	443	49843	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:12.527795076 CEST	49848	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:12.527829885 CEST	443	49848	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:12.527909994 CEST	49848	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:12.528052092 CEST	49848	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:12.528064013 CEST	443	49848	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:12.547612906 CEST	443	49845	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:12.548016071 CEST	49845	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:12.548095942 CEST	443	49845	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:12.548541069 CEST	49845	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:12.548557997 CEST	443	49845	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:12.558342934 CEST	443	49846	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:12.558813095 CEST	49846	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:12.558828115 CEST	443	49846	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:12.559442043 CEST	49846	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:12.559453011 CEST	443	49846	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:12.582845926 CEST	443	49847	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:12.583239079 CEST	49847	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:12.583246946 CEST	443	49847	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:12.583753109 CEST	49847	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:12.583758116 CEST	443	49847	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:12.595158100 CEST	443	49844	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:12.595320940 CEST	443	49844	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:12.595388889 CEST	49844	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:12.595427990 CEST	49844	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:12.595443010 CEST	443	49844	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:12.595457077 CEST	49844	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:12.595463991 CEST	443	49844	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:12.598040104 CEST	49849	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:12.598108053 CEST	443	49849	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:12.598191977 CEST	49849	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:12.598349094 CEST	49849	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:12.598368883 CEST	443	49849	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:12.652556896 CEST	443	49845	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:12.652628899 CEST	443	49845	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:12.652733088 CEST	443	49845	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:12.652880907 CEST	49845	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:12.652880907 CEST	49845	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:12.657238960 CEST	49845	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:12.657291889 CEST	443	49845	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:12.657322884 CEST	49845	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:12.657339096 CEST	443	49845	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:12.658668041 CEST	443	49846	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:12.658813000 CEST	443	49846	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:12.658876896 CEST	49846	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:12.658947945 CEST	49846	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:12.658963919 CEST	443	49846	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:12.658987045 CEST	49846	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:12.658997059 CEST	443	49846	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:12.660890102 CEST	49850	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:12.660950899 CEST	443	49850	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:12.661060095 CEST	49850	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:12.661228895 CEST	49850	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:12.661259890 CEST	443	49850	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:12.661612988 CEST	49851	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:12.661655903 CEST	443	49851	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:12.661722898 CEST	49851	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:12.661839008 CEST	49851	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:12.661859989 CEST	443	49851	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:12.686045885 CEST	443	49847	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:12.686187029 CEST	443	49847	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:12.686264038 CEST	49847	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:12.686518908 CEST	49847	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:12.686518908 CEST	49847	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:12.686528921 CEST	443	49847	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:12.686537981 CEST	443	49847	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:12.689331055 CEST	49852	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:12.689419031 CEST	443	49852	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:12.689762115 CEST	49852	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:12.689762115 CEST	49852	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:12.689898014 CEST	443	49852	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:13.189743042 CEST	443	49848	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:13.190306902 CEST	49848	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:13.190319061 CEST	443	49848	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:13.190932989 CEST	49848	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:13.190938950 CEST	443	49848	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:13.279771090 CEST	443	49849	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:13.281475067 CEST	49849	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:13.281512976 CEST	443	49849	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:13.282959938 CEST	49849	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:13.282967091 CEST	443	49849	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:13.319602966 CEST	443	49848	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:13.319679022 CEST	443	49848	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:13.319735050 CEST	49848	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:13.320015907 CEST	49848	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:13.320030928 CEST	443	49848	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:13.320044041 CEST	49848	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:13.320051908 CEST	443	49848	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:13.325579882 CEST	49853	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:13.325629950 CEST	443	49853	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:13.325705051 CEST	49853	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:13.325921059 CEST	49853	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:13.325937986 CEST	443	49853	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:13.326738119 CEST	443	49850	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:13.326792955 CEST	443	49851	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:13.327276945 CEST	49850	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:13.327302933 CEST	443	49850	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:13.328258038 CEST	49850	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:13.328269005 CEST	443	49850	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:13.328562975 CEST	49851	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:13.328583002 CEST	443	49851	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:13.329411030 CEST	49851	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:13.329417944 CEST	443	49851	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:13.348634958 CEST	443	49852	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:13.349632025 CEST	49852	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:13.349699020 CEST	443	49852	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:13.350383043 CEST	49852	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:13.350398064 CEST	443	49852	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:13.386796951 CEST	443	49849	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:13.386854887 CEST	443	49849	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:13.386928082 CEST	49849	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:13.386946917 CEST	443	49849	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:13.387037039 CEST	443	49849	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:13.387094021 CEST	49849	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:13.387366056 CEST	49849	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:13.387413979 CEST	443	49849	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:13.387449980 CEST	49849	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:13.387465000 CEST	443	49849	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:13.390655994 CEST	49854	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:13.390672922 CEST	443	49854	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:13.390763044 CEST	49854	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:13.390949965 CEST	49854	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:13.390960932 CEST	443	49854	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:13.439444065 CEST	443	49851	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:13.439515114 CEST	443	49850	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:13.439666033 CEST	443	49850	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:13.439763069 CEST	49850	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:13.439863920 CEST	49850	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:13.439893961 CEST	443	49850	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:13.439954042 CEST	49850	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:13.439968109 CEST	443	49851	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:13.439969063 CEST	443	49850	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:13.440042973 CEST	49851	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:13.440074921 CEST	443	49851	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:13.440181017 CEST	443	49851	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:13.440188885 CEST	49851	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:13.440210104 CEST	49851	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:13.440227985 CEST	443	49851	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:13.440241098 CEST	49851	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:13.440244913 CEST	443	49851	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:13.440258980 CEST	443	49851	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:13.442933083 CEST	49855	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:13.443038940 CEST	443	49855	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:13.443079948 CEST	49856	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:13.443108082 CEST	443	49856	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:13.443128109 CEST	49855	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:13.443190098 CEST	49856	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:13.443334103 CEST	49856	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:13.443355083 CEST	443	49856	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:13.443413973 CEST	49855	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:13.443454981 CEST	443	49855	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:13.449239969 CEST	443	49852	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:13.449388981 CEST	443	49852	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:13.449460983 CEST	49852	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:13.449532986 CEST	49852	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:13.449558020 CEST	443	49852	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:13.449584007 CEST	49852	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:13.449596882 CEST	443	49852	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:13.452312946 CEST	49857	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:13.452368021 CEST	443	49857	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:13.452466011 CEST	49857	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:13.452622890 CEST	49857	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:13.452651978 CEST	443	49857	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:13.993757010 CEST	443	49853	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:13.994343042 CEST	49853	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:13.994386911 CEST	443	49853	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:13.994779110 CEST	49853	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:13.994786978 CEST	443	49853	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.045092106 CEST	443	49854	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.045644999 CEST	49854	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.045670033 CEST	443	49854	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.046063900 CEST	49854	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.046067953 CEST	443	49854	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.097121954 CEST	443	49853	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.097201109 CEST	443	49853	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.097393036 CEST	49853	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.097449064 CEST	49853	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.097467899 CEST	443	49853	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.097515106 CEST	49853	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.097522974 CEST	443	49853	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.100514889 CEST	49858	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.100595951 CEST	443	49858	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.100797892 CEST	49858	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.100861073 CEST	49858	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.100876093 CEST	443	49858	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.108150005 CEST	443	49857	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.108509064 CEST	49857	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.108527899 CEST	443	49857	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.108902931 CEST	49857	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.108913898 CEST	443	49857	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.125535965 CEST	443	49856	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.125792027 CEST	443	49855	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.126126051 CEST	49856	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.126157045 CEST	443	49856	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.126245975 CEST	49855	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.126307964 CEST	443	49855	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.126319885 CEST	49856	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.126328945 CEST	443	49856	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.126638889 CEST	49855	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.126693010 CEST	443	49855	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.145958900 CEST	443	49854	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.146105051 CEST	443	49854	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.146167994 CEST	49854	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.146203041 CEST	49854	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.146203041 CEST	49854	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.146214008 CEST	443	49854	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.146224976 CEST	443	49854	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.148992062 CEST	49859	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.149036884 CEST	443	49859	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.149338961 CEST	49859	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.149338961 CEST	49859	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.149405003 CEST	443	49859	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.208719015 CEST	443	49857	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.208894014 CEST	443	49857	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.209178925 CEST	49857	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.209180117 CEST	49857	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.209180117 CEST	49857	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.210937977 CEST	49860	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.211024046 CEST	443	49860	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.211131096 CEST	49860	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.211229086 CEST	49860	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.211250067 CEST	443	49860	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.229747057 CEST	443	49855	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.229842901 CEST	443	49856	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.229855061 CEST	443	49855	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.229945898 CEST	49855	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.229958057 CEST	443	49855	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.230283022 CEST	49855	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.230283022 CEST	49855	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.230283022 CEST	49855	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.230480909 CEST	443	49856	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.230770111 CEST	49856	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.230770111 CEST	49856	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.230770111 CEST	49856	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.231682062 CEST	49861	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.231708050 CEST	443	49861	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.231775999 CEST	49861	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.231892109 CEST	49861	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.231903076 CEST	443	49861	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.232774973 CEST	49862	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.232789040 CEST	443	49862	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.232852936 CEST	49862	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.233000040 CEST	49862	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.233011961 CEST	443	49862	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.513567924 CEST	49857	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.513648987 CEST	443	49857	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.529356956 CEST	49856	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.529387951 CEST	443	49856	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.545037985 CEST	49855	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.545099974 CEST	443	49855	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.751627922 CEST	443	49858	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.752270937 CEST	49858	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.752334118 CEST	443	49858	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.752631903 CEST	49858	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.752646923 CEST	443	49858	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.813635111 CEST	443	49859	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.814217091 CEST	49859	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.814261913 CEST	443	49859	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.814655066 CEST	49859	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.814682007 CEST	443	49859	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.853025913 CEST	443	49858	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.853100061 CEST	443	49858	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.853269100 CEST	49858	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.853457928 CEST	49858	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.853457928 CEST	49858	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.853483915 CEST	443	49858	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.853498936 CEST	443	49858	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.856518984 CEST	49863	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.856606007 CEST	443	49863	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.856942892 CEST	49863	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.856944084 CEST	49863	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.857076883 CEST	443	49863	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.867665052 CEST	443	49860	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.868130922 CEST	49860	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.868194103 CEST	443	49860	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.868530989 CEST	49860	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.868585110 CEST	443	49860	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.882505894 CEST	443	49861	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.882814884 CEST	49861	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.882838964 CEST	443	49861	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.883371115 CEST	49861	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.883378983 CEST	443	49861	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.916399002 CEST	443	49859	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.916469097 CEST	443	49859	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.916520119 CEST	49859	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.916538954 CEST	443	49859	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.916569948 CEST	443	49859	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.916618109 CEST	49859	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.916670084 CEST	49859	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.916685104 CEST	443	49859	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.916697979 CEST	49859	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.916703939 CEST	443	49859	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.918906927 CEST	49864	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.918942928 CEST	443	49864	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.919004917 CEST	49864	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.919112921 CEST	49864	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.919117928 CEST	443	49864	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.925976992 CEST	443	49862	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.926340103 CEST	49862	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.926372051 CEST	443	49862	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.926672935 CEST	49862	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.926678896 CEST	443	49862	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.967813015 CEST	443	49860	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.968136072 CEST	443	49860	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.968436003 CEST	49860	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.968436003 CEST	49860	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.968436003 CEST	49860	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.970026970 CEST	49865	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.970055103 CEST	443	49865	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.970339060 CEST	49865	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.970339060 CEST	49865	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.970381021 CEST	443	49865	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.982646942 CEST	443	49861	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.982953072 CEST	443	49861	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.983026981 CEST	49861	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.983230114 CEST	49861	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.983230114 CEST	49861	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.983247995 CEST	443	49861	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.983258963 CEST	443	49861	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.984939098 CEST	49866	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.984967947 CEST	443	49866	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:14.985132933 CEST	49866	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.985168934 CEST	49866	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:14.985178947 CEST	443	49866	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:15.032035112 CEST	443	49862	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:15.032197952 CEST	443	49862	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:15.032377958 CEST	49862	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:15.036768913 CEST	49862	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:15.036768913 CEST	49862	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:15.036792040 CEST	443	49862	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:15.036813974 CEST	443	49862	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:15.039603949 CEST	49867	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:15.039628029 CEST	443	49867	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:15.039712906 CEST	49867	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:15.039834976 CEST	49867	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:15.039848089 CEST	443	49867	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:15.279306889 CEST	49860	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:15.279371023 CEST	443	49860	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:15.552120924 CEST	443	49863	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:15.552788019 CEST	49863	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:15.552875996 CEST	443	49863	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:15.553288937 CEST	49863	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:15.553304911 CEST	443	49863	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:15.565610886 CEST	443	49864	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:15.565903902 CEST	49864	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:15.565923929 CEST	443	49864	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:15.566262007 CEST	49864	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:15.566267014 CEST	443	49864	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:15.635159016 CEST	443	49865	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:15.635677099 CEST	49865	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:15.635699987 CEST	443	49865	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:15.636168003 CEST	49865	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:15.636173964 CEST	443	49865	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:15.658325911 CEST	443	49863	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:15.658391953 CEST	443	49863	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:15.658493996 CEST	443	49863	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:15.658617973 CEST	49863	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:15.658617973 CEST	49863	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:15.658751965 CEST	49863	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:15.658751965 CEST	49863	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:15.658792973 CEST	443	49863	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:15.658821106 CEST	443	49863	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:15.666445017 CEST	443	49864	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:15.666656017 CEST	443	49864	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:15.666733027 CEST	49864	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:15.678757906 CEST	443	49866	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:15.696316004 CEST	443	49867	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:15.732336998 CEST	49866	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:15.745784998 CEST	443	49865	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:15.745999098 CEST	49868	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:15.746043921 CEST	443	49865	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:15.746052027 CEST	443	49868	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:15.746114969 CEST	49865	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:15.746139050 CEST	49868	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:15.746248007 CEST	49864	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:15.746275902 CEST	443	49864	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:15.746309996 CEST	49864	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:15.746316910 CEST	443	49864	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:15.747318983 CEST	49868	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:15.747335911 CEST	443	49868	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:15.747354984 CEST	49865	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:15.747370005 CEST	443	49865	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:15.747380972 CEST	49865	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:15.747390032 CEST	443	49865	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:15.747930050 CEST	49867	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:15.748209000 CEST	49866	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:15.748214006 CEST	443	49866	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:15.748827934 CEST	49866	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:15.748832941 CEST	443	49866	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:15.758912086 CEST	49867	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:15.758924007 CEST	443	49867	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:15.759299040 CEST	49867	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:15.759304047 CEST	443	49867	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:15.775635958 CEST	49869	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:15.775727034 CEST	443	49869	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:15.775979996 CEST	49869	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:15.779052973 CEST	49869	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:15.779136896 CEST	443	49869	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:15.807492018 CEST	49870	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:15.807578087 CEST	443	49870	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:15.807667971 CEST	49870	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:15.846949100 CEST	49870	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:15.847031116 CEST	443	49870	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:15.852494955 CEST	443	49866	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:15.852667093 CEST	443	49866	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:15.852741003 CEST	49866	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:15.854803085 CEST	49866	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:15.854815006 CEST	443	49866	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:15.854823112 CEST	49866	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:15.854826927 CEST	443	49866	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:15.857400894 CEST	443	49867	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:15.857464075 CEST	443	49867	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:15.857521057 CEST	49867	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:15.857542038 CEST	443	49867	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:15.857568979 CEST	443	49867	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:15.857642889 CEST	49867	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:15.859150887 CEST	49867	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:15.859165907 CEST	443	49867	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:15.859211922 CEST	49867	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:15.859217882 CEST	443	49867	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:15.883892059 CEST	49871	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:15.883929014 CEST	443	49871	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:15.884016991 CEST	49871	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:15.888508081 CEST	49872	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:15.888578892 CEST	443	49872	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:15.888667107 CEST	49872	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:15.892422915 CEST	49871	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:15.892436028 CEST	443	49871	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:15.892544031 CEST	49872	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:15.892576933 CEST	443	49872	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:16.409795046 CEST	443	49868	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:16.410487890 CEST	49868	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:16.410504103 CEST	443	49868	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:16.411156893 CEST	49868	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:16.411160946 CEST	443	49868	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:16.440495968 CEST	443	49869	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:16.447670937 CEST	49869	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:16.447732925 CEST	443	49869	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:16.448052883 CEST	49869	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:16.448069096 CEST	443	49869	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:16.506484985 CEST	443	49870	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:16.507122040 CEST	49870	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:16.507184029 CEST	443	49870	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:16.507348061 CEST	49870	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:16.507364035 CEST	443	49870	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:16.510622025 CEST	443	49868	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:16.510790110 CEST	443	49868	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:16.510853052 CEST	49868	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:16.511152029 CEST	49868	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:16.511168957 CEST	443	49868	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:16.511219025 CEST	49868	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:16.511224031 CEST	443	49868	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:16.514152050 CEST	49873	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:16.514261961 CEST	443	49873	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:16.514353037 CEST	49873	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:16.514481068 CEST	49873	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:16.514507055 CEST	443	49873	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:16.546411991 CEST	443	49869	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:16.546479940 CEST	443	49869	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:16.546622038 CEST	443	49869	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:16.546700001 CEST	49869	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:16.546780109 CEST	49869	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:16.547281981 CEST	49869	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:16.547281981 CEST	49869	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:16.547348976 CEST	443	49869	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:16.547384024 CEST	443	49869	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:16.549978018 CEST	49874	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:16.550062895 CEST	443	49874	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:16.550156116 CEST	49874	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:16.550291061 CEST	49874	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:16.550319910 CEST	443	49874	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:16.560214043 CEST	443	49872	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:16.560733080 CEST	49872	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:16.560796976 CEST	443	49872	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:16.560950994 CEST	49872	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:16.560966969 CEST	443	49872	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:16.574562073 CEST	443	49871	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:16.575047970 CEST	49871	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:16.575057030 CEST	443	49871	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:16.575653076 CEST	49871	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:16.575658083 CEST	443	49871	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:16.606324911 CEST	443	49870	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:16.606462955 CEST	443	49870	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:16.606666088 CEST	49870	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:16.606745958 CEST	49870	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:16.606790066 CEST	443	49870	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:16.606823921 CEST	49870	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:16.606839895 CEST	443	49870	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:16.609006882 CEST	49875	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:16.609097958 CEST	443	49875	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:16.609190941 CEST	49875	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:16.609318018 CEST	49875	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:16.609340906 CEST	443	49875	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:16.661848068 CEST	443	49872	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:16.661993027 CEST	443	49872	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:16.662061930 CEST	49872	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:16.662107944 CEST	49872	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:16.662107944 CEST	49872	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:16.662132978 CEST	443	49872	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:16.662153006 CEST	443	49872	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:16.664170027 CEST	49876	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:16.664211035 CEST	443	49876	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:16.664331913 CEST	49876	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:16.664465904 CEST	49876	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:16.664499998 CEST	443	49876	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:16.680059910 CEST	443	49871	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:16.680159092 CEST	443	49871	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:16.680205107 CEST	49871	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:16.680212021 CEST	443	49871	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:16.680259943 CEST	443	49871	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:16.680305958 CEST	49871	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:16.680351019 CEST	49871	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:16.680361032 CEST	443	49871	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:16.680368900 CEST	49871	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:16.680372953 CEST	443	49871	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:16.682363987 CEST	49877	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:16.682387114 CEST	443	49877	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:16.682451963 CEST	49877	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:16.682554007 CEST	49877	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:16.682565928 CEST	443	49877	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:17.168421984 CEST	443	49873	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:17.168977976 CEST	49873	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:17.169054985 CEST	443	49873	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:17.169485092 CEST	49873	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:17.169500113 CEST	443	49873	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:17.244020939 CEST	443	49874	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:17.244664907 CEST	49874	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:17.244728088 CEST	443	49874	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:17.245050907 CEST	49874	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:17.245066881 CEST	443	49874	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:17.263884068 CEST	443	49875	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:17.264211893 CEST	49875	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:17.264240026 CEST	443	49875	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:17.264584064 CEST	49875	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:17.264589071 CEST	443	49875	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:17.270888090 CEST	443	49873	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:17.273766994 CEST	443	49873	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:17.273854971 CEST	49873	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:17.273873091 CEST	443	49873	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:17.273946047 CEST	49873	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:17.273998976 CEST	49873	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:17.273998976 CEST	49873	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:17.274039984 CEST	443	49873	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:17.274066925 CEST	443	49873	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:17.276748896 CEST	49878	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:17.276774883 CEST	443	49878	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:17.276833057 CEST	49878	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:17.276954889 CEST	49878	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:17.276962996 CEST	443	49878	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:17.316447973 CEST	443	49876	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:17.316889048 CEST	49876	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:17.316929102 CEST	443	49876	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:17.317475080 CEST	49876	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:17.317487955 CEST	443	49876	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:17.350181103 CEST	443	49874	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:17.350372076 CEST	443	49874	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:17.350548983 CEST	49874	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:17.350548983 CEST	49874	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:17.350548983 CEST	49874	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:17.352684975 CEST	49879	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:17.352780104 CEST	443	49879	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:17.352860928 CEST	49879	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:17.353001118 CEST	49879	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:17.353029013 CEST	443	49879	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:17.362803936 CEST	443	49877	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:17.363104105 CEST	49877	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:17.363112926 CEST	443	49877	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:17.363535881 CEST	49877	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:17.363540888 CEST	443	49877	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:17.368031979 CEST	443	49875	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:17.370856047 CEST	443	49875	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:17.370927095 CEST	49875	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:17.370938063 CEST	443	49875	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:17.370956898 CEST	443	49875	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:17.371001959 CEST	49875	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:17.371026039 CEST	49875	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:17.371026039 CEST	49875	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:17.371038914 CEST	443	49875	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:17.371046066 CEST	443	49875	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:17.372867107 CEST	49880	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:17.372951984 CEST	443	49880	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:17.373028994 CEST	49880	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:17.373167992 CEST	49880	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:17.373209953 CEST	443	49880	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:17.443943977 CEST	443	49876	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:17.444013119 CEST	443	49876	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:17.444108963 CEST	49876	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:17.444200039 CEST	49876	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:17.444200039 CEST	49876	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:17.444246054 CEST	443	49876	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:17.444276094 CEST	443	49876	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:17.445950031 CEST	49881	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:17.445976973 CEST	443	49881	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:17.446043015 CEST	49881	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:17.446125031 CEST	49881	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:17.446130991 CEST	443	49881	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:17.503837109 CEST	443	49877	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:17.504726887 CEST	443	49877	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:17.504826069 CEST	49877	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:17.504865885 CEST	49877	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:17.504882097 CEST	443	49877	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:17.504890919 CEST	49877	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:17.504895926 CEST	443	49877	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:17.507921934 CEST	49882	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:17.507936954 CEST	443	49882	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:17.508001089 CEST	49882	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:17.508124113 CEST	49882	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:17.508133888 CEST	443	49882	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:17.654328108 CEST	49874	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:17.654391050 CEST	443	49874	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:17.950897932 CEST	443	49880	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:17.951458931 CEST	49880	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:17.951520920 CEST	443	49880	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:17.951877117 CEST	49880	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:17.951891899 CEST	443	49880	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:17.956343889 CEST	443	49878	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:17.956598043 CEST	49878	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:17.956628084 CEST	443	49878	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:17.957016945 CEST	49878	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:17.957026958 CEST	443	49878	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.047297955 CEST	443	49879	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.047642946 CEST	49879	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.047703981 CEST	443	49879	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.048042059 CEST	49879	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.048054934 CEST	443	49879	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.051239967 CEST	443	49880	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.051475048 CEST	443	49880	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.051549911 CEST	49880	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.051635981 CEST	49880	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.051635981 CEST	49880	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.051681042 CEST	443	49880	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.051709890 CEST	443	49880	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.054229021 CEST	49883	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.054280043 CEST	443	49883	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.054375887 CEST	49883	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.054508924 CEST	49883	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.054538012 CEST	443	49883	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.058151960 CEST	443	49878	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.058326960 CEST	443	49878	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.058389902 CEST	49878	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.058432102 CEST	49878	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.058432102 CEST	49878	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.058453083 CEST	443	49878	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.058465958 CEST	443	49878	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.060590029 CEST	49884	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.060630083 CEST	443	49884	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.060694933 CEST	49884	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.060821056 CEST	49884	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.060834885 CEST	443	49884	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.091130018 CEST	443	49881	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.091487885 CEST	49881	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.091500044 CEST	443	49881	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.091835022 CEST	49881	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.091839075 CEST	443	49881	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.151468992 CEST	443	49879	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.151540995 CEST	443	49879	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.151627064 CEST	49879	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.151664972 CEST	443	49879	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.151734114 CEST	49879	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.151799917 CEST	49879	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.151799917 CEST	49879	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.151844978 CEST	443	49879	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.151871920 CEST	443	49879	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.154037952 CEST	49885	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.154067993 CEST	443	49885	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.154139996 CEST	49885	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.154285908 CEST	49885	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.154295921 CEST	443	49885	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.161880970 CEST	443	49882	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.162157059 CEST	49882	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.162163973 CEST	443	49882	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.162507057 CEST	49882	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.162511110 CEST	443	49882	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.191481113 CEST	443	49881	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.191515923 CEST	443	49881	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.191571951 CEST	49881	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.191571951 CEST	443	49881	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.191616058 CEST	49881	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.191745043 CEST	49881	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.191754103 CEST	443	49881	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.191762924 CEST	49881	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.191767931 CEST	443	49881	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.193465948 CEST	49886	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.193475008 CEST	443	49886	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.193536997 CEST	49886	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.193629980 CEST	49886	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.193639040 CEST	443	49886	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.262973070 CEST	443	49882	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.263114929 CEST	443	49882	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.263235092 CEST	49882	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.263358116 CEST	49882	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.263365030 CEST	443	49882	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.263416052 CEST	49882	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.263420105 CEST	443	49882	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.266149044 CEST	49887	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.266185045 CEST	443	49887	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.266272068 CEST	49887	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.266376019 CEST	49887	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.266383886 CEST	443	49887	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.709189892 CEST	443	49883	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.709985018 CEST	49883	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.710050106 CEST	443	49883	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.710318089 CEST	49883	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.710334063 CEST	443	49883	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.728205919 CEST	443	49884	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.728619099 CEST	49884	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.728650093 CEST	443	49884	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.728908062 CEST	49884	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.728914022 CEST	443	49884	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.809281111 CEST	443	49883	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.809443951 CEST	443	49883	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.809533119 CEST	49883	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.809576035 CEST	49883	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.809600115 CEST	443	49883	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.809618950 CEST	49883	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.809624910 CEST	443	49883	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.811690092 CEST	49888	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.811717987 CEST	443	49888	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.811780930 CEST	49888	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.811883926 CEST	49888	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.811891079 CEST	443	49888	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.838407993 CEST	443	49884	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.838589907 CEST	443	49884	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.838654041 CEST	49884	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.838682890 CEST	49884	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.838691950 CEST	443	49884	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.838701963 CEST	49884	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.838706970 CEST	443	49884	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.840436935 CEST	49889	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.840487003 CEST	443	49889	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.840564966 CEST	49889	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.840687990 CEST	49889	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.840702057 CEST	443	49889	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.844578028 CEST	443	49885	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.844892025 CEST	49885	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.844901085 CEST	443	49885	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.845292091 CEST	49885	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.845297098 CEST	443	49885	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.881279945 CEST	443	49886	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.881633043 CEST	49886	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.881642103 CEST	443	49886	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.882035971 CEST	49886	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.882040977 CEST	443	49886	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.920455933 CEST	443	49887	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.921080112 CEST	49887	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.921104908 CEST	443	49887	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.921437979 CEST	49887	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.921456099 CEST	443	49887	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.948947906 CEST	443	49885	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.949016094 CEST	443	49885	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.949115038 CEST	443	49885	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.949167013 CEST	49885	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.949297905 CEST	49885	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.949297905 CEST	49885	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.949323893 CEST	49885	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.949336052 CEST	443	49885	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.951834917 CEST	49890	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.951855898 CEST	443	49890	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.951941967 CEST	49890	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.952066898 CEST	49890	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.952076912 CEST	443	49890	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.988719940 CEST	443	49886	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.988785982 CEST	443	49886	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.989008904 CEST	49886	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.989026070 CEST	49886	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.989032030 CEST	443	49886	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.989224911 CEST	49886	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.989231110 CEST	443	49886	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.990722895 CEST	49891	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.990756035 CEST	443	49891	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:18.990827084 CEST	49891	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.990933895 CEST	49891	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:18.990948915 CEST	443	49891	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:19.066786051 CEST	443	49887	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:19.066862106 CEST	443	49887	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:19.066963911 CEST	443	49887	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:19.067259073 CEST	49887	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:19.067259073 CEST	49887	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:19.067259073 CEST	49887	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:19.067259073 CEST	49887	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:19.068893909 CEST	49892	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:19.068936110 CEST	443	49892	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:19.069003105 CEST	49892	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:19.069098949 CEST	49892	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:19.069113016 CEST	443	49892	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:19.370816946 CEST	49887	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:19.370839119 CEST	443	49887	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:19.499185085 CEST	443	49888	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:19.499778032 CEST	49888	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:19.499805927 CEST	443	49888	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:19.500258923 CEST	49888	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:19.500263929 CEST	443	49888	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:19.537125111 CEST	443	49889	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:19.537455082 CEST	49889	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:19.537480116 CEST	443	49889	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:19.537868023 CEST	49889	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:19.537873983 CEST	443	49889	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:19.603658915 CEST	443	49888	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:19.603791952 CEST	443	49888	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:19.603847027 CEST	49888	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:19.603943110 CEST	49888	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:19.603965998 CEST	443	49888	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:19.603979111 CEST	49888	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:19.603984118 CEST	443	49888	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:19.607630968 CEST	49893	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:19.607667923 CEST	443	49893	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:19.607722044 CEST	49893	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:19.608113050 CEST	49893	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:19.608124971 CEST	443	49893	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:19.618691921 CEST	443	49890	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:19.619033098 CEST	49890	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:19.619057894 CEST	443	49890	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:19.619429111 CEST	49890	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:19.619434118 CEST	443	49890	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:19.638570070 CEST	443	49889	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:19.638719082 CEST	443	49889	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:19.638772011 CEST	49889	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:19.638926983 CEST	49889	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:19.638947010 CEST	443	49889	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:19.638959885 CEST	49889	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:19.638967037 CEST	443	49889	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:19.641232967 CEST	49894	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:19.641246080 CEST	443	49894	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:19.641308069 CEST	49894	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:19.641446114 CEST	49894	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:19.641454935 CEST	443	49894	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:19.670239925 CEST	443	49891	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:19.670572042 CEST	49891	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:19.670582056 CEST	443	49891	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:19.671163082 CEST	49891	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:19.671168089 CEST	443	49891	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:19.718713045 CEST	443	49890	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:19.718919039 CEST	443	49890	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:19.718974113 CEST	49890	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:19.719078064 CEST	49890	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:19.719100952 CEST	443	49890	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:19.719115019 CEST	49890	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:19.719121933 CEST	443	49890	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:19.721520901 CEST	49895	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:19.721617937 CEST	443	49895	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:19.721689939 CEST	49895	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:19.721796989 CEST	49895	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:19.721821070 CEST	443	49895	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:19.723858118 CEST	443	49892	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:19.724180937 CEST	49892	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:19.724200010 CEST	443	49892	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:19.724585056 CEST	49892	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:19.724596024 CEST	443	49892	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:19.774175882 CEST	443	49891	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:19.774358034 CEST	443	49891	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:19.774408102 CEST	49891	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:19.774748087 CEST	49891	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:19.774761915 CEST	443	49891	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:19.774805069 CEST	49891	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:19.774810076 CEST	443	49891	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:19.778188944 CEST	49896	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:19.778263092 CEST	443	49896	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:19.778332949 CEST	49896	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:19.778547049 CEST	49896	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:19.778578997 CEST	443	49896	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:19.824035883 CEST	443	49892	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:19.824491024 CEST	443	49892	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:19.824564934 CEST	49892	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:19.826124907 CEST	49892	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:19.826126099 CEST	49892	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:19.826169014 CEST	443	49892	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:19.826196909 CEST	443	49892	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:19.828439951 CEST	49897	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:19.828471899 CEST	443	49897	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:19.828524113 CEST	49897	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:19.828658104 CEST	49897	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:19.828684092 CEST	443	49897	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:20.274981022 CEST	443	49893	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:20.275446892 CEST	49893	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:20.275475979 CEST	443	49893	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:20.275849104 CEST	49893	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:20.275854111 CEST	443	49893	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:20.324249029 CEST	443	49894	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:20.324544907 CEST	49894	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:20.324558020 CEST	443	49894	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:20.324944973 CEST	49894	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:20.324949026 CEST	443	49894	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:20.377017021 CEST	443	49893	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:20.377163887 CEST	443	49893	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:20.377221107 CEST	49893	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:20.377335072 CEST	49893	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:20.377350092 CEST	443	49893	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:20.377357960 CEST	49893	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:20.377362967 CEST	443	49893	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:20.379817009 CEST	49898	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:20.379859924 CEST	443	49898	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:20.380069971 CEST	49898	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:20.380215883 CEST	49898	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:20.380225897 CEST	443	49898	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:20.388253927 CEST	443	49895	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:20.388617039 CEST	49895	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:20.388679981 CEST	443	49895	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:20.388973951 CEST	49895	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:20.388988018 CEST	443	49895	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:20.431344032 CEST	443	49894	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:20.431495905 CEST	443	49894	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:20.431555986 CEST	49894	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:20.431689024 CEST	49894	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:20.431694031 CEST	443	49894	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:20.431765079 CEST	49894	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:20.431768894 CEST	443	49894	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:20.434047937 CEST	49899	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:20.434113979 CEST	443	49899	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:20.434232950 CEST	49899	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:20.434393883 CEST	49899	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:20.434410095 CEST	443	49899	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:20.440499067 CEST	443	49896	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:20.440903902 CEST	49896	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:20.440932989 CEST	443	49896	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:20.441252947 CEST	49896	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:20.441263914 CEST	443	49896	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:20.487241983 CEST	443	49897	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:20.487540960 CEST	49897	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:20.487560987 CEST	443	49897	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:20.487878084 CEST	49897	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:20.487884045 CEST	443	49897	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:20.490637064 CEST	443	49895	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:20.490734100 CEST	443	49895	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:20.490787029 CEST	443	49895	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:20.490946054 CEST	49895	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:20.490946054 CEST	49895	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:20.490946054 CEST	49895	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:20.490946054 CEST	49895	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:20.492578983 CEST	49900	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:20.492619991 CEST	443	49900	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:20.492850065 CEST	49900	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:20.492963076 CEST	49900	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:20.492980003 CEST	443	49900	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:20.587821960 CEST	443	49897	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:20.588275909 CEST	443	49897	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:20.588351011 CEST	49897	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:20.588447094 CEST	49897	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:20.588447094 CEST	49897	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:20.588469028 CEST	443	49897	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:20.588480949 CEST	443	49897	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:20.589190006 CEST	443	49896	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:20.589317083 CEST	443	49896	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:20.589406013 CEST	49896	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:20.589812994 CEST	49896	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:20.589812994 CEST	49896	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:20.589853048 CEST	443	49896	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:20.589876890 CEST	443	49896	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:20.592783928 CEST	49901	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:20.592884064 CEST	443	49901	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:20.593077898 CEST	49901	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:20.598942041 CEST	49901	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:20.598984957 CEST	443	49901	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:20.599106073 CEST	49902	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:20.599128962 CEST	443	49902	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:20.600940943 CEST	49902	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:20.601079941 CEST	49902	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:20.601108074 CEST	443	49902	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:20.794845104 CEST	49895	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:20.794913054 CEST	443	49895	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.033853054 CEST	443	49898	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.036539078 CEST	49898	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:21.036559105 CEST	443	49898	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.037020922 CEST	49898	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:21.037030935 CEST	443	49898	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.100631952 CEST	443	49899	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.101197958 CEST	49899	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:21.101243019 CEST	443	49899	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.101457119 CEST	49899	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:21.101470947 CEST	443	49899	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.134573936 CEST	443	49898	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.134706020 CEST	443	49898	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.134867907 CEST	49898	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:21.134867907 CEST	49898	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:21.134867907 CEST	49898	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:21.136898994 CEST	49903	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:21.137006044 CEST	443	49903	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.137100935 CEST	49903	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:21.137221098 CEST	49903	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:21.137242079 CEST	443	49903	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.142961979 CEST	443	49900	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.143266916 CEST	49900	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:21.143285990 CEST	443	49900	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.143611908 CEST	49900	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:21.143621922 CEST	443	49900	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.202970982 CEST	443	49899	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.203015089 CEST	443	49899	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.203166008 CEST	49899	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:21.203191996 CEST	443	49899	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.203242064 CEST	443	49899	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.203291893 CEST	49899	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:21.203350067 CEST	443	49899	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.203378916 CEST	49899	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:21.203378916 CEST	49899	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:21.203427076 CEST	443	49899	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.203445911 CEST	443	49899	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.204973936 CEST	49904	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:21.204998970 CEST	443	49904	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.205071926 CEST	49904	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:21.205176115 CEST	49904	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:21.205185890 CEST	443	49904	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.244007111 CEST	443	49900	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.244067907 CEST	443	49900	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.244152069 CEST	443	49900	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.244240999 CEST	49900	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:21.244291067 CEST	49900	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:21.244292021 CEST	49900	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:21.245984077 CEST	49900	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:21.246007919 CEST	443	49900	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.246104002 CEST	49905	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:21.246196985 CEST	443	49905	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.246284008 CEST	49905	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:21.246382952 CEST	49905	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:21.246406078 CEST	443	49905	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.252526999 CEST	443	49901	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.252871990 CEST	49901	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:21.252937078 CEST	443	49901	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.253281116 CEST	49901	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:21.253293991 CEST	443	49901	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.294440985 CEST	443	49902	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.294949055 CEST	49902	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:21.295000076 CEST	443	49902	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.295332909 CEST	49902	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:21.295346022 CEST	443	49902	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.353259087 CEST	443	49901	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.353446007 CEST	443	49901	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.353640079 CEST	49901	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:21.353640079 CEST	49901	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:21.353640079 CEST	49901	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:21.355902910 CEST	49906	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:21.355992079 CEST	443	49906	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.356067896 CEST	49906	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:21.356223106 CEST	49906	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:21.356252909 CEST	443	49906	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.400634050 CEST	443	49902	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.400705099 CEST	443	49902	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.400809050 CEST	443	49902	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.400881052 CEST	49902	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:21.400881052 CEST	49902	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:21.400968075 CEST	49902	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:21.400969028 CEST	49902	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:21.401011944 CEST	443	49902	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.401047945 CEST	443	49902	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.403033972 CEST	49907	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:21.403060913 CEST	443	49907	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.403126955 CEST	49907	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:21.403255939 CEST	49907	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:21.403265953 CEST	443	49907	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.435439110 CEST	49898	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:21.435458899 CEST	443	49898	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.654257059 CEST	49901	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:21.654319048 CEST	443	49901	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.828018904 CEST	443	49903	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.828680992 CEST	49903	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:21.828706026 CEST	443	49903	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.829284906 CEST	49903	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:21.829289913 CEST	443	49903	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.865956068 CEST	443	49904	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.866466045 CEST	49904	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:21.866482019 CEST	443	49904	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.866756916 CEST	49904	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:21.866761923 CEST	443	49904	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.932785988 CEST	443	49903	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.932820082 CEST	443	49903	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.932866096 CEST	443	49903	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.933185101 CEST	49903	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:21.933525085 CEST	49903	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:21.933537006 CEST	443	49903	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.933547020 CEST	49903	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:21.933552027 CEST	443	49903	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.937115908 CEST	49908	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:21.937159061 CEST	443	49908	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.937235117 CEST	49908	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:21.938534975 CEST	49908	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:21.938551903 CEST	443	49908	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.966939926 CEST	443	49904	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.967118979 CEST	443	49904	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.967195034 CEST	49904	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:21.967370987 CEST	49904	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:21.967370987 CEST	49904	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:21.967386961 CEST	443	49904	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.967395067 CEST	443	49904	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.969306946 CEST	49909	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:21.969340086 CEST	443	49909	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:21.969434023 CEST	49909	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:21.969536066 CEST	49909	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:21.969548941 CEST	443	49909	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:22.067444086 CEST	443	49906	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:22.068320990 CEST	49906	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:22.068382978 CEST	443	49906	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:22.068748951 CEST	49906	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:22.068803072 CEST	443	49906	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:22.082124949 CEST	443	49907	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:22.082518101 CEST	49907	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:22.082530022 CEST	443	49907	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:22.082978010 CEST	49907	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:22.082982063 CEST	443	49907	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:22.172892094 CEST	443	49906	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:22.173393011 CEST	443	49906	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:22.173492908 CEST	443	49906	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:22.173671007 CEST	49906	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:22.173799038 CEST	49906	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:22.173799038 CEST	49906	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:22.173799038 CEST	49906	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:22.176817894 CEST	49910	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:22.176847935 CEST	443	49910	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:22.176945925 CEST	49910	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:22.177063942 CEST	49910	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:22.177077055 CEST	443	49910	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:22.184554100 CEST	443	49907	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:22.184647083 CEST	443	49907	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:22.184734106 CEST	49907	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:22.184741974 CEST	443	49907	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:22.184767962 CEST	443	49907	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:22.184848070 CEST	49907	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:22.184864044 CEST	443	49907	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:22.184875965 CEST	49907	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:22.184875965 CEST	49907	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:22.184883118 CEST	443	49907	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:22.184889078 CEST	443	49907	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:22.187222004 CEST	49911	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:22.187252998 CEST	443	49911	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:22.187412977 CEST	49911	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:22.187509060 CEST	49911	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:22.187520027 CEST	443	49911	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:22.388623953 CEST	49906	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:22.388652086 CEST	443	49906	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:22.586168051 CEST	443	49908	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:22.586818933 CEST	49908	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:22.586829901 CEST	443	49908	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:22.587374926 CEST	49908	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:22.587379932 CEST	443	49908	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:22.619751930 CEST	443	49909	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:22.620587111 CEST	49909	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:22.620609045 CEST	443	49909	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:22.621135950 CEST	49909	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:22.621141911 CEST	443	49909	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:22.695960045 CEST	443	49908	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:22.696144104 CEST	443	49908	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:22.696305037 CEST	49908	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:22.696342945 CEST	49908	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:22.696361065 CEST	443	49908	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:22.696376085 CEST	49908	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:22.696382046 CEST	443	49908	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:22.699847937 CEST	49912	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:22.699934006 CEST	443	49912	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:22.700038910 CEST	49912	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:22.700211048 CEST	49912	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:22.700248957 CEST	443	49912	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:22.719496012 CEST	443	49909	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:22.719686985 CEST	443	49909	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:22.719837904 CEST	49909	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:22.720001936 CEST	49909	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:22.720001936 CEST	49909	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:22.720010996 CEST	443	49909	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:22.720019102 CEST	443	49909	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:22.723191977 CEST	49913	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:22.723248959 CEST	443	49913	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:22.723331928 CEST	49913	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:22.723510981 CEST	49913	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:22.723529100 CEST	443	49913	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:22.867759943 CEST	443	49911	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:22.869040012 CEST	49911	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:22.869060993 CEST	443	49911	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:22.869664907 CEST	49911	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:22.869669914 CEST	443	49911	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:22.871958017 CEST	443	49910	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:22.872337103 CEST	49910	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:22.872345924 CEST	443	49910	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:22.872848034 CEST	49910	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:22.872853041 CEST	443	49910	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:22.971056938 CEST	443	49911	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:22.971132994 CEST	443	49911	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:22.971226931 CEST	443	49911	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:22.971236944 CEST	49911	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:22.971287966 CEST	49911	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:22.971628904 CEST	49911	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:22.971652985 CEST	443	49911	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:22.971666098 CEST	49911	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:22.971673012 CEST	443	49911	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:22.975419998 CEST	49914	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:22.975466013 CEST	443	49914	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:22.975543976 CEST	49914	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:22.975749969 CEST	49914	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:22.975784063 CEST	443	49914	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:22.978146076 CEST	443	49910	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:22.978513002 CEST	443	49910	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:22.978588104 CEST	49910	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:22.978754044 CEST	49910	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:22.978759050 CEST	443	49910	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:22.978773117 CEST	49910	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:22.978776932 CEST	443	49910	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:22.981246948 CEST	49915	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:22.981318951 CEST	443	49915	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:22.981425047 CEST	49915	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:22.981506109 CEST	49915	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:22.981527090 CEST	443	49915	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:23.392437935 CEST	443	49912	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:23.393608093 CEST	49912	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:23.393630981 CEST	443	49912	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:23.394651890 CEST	49912	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:23.394661903 CEST	443	49912	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:23.399061918 CEST	443	49913	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:23.399547100 CEST	49913	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:23.399605036 CEST	443	49913	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:23.400149107 CEST	49913	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:23.400162935 CEST	443	49913	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:23.499350071 CEST	443	49912	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:23.499639034 CEST	443	49912	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:23.499815941 CEST	49912	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:23.499815941 CEST	49912	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:23.502994061 CEST	49916	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:23.502996922 CEST	49912	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:23.503029108 CEST	443	49916	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:23.503038883 CEST	443	49912	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:23.503134966 CEST	49916	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:23.503304005 CEST	49916	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:23.503319979 CEST	443	49916	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:23.508514881 CEST	443	49913	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:23.508579969 CEST	443	49913	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:23.508644104 CEST	49913	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:23.508683920 CEST	443	49913	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:23.508718014 CEST	443	49913	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:23.508779049 CEST	49913	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:23.508846998 CEST	49913	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:23.508881092 CEST	443	49913	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:23.508908987 CEST	49913	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:23.508924007 CEST	443	49913	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:23.510982990 CEST	49917	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:23.511050940 CEST	443	49917	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:23.511149883 CEST	49917	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:23.511269093 CEST	49917	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:23.511287928 CEST	443	49917	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:23.627578020 CEST	443	49914	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:23.628601074 CEST	49914	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:23.628659964 CEST	443	49914	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:23.629242897 CEST	49914	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:23.629256010 CEST	443	49914	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:23.633702040 CEST	443	49915	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:23.634150028 CEST	49915	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:23.634228945 CEST	443	49915	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:23.634834051 CEST	49915	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:23.634851933 CEST	443	49915	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:23.728950024 CEST	443	49914	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:23.729108095 CEST	443	49914	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:23.729298115 CEST	49914	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:23.729444981 CEST	49914	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:23.729487896 CEST	443	49914	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:23.729516029 CEST	49914	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:23.729532003 CEST	443	49914	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:23.733572960 CEST	49918	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:23.733656883 CEST	443	49918	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:23.733772039 CEST	49918	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:23.733971119 CEST	49918	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:23.734002113 CEST	443	49918	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:23.734333038 CEST	443	49915	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:23.734384060 CEST	443	49915	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:23.734437943 CEST	443	49915	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:23.734460115 CEST	49915	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:23.734545946 CEST	49915	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:23.734689951 CEST	49915	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:23.734733105 CEST	443	49915	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:23.734762907 CEST	49915	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:23.734777927 CEST	443	49915	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:23.737777948 CEST	49919	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:23.737816095 CEST	443	49919	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:23.737894058 CEST	49919	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:23.738112926 CEST	49919	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:23.738131046 CEST	443	49919	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:23.854161024 CEST	443	49905	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:23.855133057 CEST	49905	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:23.855150938 CEST	443	49905	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:23.855741024 CEST	49905	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:23.855751991 CEST	443	49905	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:23.959000111 CEST	443	49905	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:23.959049940 CEST	443	49905	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:23.959314108 CEST	49905	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:23.959377050 CEST	443	49905	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:23.959460020 CEST	443	49905	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:23.959642887 CEST	49905	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:23.959642887 CEST	49905	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:23.959642887 CEST	49905	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:23.963627100 CEST	49920	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:23.963666916 CEST	443	49920	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:23.963908911 CEST	49920	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:23.963980913 CEST	49920	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:23.963988066 CEST	443	49920	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:24.181094885 CEST	443	49916	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:24.181932926 CEST	49916	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:24.181956053 CEST	443	49916	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:24.182531118 CEST	49916	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:24.182535887 CEST	443	49916	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:24.185494900 CEST	49905	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:24.185533047 CEST	443	49905	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:24.188992977 CEST	443	49917	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:24.189376116 CEST	49917	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:24.189393044 CEST	443	49917	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:24.189873934 CEST	49917	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:24.189881086 CEST	443	49917	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:24.285226107 CEST	443	49916	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:24.285408974 CEST	443	49916	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:24.285527945 CEST	49916	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:24.285636902 CEST	49916	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:24.285649061 CEST	443	49916	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:24.285664082 CEST	49916	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:24.285672903 CEST	443	49916	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:24.289488077 CEST	49921	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:24.289573908 CEST	443	49921	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:24.289685011 CEST	49921	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:24.289920092 CEST	49921	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:24.289956093 CEST	443	49921	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:24.293895960 CEST	443	49917	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:24.293958902 CEST	443	49917	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:24.294013023 CEST	49917	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:24.294157028 CEST	49917	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:24.294174910 CEST	443	49917	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:24.294187069 CEST	49917	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:24.294193983 CEST	443	49917	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:24.296864986 CEST	49922	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:24.296900988 CEST	443	49922	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:24.296997070 CEST	49922	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:24.297167063 CEST	49922	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:24.297192097 CEST	443	49922	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:24.330462933 CEST	443	49918	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:24.330940962 CEST	49918	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:24.330995083 CEST	443	49918	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:24.331549883 CEST	49918	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:24.331562996 CEST	443	49918	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:24.394006014 CEST	443	49919	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:24.394680977 CEST	49919	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:24.394691944 CEST	443	49919	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:24.395298958 CEST	49919	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:24.395304918 CEST	443	49919	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:24.434215069 CEST	443	49918	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:24.434286118 CEST	443	49918	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:24.434372902 CEST	49918	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:24.434771061 CEST	49918	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:24.434808969 CEST	443	49918	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:24.434835911 CEST	49918	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:24.434849977 CEST	443	49918	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:24.438930035 CEST	49923	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:24.439006090 CEST	443	49923	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:24.439100027 CEST	49923	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:24.439305067 CEST	49923	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:24.439340115 CEST	443	49923	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:24.496001959 CEST	443	49919	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:24.496150017 CEST	443	49919	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:24.496428013 CEST	49919	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:24.496793985 CEST	49919	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:24.496793985 CEST	49919	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:24.496814966 CEST	443	49919	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:24.496826887 CEST	443	49919	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:24.499778032 CEST	49924	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:24.499805927 CEST	443	49924	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:24.499882936 CEST	49924	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:24.500052929 CEST	49924	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:24.500068903 CEST	443	49924	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:24.616070032 CEST	443	49920	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:24.616575003 CEST	49920	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:24.616611958 CEST	443	49920	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:24.617176056 CEST	49920	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:24.617191076 CEST	443	49920	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:24.717253923 CEST	443	49920	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:24.717401981 CEST	443	49920	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:24.717504978 CEST	49920	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:24.717650890 CEST	49920	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:24.717689037 CEST	443	49920	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:24.717715979 CEST	49920	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:24.717730999 CEST	443	49920	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:24.721232891 CEST	49925	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:24.721262932 CEST	443	49925	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:24.721347094 CEST	49925	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:24.721519947 CEST	49925	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:24.721534967 CEST	443	49925	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:24.861344099 CEST	443	49922	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:24.862102985 CEST	49922	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:24.862163067 CEST	443	49922	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:24.862730026 CEST	49922	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:24.862745047 CEST	443	49922	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:24.960937023 CEST	443	49922	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:24.961122036 CEST	443	49922	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:24.961329937 CEST	49922	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:24.961668968 CEST	49922	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:24.961669922 CEST	49922	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:24.961734056 CEST	443	49922	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:24.961771011 CEST	443	49922	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:24.965276957 CEST	49926	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:24.965306044 CEST	443	49926	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:24.965491056 CEST	49926	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:24.965606928 CEST	49926	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:24.965617895 CEST	443	49926	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:24.982211113 CEST	443	49921	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:24.982794046 CEST	49921	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:24.982877016 CEST	443	49921	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:24.983604908 CEST	49921	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:24.983659029 CEST	443	49921	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:25.088406086 CEST	443	49921	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:25.088479996 CEST	443	49921	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:25.088601112 CEST	443	49921	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:25.088762045 CEST	49921	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:25.088830948 CEST	49921	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:25.089118958 CEST	49921	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:25.089119911 CEST	49921	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:25.089184999 CEST	443	49921	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:25.089221001 CEST	443	49921	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:25.092756987 CEST	49927	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:25.092803001 CEST	443	49927	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:25.092875004 CEST	443	49923	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:25.092971087 CEST	49927	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:25.093090057 CEST	49927	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:25.093103886 CEST	443	49927	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:25.093476057 CEST	49923	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:25.093535900 CEST	443	49923	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:25.094064951 CEST	49923	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:25.094079018 CEST	443	49923	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:25.181447029 CEST	443	49924	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:25.182122946 CEST	49924	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:25.182178020 CEST	443	49924	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:25.182543039 CEST	49924	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:25.182555914 CEST	443	49924	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:25.193321943 CEST	443	49923	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:25.193384886 CEST	443	49923	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:25.193486929 CEST	443	49923	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:25.193562031 CEST	49923	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:25.193734884 CEST	49923	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:25.193734884 CEST	49923	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:25.193953037 CEST	49923	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:25.193984985 CEST	443	49923	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:25.196983099 CEST	49928	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:25.197067976 CEST	443	49928	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:25.197243929 CEST	49928	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:25.197319031 CEST	49928	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:25.197345972 CEST	443	49928	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:25.290575981 CEST	443	49924	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:25.291484118 CEST	443	49924	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:25.291544914 CEST	49924	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:25.291589022 CEST	49924	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:25.291604996 CEST	443	49924	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:25.291616917 CEST	49924	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:25.291624069 CEST	443	49924	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:25.293862104 CEST	49929	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:25.293895960 CEST	443	49929	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:25.294001102 CEST	49929	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:25.294111967 CEST	49929	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:25.294125080 CEST	443	49929	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:25.402952909 CEST	443	49925	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:25.403718948 CEST	49925	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:25.403731108 CEST	443	49925	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:25.404859066 CEST	49925	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:25.404864073 CEST	443	49925	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:25.507817984 CEST	443	49925	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:25.507920980 CEST	443	49925	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:25.507982016 CEST	49925	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:25.507998943 CEST	443	49925	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:25.508044958 CEST	443	49925	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:25.508100986 CEST	49925	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:25.508352041 CEST	49925	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:25.508359909 CEST	443	49925	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:25.508369923 CEST	49925	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:25.508373976 CEST	443	49925	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:25.511699915 CEST	49930	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:25.511729956 CEST	443	49930	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:25.511835098 CEST	49930	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:25.512065887 CEST	49930	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:25.512078047 CEST	443	49930	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:25.690203905 CEST	443	49926	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:25.690891027 CEST	49926	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:25.690916061 CEST	443	49926	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:25.691199064 CEST	49926	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:25.691203117 CEST	443	49926	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:25.781825066 CEST	443	49927	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:25.782293081 CEST	49927	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:25.782355070 CEST	443	49927	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:25.782697916 CEST	49927	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:25.782711029 CEST	443	49927	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:25.797902107 CEST	443	49926	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:25.797961950 CEST	443	49926	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:25.798022985 CEST	49926	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:25.798209906 CEST	49926	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:25.798233032 CEST	443	49926	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:25.798247099 CEST	49926	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:25.798254013 CEST	443	49926	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:25.801026106 CEST	49931	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:25.801110983 CEST	443	49931	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:25.801211119 CEST	49931	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:25.801356077 CEST	49931	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:25.801399946 CEST	443	49931	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:25.883850098 CEST	443	49927	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:25.883908987 CEST	443	49927	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:25.884011030 CEST	443	49927	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:25.884021044 CEST	49927	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:25.884094954 CEST	49927	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:25.884290934 CEST	49927	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:25.884291887 CEST	49927	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:25.884325027 CEST	443	49927	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:25.884351015 CEST	443	49927	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:25.886845112 CEST	49932	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:25.886873007 CEST	443	49932	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:25.886940956 CEST	49932	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:25.887074947 CEST	49932	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:25.887089968 CEST	443	49932	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:25.900042057 CEST	443	49928	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:25.900410891 CEST	49928	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:25.900451899 CEST	443	49928	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:25.900986910 CEST	49928	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:25.901000977 CEST	443	49928	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:25.994700909 CEST	443	49929	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:25.995523930 CEST	49929	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:25.995536089 CEST	443	49929	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:25.996079922 CEST	49929	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:25.996085882 CEST	443	49929	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.004126072 CEST	443	49928	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.004271984 CEST	443	49928	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.004337072 CEST	49928	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:26.004363060 CEST	49928	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:26.004375935 CEST	443	49928	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.004388094 CEST	49928	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:26.004391909 CEST	443	49928	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.006628036 CEST	49933	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:26.006652117 CEST	443	49933	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.006733894 CEST	49933	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:26.006889105 CEST	49933	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:26.006900072 CEST	443	49933	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.102250099 CEST	443	49929	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.102297068 CEST	443	49929	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.102380037 CEST	49929	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:26.102390051 CEST	443	49929	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.102442026 CEST	443	49929	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.102494001 CEST	49929	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:26.102607012 CEST	49929	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:26.102633953 CEST	443	49929	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.102646112 CEST	49929	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:26.102652073 CEST	443	49929	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.105423927 CEST	49934	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:26.105439901 CEST	443	49934	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.105516911 CEST	49934	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:26.105694056 CEST	49934	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:26.105705023 CEST	443	49934	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.180922985 CEST	443	49930	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.181405067 CEST	49930	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:26.181421995 CEST	443	49930	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.181819916 CEST	49930	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:26.181824923 CEST	443	49930	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.281673908 CEST	443	49930	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.281730890 CEST	443	49930	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.281788111 CEST	49930	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:26.281800985 CEST	443	49930	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.281939983 CEST	49930	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:26.281953096 CEST	443	49930	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.281991005 CEST	49930	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:26.282331944 CEST	443	49930	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.282413960 CEST	443	49930	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.282464027 CEST	49930	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:26.284214020 CEST	49935	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:26.284246922 CEST	443	49935	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.284311056 CEST	49935	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:26.284467936 CEST	49935	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:26.284482002 CEST	443	49935	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.454199076 CEST	443	49931	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.454834938 CEST	49931	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:26.454859972 CEST	443	49931	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.455436945 CEST	49931	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:26.455446005 CEST	443	49931	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.553538084 CEST	443	49932	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.553980112 CEST	443	49931	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.554033041 CEST	49932	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:26.554044962 CEST	443	49931	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.554061890 CEST	443	49932	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.554127932 CEST	49931	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:26.554162025 CEST	443	49931	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.554225922 CEST	49931	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:26.554311991 CEST	49931	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:26.554346085 CEST	443	49931	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.554394960 CEST	49931	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:26.554409981 CEST	443	49931	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.554651976 CEST	49932	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:26.554660082 CEST	443	49932	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.557205915 CEST	49936	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:26.557246923 CEST	443	49936	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.557326078 CEST	49936	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:26.557449102 CEST	49936	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:26.557467937 CEST	443	49936	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.655137062 CEST	443	49932	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.655277967 CEST	443	49932	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.655340910 CEST	49932	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:26.655381918 CEST	49932	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:26.655402899 CEST	443	49932	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.655419111 CEST	49932	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:26.655424118 CEST	443	49932	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.657834053 CEST	49937	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:26.657907963 CEST	443	49937	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.658004999 CEST	49937	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:26.658137083 CEST	49937	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:26.658157110 CEST	443	49937	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.659483910 CEST	443	49933	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.659810066 CEST	49933	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:26.659832954 CEST	443	49933	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.660341978 CEST	49933	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:26.660352945 CEST	443	49933	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.759066105 CEST	443	49934	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.759434938 CEST	443	49933	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.759439945 CEST	49934	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:26.759454966 CEST	443	49934	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.759521961 CEST	443	49933	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.759578943 CEST	49933	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:26.759586096 CEST	443	49933	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.759648085 CEST	443	49933	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.759699106 CEST	49933	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:26.759882927 CEST	49934	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:26.759886026 CEST	443	49934	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.759999990 CEST	49933	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:26.760014057 CEST	443	49933	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.760025024 CEST	49933	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:26.760029078 CEST	443	49933	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.762291908 CEST	49938	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:26.762348890 CEST	443	49938	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.762434006 CEST	49938	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:26.762726068 CEST	49938	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:26.762756109 CEST	443	49938	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.863780975 CEST	443	49934	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.864056110 CEST	443	49934	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.864144087 CEST	49934	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:26.864893913 CEST	49934	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:26.864901066 CEST	443	49934	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.864940882 CEST	49934	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:26.864944935 CEST	443	49934	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.867188931 CEST	49939	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:26.867224932 CEST	443	49939	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.867281914 CEST	49939	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:26.867405891 CEST	49939	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:26.867422104 CEST	443	49939	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.941330910 CEST	443	49935	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.941742897 CEST	49935	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:26.941766024 CEST	443	49935	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:26.942120075 CEST	49935	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:26.942125082 CEST	443	49935	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:27.042284012 CEST	443	49935	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:27.042349100 CEST	443	49935	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:27.042397022 CEST	49935	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:27.042416096 CEST	443	49935	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:27.042459965 CEST	443	49935	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:27.042560101 CEST	49935	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:27.042589903 CEST	49935	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:27.042603970 CEST	443	49935	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:27.042651892 CEST	49935	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:27.042658091 CEST	443	49935	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:27.047895908 CEST	49940	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:27.047940016 CEST	443	49940	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:27.048022985 CEST	49940	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:27.062439919 CEST	49940	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:27.062473059 CEST	443	49940	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:27.237483025 CEST	443	49936	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:27.253484964 CEST	49936	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:27.253499985 CEST	443	49936	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:27.253952980 CEST	49936	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:27.253959894 CEST	443	49936	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:27.309953928 CEST	443	49937	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:27.312484026 CEST	49937	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:27.312526941 CEST	443	49937	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:27.316128969 CEST	49937	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:27.316143990 CEST	443	49937	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:27.354912996 CEST	443	49936	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:27.355081081 CEST	443	49936	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:27.355129004 CEST	49936	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:27.359369040 CEST	49936	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:27.359395027 CEST	443	49936	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:27.359410048 CEST	49936	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:27.359424114 CEST	443	49936	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:27.370523930 CEST	49941	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:27.370620966 CEST	443	49941	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:27.370702982 CEST	49941	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:27.370806932 CEST	49941	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:27.370831966 CEST	443	49941	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:27.412081003 CEST	443	49938	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:27.412755966 CEST	443	49937	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:27.412827015 CEST	443	49937	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:27.412898064 CEST	49937	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:27.412925005 CEST	443	49937	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:27.412985086 CEST	49937	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:27.413245916 CEST	49938	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:27.413284063 CEST	443	49938	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:27.413686037 CEST	49938	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:27.413697958 CEST	443	49938	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:27.413872004 CEST	49937	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:27.413872957 CEST	49937	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:27.413902044 CEST	443	49937	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:27.413924932 CEST	443	49937	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:27.419126987 CEST	49942	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:27.419195890 CEST	443	49942	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:27.419286013 CEST	49942	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:27.422254086 CEST	49942	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:27.422285080 CEST	443	49942	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:27.514719009 CEST	443	49938	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:27.514880896 CEST	443	49938	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:27.514947891 CEST	49938	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:27.515019894 CEST	49938	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:27.515019894 CEST	49938	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:27.515042067 CEST	443	49938	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:27.515064001 CEST	443	49938	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:27.517621994 CEST	49943	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:27.517668962 CEST	443	49943	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:27.517754078 CEST	49943	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:27.517924070 CEST	49943	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:27.517934084 CEST	443	49943	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:27.549283981 CEST	443	49939	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:27.549714088 CEST	49939	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:27.549731016 CEST	443	49939	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:27.550139904 CEST	49939	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:27.550144911 CEST	443	49939	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:27.652945042 CEST	443	49939	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:27.652976036 CEST	443	49939	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:27.653021097 CEST	443	49939	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:27.653248072 CEST	49939	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:27.653248072 CEST	49939	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:27.653465986 CEST	49939	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:27.653465986 CEST	49939	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:27.653507948 CEST	443	49939	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:27.653534889 CEST	443	49939	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:27.655956984 CEST	49944	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:27.655991077 CEST	443	49944	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:27.656075001 CEST	49944	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:27.656209946 CEST	49944	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:27.656219959 CEST	443	49944	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:27.752289057 CEST	443	49940	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:27.752747059 CEST	49940	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:27.752782106 CEST	443	49940	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:27.753120899 CEST	49940	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:27.753134966 CEST	443	49940	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:27.858930111 CEST	443	49940	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:27.859092951 CEST	443	49940	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:27.859164000 CEST	49940	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:27.859245062 CEST	49940	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:27.859275103 CEST	443	49940	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:27.859302044 CEST	49940	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:27.859316111 CEST	443	49940	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:27.862061977 CEST	49945	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:27.862114906 CEST	443	49945	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:27.862221003 CEST	49945	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:27.862381935 CEST	49945	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:27.862401009 CEST	443	49945	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.032229900 CEST	443	49941	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.032932997 CEST	49941	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.032975912 CEST	443	49941	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.033351898 CEST	49941	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.033379078 CEST	443	49941	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.081734896 CEST	443	49942	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.082238913 CEST	49942	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.082299948 CEST	443	49942	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.082413912 CEST	49942	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.082428932 CEST	443	49942	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.132364035 CEST	443	49941	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.132509947 CEST	443	49941	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.132791996 CEST	49941	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.132950068 CEST	49941	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.132950068 CEST	49941	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.132994890 CEST	443	49941	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.133023024 CEST	443	49941	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.134988070 CEST	49946	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.135031939 CEST	443	49946	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.135112047 CEST	49946	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.135235071 CEST	49946	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.135241985 CEST	443	49946	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.182722092 CEST	443	49942	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.182786942 CEST	443	49942	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.182892084 CEST	443	49942	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.182931900 CEST	49942	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.182987928 CEST	49942	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.183157921 CEST	49942	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.183157921 CEST	49942	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.183190107 CEST	443	49942	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.183214903 CEST	443	49942	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.183471918 CEST	443	49943	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.183867931 CEST	49943	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.183885098 CEST	443	49943	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.184258938 CEST	49943	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.184266090 CEST	443	49943	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.185368061 CEST	49947	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.185395956 CEST	443	49947	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.185477972 CEST	49947	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.185651064 CEST	49947	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.185661077 CEST	443	49947	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.284923077 CEST	443	49943	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.285092115 CEST	443	49943	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.285263062 CEST	49943	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.285263062 CEST	49943	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.285263062 CEST	49943	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.286992073 CEST	49948	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.287028074 CEST	443	49948	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.287189960 CEST	49948	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.287189960 CEST	49948	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.287225962 CEST	443	49948	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.304672956 CEST	443	49944	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.305121899 CEST	49944	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.305133104 CEST	443	49944	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.305387974 CEST	49944	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.305392981 CEST	443	49944	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.405431032 CEST	443	49944	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.405642033 CEST	443	49944	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.405745029 CEST	49944	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.405798912 CEST	49944	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.405798912 CEST	49944	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.405811071 CEST	443	49944	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.405818939 CEST	443	49944	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.408148050 CEST	49949	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.408205032 CEST	443	49949	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.408283949 CEST	49949	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.408379078 CEST	49949	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.408406973 CEST	443	49949	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.538794041 CEST	443	49945	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.539328098 CEST	49945	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.539340973 CEST	443	49945	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.539794922 CEST	49945	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.539800882 CEST	443	49945	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.591759920 CEST	49943	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.591774940 CEST	443	49943	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.643826008 CEST	443	49945	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.643898964 CEST	443	49945	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.643945932 CEST	443	49945	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.643951893 CEST	49945	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.643996000 CEST	49945	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.644140005 CEST	49945	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.644153118 CEST	443	49945	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.644165993 CEST	49945	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.644171953 CEST	443	49945	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.646811008 CEST	49950	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.646869898 CEST	443	49950	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.646967888 CEST	49950	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.647115946 CEST	49950	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.647147894 CEST	443	49950	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.787087917 CEST	443	49946	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.787507057 CEST	49946	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.787547112 CEST	443	49946	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.787843943 CEST	49946	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.787852049 CEST	443	49946	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.842822075 CEST	443	49947	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.847687006 CEST	49947	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.847704887 CEST	443	49947	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.848381996 CEST	49947	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.848387957 CEST	443	49947	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.886677980 CEST	443	49946	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.886821985 CEST	443	49946	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.886893988 CEST	49946	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.886939049 CEST	49946	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.886955976 CEST	443	49946	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.886995077 CEST	49946	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.887001991 CEST	443	49946	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.889323950 CEST	49951	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.889357090 CEST	443	49951	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.889451027 CEST	49951	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.889590979 CEST	49951	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.889600039 CEST	443	49951	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.945527077 CEST	443	49947	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.945589066 CEST	443	49947	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.945692062 CEST	443	49947	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.945769072 CEST	49947	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.945769072 CEST	49947	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.945807934 CEST	49947	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.945823908 CEST	443	49947	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.945861101 CEST	49947	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.945866108 CEST	443	49947	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.947488070 CEST	49952	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.947504044 CEST	443	49952	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.947607040 CEST	49952	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.947731018 CEST	49952	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.947741032 CEST	443	49952	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.973376989 CEST	443	49948	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.973763943 CEST	49948	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.973771095 CEST	443	49948	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:28.974303961 CEST	49948	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:28.974308014 CEST	443	49948	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:29.066765070 CEST	443	49949	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:29.067195892 CEST	49949	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:29.067255974 CEST	443	49949	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:29.067447901 CEST	49949	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:29.067461014 CEST	443	49949	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:29.074215889 CEST	443	49948	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:29.074455976 CEST	443	49948	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:29.074523926 CEST	49948	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:29.074577093 CEST	49948	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:29.074577093 CEST	49948	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:29.074585915 CEST	443	49948	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:29.074594021 CEST	443	49948	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:29.076443911 CEST	49953	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:29.076498985 CEST	443	49953	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:29.076560974 CEST	49953	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:29.076673031 CEST	49953	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:29.076687098 CEST	443	49953	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:29.167762041 CEST	443	49949	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:29.167985916 CEST	443	49949	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:29.168164968 CEST	49949	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:29.168164968 CEST	49949	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:29.168164968 CEST	49949	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:29.169806957 CEST	49954	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:29.169837952 CEST	443	49954	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:29.169913054 CEST	49954	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:29.170072079 CEST	49954	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:29.170099020 CEST	443	49954	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:29.301740885 CEST	443	49950	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:29.302212954 CEST	49950	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:29.302290916 CEST	443	49950	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:29.302613020 CEST	49950	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:29.302628040 CEST	443	49950	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:29.404059887 CEST	443	49950	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:29.404284000 CEST	443	49950	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:29.404350996 CEST	49950	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:29.404390097 CEST	443	49950	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:29.404455900 CEST	49950	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:29.404515028 CEST	49950	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:29.404515028 CEST	49950	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:29.404556036 CEST	443	49950	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:29.404582977 CEST	443	49950	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:29.407277107 CEST	49955	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:29.407295942 CEST	443	49955	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:29.407362938 CEST	49955	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:29.407527924 CEST	49955	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:29.407536983 CEST	443	49955	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:29.482541084 CEST	49949	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:29.482618093 CEST	443	49949	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:29.554881096 CEST	443	49951	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:29.555391073 CEST	49951	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:29.555418015 CEST	443	49951	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:29.555866957 CEST	49951	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:29.555872917 CEST	443	49951	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:29.653568029 CEST	443	49952	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:29.654026985 CEST	49952	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:29.654046059 CEST	443	49952	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:29.654705048 CEST	49952	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:29.654710054 CEST	443	49952	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:29.655741930 CEST	443	49951	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:29.655946970 CEST	443	49951	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:29.656011105 CEST	49951	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:29.656043053 CEST	49951	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:29.656061888 CEST	443	49951	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:29.656074047 CEST	49951	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:29.656080008 CEST	443	49951	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:29.659262896 CEST	49956	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:29.659301043 CEST	443	49956	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:29.659374952 CEST	49956	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:29.659544945 CEST	49956	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:29.659557104 CEST	443	49956	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:29.757824898 CEST	443	49953	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:29.758570910 CEST	443	49952	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:29.758734941 CEST	443	49952	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:29.758811951 CEST	49952	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:29.772825003 CEST	49953	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:29.772902012 CEST	443	49953	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:29.773490906 CEST	49953	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:29.773505926 CEST	443	49953	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:29.773730040 CEST	49952	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:29.773746014 CEST	443	49952	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:29.773756981 CEST	49952	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:29.773761988 CEST	443	49952	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:29.808958054 CEST	49957	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:29.808993101 CEST	443	49957	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:29.809091091 CEST	49957	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:29.809294939 CEST	49957	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:29.809309006 CEST	443	49957	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:29.868726015 CEST	443	49954	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:29.871161938 CEST	443	49953	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:29.871251106 CEST	443	49953	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:29.871351957 CEST	443	49953	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:29.871428967 CEST	49953	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:29.872950077 CEST	49953	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:29.878539085 CEST	49954	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:29.878561020 CEST	443	49954	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:29.879000902 CEST	49954	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:29.879013062 CEST	443	49954	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:29.883317947 CEST	49953	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:29.883351088 CEST	443	49953	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:29.883377075 CEST	49953	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:29.883405924 CEST	443	49953	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:29.922898054 CEST	49958	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:29.922914982 CEST	443	49958	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:29.923027039 CEST	49958	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:29.923157930 CEST	49958	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:29.923175097 CEST	443	49958	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:29.979743958 CEST	443	49954	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:29.979820967 CEST	443	49954	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:29.980021954 CEST	49954	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:29.982151985 CEST	49954	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:29.982172966 CEST	443	49954	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:29.982201099 CEST	49954	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:29.982229948 CEST	443	49954	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:30.015429020 CEST	49959	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:30.015469074 CEST	443	49959	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:30.015541077 CEST	49959	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:30.019514084 CEST	49959	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:30.019526958 CEST	443	49959	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:30.069602013 CEST	443	49955	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:30.092730999 CEST	49955	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:30.092745066 CEST	443	49955	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:30.093362093 CEST	49955	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:30.093368053 CEST	443	49955	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:30.190184116 CEST	443	49955	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:30.190283060 CEST	443	49955	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:30.190345049 CEST	49955	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:30.190355062 CEST	443	49955	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:30.190392017 CEST	443	49955	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:30.190445900 CEST	49955	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:30.196469069 CEST	49955	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:30.196482897 CEST	443	49955	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:30.196495056 CEST	49955	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:30.196500063 CEST	443	49955	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:30.214730978 CEST	49960	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:30.214754105 CEST	443	49960	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:30.214881897 CEST	49960	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:30.215369940 CEST	49960	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:30.215392113 CEST	443	49960	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:30.339966059 CEST	443	49956	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:30.340537071 CEST	49956	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:30.340558052 CEST	443	49956	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:30.341278076 CEST	49956	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:30.341281891 CEST	443	49956	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:30.449284077 CEST	443	49956	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:30.449434996 CEST	443	49956	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:30.449501991 CEST	49956	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:30.449872971 CEST	49956	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:30.449872971 CEST	49956	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:30.449891090 CEST	443	49956	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:30.449898958 CEST	443	49956	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:30.453166008 CEST	49961	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:30.453260899 CEST	443	49961	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:30.453473091 CEST	49961	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:30.453727961 CEST	49961	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:30.453759909 CEST	443	49961	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:30.457596064 CEST	443	49957	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:30.458023071 CEST	49957	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:30.458051920 CEST	443	49957	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:30.458496094 CEST	49957	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:30.458501101 CEST	443	49957	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:30.558507919 CEST	443	49957	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:30.558701992 CEST	443	49957	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:30.558804989 CEST	49957	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:30.559077024 CEST	49957	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:30.559077024 CEST	49957	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:30.559102058 CEST	443	49957	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:30.559114933 CEST	443	49957	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:30.582204103 CEST	443	49958	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:30.591056108 CEST	49962	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:30.591170073 CEST	443	49962	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:30.591273069 CEST	49962	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:30.591588020 CEST	49958	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:30.591614008 CEST	443	49958	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:30.591643095 CEST	49962	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:30.591679096 CEST	443	49962	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:30.592068911 CEST	49958	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:30.592075109 CEST	443	49958	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:30.689970016 CEST	443	49958	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:30.690185070 CEST	443	49958	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:30.690346956 CEST	49958	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:30.690412998 CEST	49958	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:30.690426111 CEST	443	49958	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:30.690438032 CEST	49958	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:30.690442085 CEST	443	49958	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:30.694016933 CEST	49963	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:30.694077015 CEST	443	49963	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:30.694184065 CEST	49963	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:30.694385052 CEST	49963	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:30.694401026 CEST	443	49963	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:30.744029999 CEST	443	49959	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:30.744746923 CEST	49959	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:30.744765043 CEST	443	49959	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:30.745129108 CEST	49959	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:30.745134115 CEST	443	49959	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:30.852214098 CEST	443	49959	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:30.852433920 CEST	443	49959	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:30.852488995 CEST	49959	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:30.852503061 CEST	443	49959	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:30.852539062 CEST	443	49959	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:30.852596045 CEST	49959	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:30.852665901 CEST	49959	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:30.852679014 CEST	443	49959	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:30.852689981 CEST	49959	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:30.852694988 CEST	443	49959	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:30.856204033 CEST	49964	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:30.856225967 CEST	443	49964	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:30.856328011 CEST	49964	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:30.856451988 CEST	49964	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:30.856470108 CEST	443	49964	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:30.898348093 CEST	443	49960	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:30.898931026 CEST	49960	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:30.898952007 CEST	443	49960	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:30.899420977 CEST	49960	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:30.899432898 CEST	443	49960	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.005419970 CEST	443	49960	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.005580902 CEST	443	49960	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.005664110 CEST	49960	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:31.005875111 CEST	49960	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:31.005902052 CEST	443	49960	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.005928040 CEST	49960	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:31.005943060 CEST	443	49960	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.009372950 CEST	49965	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:31.009466887 CEST	443	49965	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.009598017 CEST	49965	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:31.009767056 CEST	49965	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:31.009784937 CEST	443	49965	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.108724117 CEST	443	49961	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.109679937 CEST	49961	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:31.109747887 CEST	443	49961	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.110069990 CEST	49961	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:31.110085964 CEST	443	49961	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.210818052 CEST	443	49961	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.210876942 CEST	443	49961	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.210984945 CEST	443	49961	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.211282969 CEST	49961	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:31.211282969 CEST	49961	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:31.211282969 CEST	49961	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:31.214670897 CEST	49966	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:31.214728117 CEST	443	49966	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.214890003 CEST	49966	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:31.215095997 CEST	49966	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:31.215116024 CEST	443	49966	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.245121956 CEST	443	49962	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.245887041 CEST	49962	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:31.245949030 CEST	443	49962	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.246144056 CEST	49962	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:31.246159077 CEST	443	49962	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.347129107 CEST	443	49963	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.348082066 CEST	49963	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:31.348145008 CEST	443	49963	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.348407984 CEST	49963	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:31.348424911 CEST	443	49963	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.349751949 CEST	443	49962	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.349889994 CEST	443	49962	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.350054026 CEST	49962	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:31.350128889 CEST	49962	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:31.350128889 CEST	49962	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:31.350164890 CEST	443	49962	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.350188017 CEST	443	49962	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.353712082 CEST	49967	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:31.353740931 CEST	443	49967	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.353820086 CEST	49967	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:31.353986979 CEST	49967	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:31.354003906 CEST	443	49967	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.446981907 CEST	443	49963	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.447047949 CEST	443	49963	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.447112083 CEST	49963	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:31.447129965 CEST	443	49963	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.447160006 CEST	443	49963	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.447238922 CEST	49963	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:31.447441101 CEST	49963	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:31.447454929 CEST	443	49963	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.447469950 CEST	49963	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:31.447475910 CEST	443	49963	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.452467918 CEST	49968	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:31.452497959 CEST	443	49968	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.452572107 CEST	49968	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:31.452975988 CEST	49968	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:31.452991009 CEST	443	49968	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.513787985 CEST	49961	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:31.513850927 CEST	443	49961	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.523619890 CEST	443	49964	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.525321007 CEST	49964	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:31.525331974 CEST	443	49964	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.525732994 CEST	49964	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:31.525737047 CEST	443	49964	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.626781940 CEST	443	49964	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.626933098 CEST	443	49964	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.627054930 CEST	49964	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:31.627316952 CEST	49964	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:31.627331972 CEST	443	49964	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.627342939 CEST	49964	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:31.627346992 CEST	443	49964	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.630655050 CEST	49969	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:31.630673885 CEST	443	49969	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.630990028 CEST	49969	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:31.631128073 CEST	49969	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:31.631138086 CEST	443	49969	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.687756062 CEST	443	49965	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.689683914 CEST	49965	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:31.689735889 CEST	443	49965	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.690093040 CEST	49965	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:31.690104008 CEST	443	49965	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.792973042 CEST	443	49965	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.793128967 CEST	443	49965	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.793329000 CEST	49965	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:31.793498993 CEST	49965	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:31.793538094 CEST	443	49965	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.793566942 CEST	49965	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:31.793582916 CEST	443	49965	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.796730995 CEST	49970	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:31.796751976 CEST	443	49970	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.796845913 CEST	49970	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:31.796982050 CEST	49970	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:31.796992064 CEST	443	49970	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.870014906 CEST	443	49966	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.873424053 CEST	49966	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:31.873446941 CEST	443	49966	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.873867989 CEST	49966	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:31.873874903 CEST	443	49966	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.971457958 CEST	443	49966	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.971613884 CEST	443	49966	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.971735954 CEST	49966	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:31.972059011 CEST	49966	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:31.972094059 CEST	443	49966	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.972121000 CEST	49966	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:31.972135067 CEST	443	49966	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.975234032 CEST	49971	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:31.975263119 CEST	443	49971	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:31.975725889 CEST	49971	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:31.975847960 CEST	49971	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:31.975862026 CEST	443	49971	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:32.001863956 CEST	443	49967	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:32.004615068 CEST	49967	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:32.004628897 CEST	443	49967	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:32.005112886 CEST	49967	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:32.005116940 CEST	443	49967	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:32.103373051 CEST	443	49967	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:32.103405952 CEST	443	49967	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:32.103441954 CEST	443	49967	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:32.103553057 CEST	49967	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:32.103729010 CEST	49967	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:32.103740931 CEST	443	49967	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:32.103749990 CEST	49967	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:32.103754044 CEST	443	49967	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:32.106506109 CEST	49972	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:32.106590986 CEST	443	49972	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:32.106697083 CEST	49972	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:32.106816053 CEST	49972	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:32.106848001 CEST	443	49972	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:32.145602942 CEST	443	49968	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:32.146079063 CEST	49968	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:32.146086931 CEST	443	49968	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:32.146480083 CEST	49968	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:32.146483898 CEST	443	49968	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:32.247684956 CEST	443	49968	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:32.247828960 CEST	443	49968	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:32.248047113 CEST	49968	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:32.271204948 CEST	49968	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:32.271204948 CEST	49968	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:32.271225929 CEST	443	49968	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:32.271234989 CEST	443	49968	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:32.273869991 CEST	49973	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:32.273884058 CEST	443	49973	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:32.273979902 CEST	49973	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:32.274087906 CEST	49973	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:32.274096966 CEST	443	49973	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:32.291851044 CEST	443	49969	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:32.292485952 CEST	49969	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:32.292514086 CEST	443	49969	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:32.292929888 CEST	49969	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:32.292936087 CEST	443	49969	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:32.392749071 CEST	443	49969	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:32.392904997 CEST	443	49969	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:32.392967939 CEST	49969	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:32.393099070 CEST	49969	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:32.393104076 CEST	443	49969	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:32.393115044 CEST	49969	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:32.393119097 CEST	443	49969	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:32.396383047 CEST	49974	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:32.396403074 CEST	443	49974	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:32.396471024 CEST	49974	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:32.396589041 CEST	49974	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:32.396599054 CEST	443	49974	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:32.500443935 CEST	443	49970	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:32.501099110 CEST	49970	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:32.501126051 CEST	443	49970	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:32.501456022 CEST	49970	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:32.501461029 CEST	443	49970	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:32.606183052 CEST	443	49970	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:32.606328964 CEST	443	49970	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:32.606400967 CEST	49970	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:32.606493950 CEST	49970	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:32.606507063 CEST	443	49970	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:32.606518984 CEST	49970	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:32.606523037 CEST	443	49970	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:32.613027096 CEST	49975	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:32.613085032 CEST	443	49975	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:32.613173008 CEST	49975	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:32.613384962 CEST	49975	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:32.613406897 CEST	443	49975	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:32.657358885 CEST	443	49971	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:32.657799959 CEST	49971	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:32.657814980 CEST	443	49971	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:32.658272982 CEST	49971	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:32.658277988 CEST	443	49971	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:32.751138926 CEST	443	49972	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:32.751813889 CEST	49972	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:32.751874924 CEST	443	49972	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:32.752298117 CEST	49972	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:32.752310991 CEST	443	49972	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:32.761887074 CEST	443	49971	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:32.761962891 CEST	443	49971	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:32.762023926 CEST	49971	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:32.762331009 CEST	49971	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:32.762331009 CEST	49971	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:32.762341022 CEST	443	49971	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:32.762350082 CEST	443	49971	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:32.765749931 CEST	49976	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:32.765791893 CEST	443	49976	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:32.765880108 CEST	49976	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:32.766138077 CEST	49976	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:32.766148090 CEST	443	49976	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:32.851690054 CEST	443	49972	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:32.851780891 CEST	443	49972	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:32.851897955 CEST	49972	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:32.852006912 CEST	49972	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:32.852040052 CEST	443	49972	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:32.852083921 CEST	49972	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:32.852098942 CEST	443	49972	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:32.854851007 CEST	49977	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:32.854876995 CEST	443	49977	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:32.854993105 CEST	49977	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:32.855154991 CEST	49977	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:32.855170965 CEST	443	49977	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:32.938371897 CEST	443	49973	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:32.938832998 CEST	49973	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:32.938851118 CEST	443	49973	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:32.939192057 CEST	49973	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:32.939203024 CEST	443	49973	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:33.040085077 CEST	443	49973	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:33.040143967 CEST	443	49973	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:33.040307045 CEST	49973	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:33.040570974 CEST	49973	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:33.040591002 CEST	443	49973	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:33.040612936 CEST	49973	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:33.040627003 CEST	443	49973	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:33.044241905 CEST	49978	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:33.044265032 CEST	443	49978	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:33.044363976 CEST	49978	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:33.044554949 CEST	49978	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:33.044572115 CEST	443	49978	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:33.079535961 CEST	443	49974	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:33.080058098 CEST	49974	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:33.080068111 CEST	443	49974	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:33.080514908 CEST	49974	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:33.080521107 CEST	443	49974	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:33.184607983 CEST	443	49974	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:33.184753895 CEST	443	49974	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:33.184828997 CEST	49974	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:33.184952021 CEST	49974	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:33.184977055 CEST	443	49974	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:33.185002089 CEST	49974	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:33.185045004 CEST	443	49974	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:33.188813925 CEST	49979	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:33.188905001 CEST	443	49979	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:33.188999891 CEST	49979	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:33.189102888 CEST	49979	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:33.189131021 CEST	443	49979	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:33.299910069 CEST	443	49975	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:33.300645113 CEST	49975	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:33.300705910 CEST	443	49975	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:33.301177979 CEST	49975	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:33.301233053 CEST	443	49975	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:33.404853106 CEST	443	49975	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:33.404926062 CEST	443	49975	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:33.405038118 CEST	443	49975	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:33.405113935 CEST	49975	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:33.405114889 CEST	49975	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:33.405373096 CEST	49975	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:33.405417919 CEST	443	49975	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:33.405450106 CEST	49975	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:33.405464888 CEST	443	49975	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:33.409050941 CEST	49980	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:33.409157991 CEST	443	49980	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:33.409264088 CEST	49980	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:33.409498930 CEST	49980	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:33.409533024 CEST	443	49980	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:33.422228098 CEST	443	49976	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:33.422641993 CEST	49976	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:33.422660112 CEST	443	49976	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:33.423407078 CEST	49976	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:33.423413992 CEST	443	49976	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:33.525933027 CEST	443	49976	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:33.526716948 CEST	443	49976	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:33.526982069 CEST	49976	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:33.526982069 CEST	49976	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:33.526982069 CEST	49976	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:33.529530048 CEST	49981	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:33.529618025 CEST	443	49981	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:33.529794931 CEST	49981	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:33.529864073 CEST	49981	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:33.529885054 CEST	443	49981	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:33.534044027 CEST	443	49977	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:33.536161900 CEST	49977	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:33.536190033 CEST	443	49977	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:33.536564112 CEST	49977	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:33.536570072 CEST	443	49977	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:33.662462950 CEST	443	49977	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:33.662489891 CEST	443	49977	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:33.662533998 CEST	443	49977	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:33.662600994 CEST	49977	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:33.662627935 CEST	49977	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:33.662805080 CEST	49977	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:33.662821054 CEST	443	49977	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:33.662831068 CEST	49977	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:33.662836075 CEST	443	49977	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:33.665081024 CEST	49982	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:33.665173054 CEST	443	49982	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:33.665261030 CEST	49982	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:33.665384054 CEST	49982	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:33.665417910 CEST	443	49982	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:33.741370916 CEST	443	49978	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:33.742285967 CEST	49978	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:33.742309093 CEST	443	49978	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:33.742455959 CEST	49978	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:33.742463112 CEST	443	49978	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:33.841775894 CEST	49976	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:33.841837883 CEST	443	49976	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:33.849647045 CEST	443	49978	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:33.849780083 CEST	443	49978	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:33.849845886 CEST	49978	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:33.850044966 CEST	49978	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:33.850059986 CEST	443	49978	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:33.850070000 CEST	49978	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:33.850075006 CEST	443	49978	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:33.852689028 CEST	49983	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:33.852771997 CEST	443	49983	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:33.852869987 CEST	49983	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:33.853050947 CEST	49983	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:33.853081942 CEST	443	49983	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:33.901304007 CEST	443	49979	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:33.901892900 CEST	49979	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:33.901925087 CEST	443	49979	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:33.902199984 CEST	49979	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:33.902211905 CEST	443	49979	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.005903006 CEST	443	49979	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.005970001 CEST	443	49979	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.006046057 CEST	49979	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:34.006064892 CEST	443	49979	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.006123066 CEST	49979	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:34.006167889 CEST	49979	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:34.006167889 CEST	49979	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:34.006196022 CEST	443	49979	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.006217957 CEST	443	49979	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.008315086 CEST	49984	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:34.008361101 CEST	443	49984	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.008454084 CEST	49984	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:34.008570910 CEST	49984	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:34.008585930 CEST	443	49984	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.076416969 CEST	443	49980	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.077044010 CEST	49980	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:34.077083111 CEST	443	49980	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.077419996 CEST	49980	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:34.077430964 CEST	443	49980	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.176979065 CEST	443	49980	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.177139997 CEST	443	49980	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.177222013 CEST	49980	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:34.177308083 CEST	49980	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:34.177308083 CEST	49980	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:34.177370071 CEST	443	49980	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.177400112 CEST	443	49980	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.179510117 CEST	49985	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:34.179537058 CEST	443	49985	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.179610014 CEST	49985	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:34.179728031 CEST	49985	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:34.179739952 CEST	443	49985	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.193037987 CEST	443	49981	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.193509102 CEST	49981	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:34.193595886 CEST	443	49981	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.193746090 CEST	49981	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:34.193761110 CEST	443	49981	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.296160936 CEST	443	49981	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.296313047 CEST	443	49981	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.296541929 CEST	49981	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:34.296629906 CEST	49981	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:34.296668053 CEST	443	49981	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.296719074 CEST	49981	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:34.296734095 CEST	443	49981	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.298424959 CEST	49986	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:34.298434019 CEST	443	49986	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.298505068 CEST	49986	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:34.298600912 CEST	49986	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:34.298615932 CEST	443	49986	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.319853067 CEST	443	49982	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.320209026 CEST	49982	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:34.320271015 CEST	443	49982	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.320739985 CEST	49982	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:34.320755005 CEST	443	49982	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.422306061 CEST	443	49982	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.422342062 CEST	443	49982	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.422519922 CEST	49982	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:34.422612906 CEST	49982	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:34.422612906 CEST	49982	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:34.422658920 CEST	443	49982	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.422692060 CEST	443	49982	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.425273895 CEST	49987	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:34.425347090 CEST	443	49987	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.425497055 CEST	49987	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:34.425614119 CEST	49987	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:34.425641060 CEST	443	49987	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.536792040 CEST	443	49983	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.537348032 CEST	49983	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:34.537393093 CEST	443	49983	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.537668943 CEST	49983	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:34.537682056 CEST	443	49983	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.640934944 CEST	443	49983	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.640995979 CEST	443	49983	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.641088009 CEST	443	49983	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.641200066 CEST	49983	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:34.641200066 CEST	49983	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:34.641352892 CEST	49983	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:34.641352892 CEST	49983	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:34.641387939 CEST	443	49983	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.641415119 CEST	443	49983	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.643609047 CEST	49988	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:34.643652916 CEST	443	49988	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.643728018 CEST	49988	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:34.643969059 CEST	49988	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:34.643997908 CEST	443	49988	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.663312912 CEST	443	49984	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.663811922 CEST	49984	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:34.663846970 CEST	443	49984	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.664083958 CEST	49984	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:34.664094925 CEST	443	49984	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.763380051 CEST	443	49984	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.763555050 CEST	443	49984	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.763691902 CEST	49984	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:34.763742924 CEST	49984	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:34.763767958 CEST	443	49984	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.763813972 CEST	49984	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:34.763828039 CEST	443	49984	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.765995026 CEST	49989	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:34.766081095 CEST	443	49989	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.766169071 CEST	49989	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:34.766292095 CEST	49989	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:34.766326904 CEST	443	49989	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.846963882 CEST	443	49985	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.847435951 CEST	49985	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:34.847460985 CEST	443	49985	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.847858906 CEST	49985	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:34.847866058 CEST	443	49985	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.949269056 CEST	443	49985	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.949412107 CEST	443	49985	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.949470997 CEST	49985	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:34.949493885 CEST	49985	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:34.949493885 CEST	49985	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:34.949508905 CEST	443	49985	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.949517965 CEST	443	49985	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.952496052 CEST	49990	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:34.952581882 CEST	443	49990	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.952657938 CEST	49990	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:34.952835083 CEST	49990	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:34.952869892 CEST	443	49990	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.964517117 CEST	443	49986	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.964799881 CEST	49986	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:34.964809895 CEST	443	49986	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:34.965163946 CEST	49986	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:34.965169907 CEST	443	49986	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.067894936 CEST	443	49986	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.067938089 CEST	443	49986	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.068043947 CEST	443	49986	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.068087101 CEST	49986	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:35.068238020 CEST	49986	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:35.068238020 CEST	49986	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:35.068963051 CEST	49986	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:35.068979025 CEST	443	49986	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.070687056 CEST	49991	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:35.070780039 CEST	443	49991	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.070871115 CEST	49991	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:35.070979118 CEST	49991	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:35.071013927 CEST	443	49991	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.085433006 CEST	443	49987	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.085728884 CEST	49987	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:35.085748911 CEST	443	49987	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.086184025 CEST	49987	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:35.086189032 CEST	443	49987	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.190665960 CEST	443	49987	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.190709114 CEST	443	49987	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.190865993 CEST	49987	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:35.190897942 CEST	49987	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:35.190917015 CEST	443	49987	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.190931082 CEST	49987	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:35.190937042 CEST	443	49987	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.192810059 CEST	49992	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:35.192837000 CEST	443	49992	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.192918062 CEST	49992	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:35.193041086 CEST	49992	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:35.193054914 CEST	443	49992	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.304023981 CEST	443	49988	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.304528952 CEST	49988	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:35.304614067 CEST	443	49988	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.304747105 CEST	49988	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:35.304761887 CEST	443	49988	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.404566050 CEST	443	49988	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.404613972 CEST	443	49988	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.404722929 CEST	443	49988	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.404793024 CEST	49988	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:35.404793978 CEST	49988	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:35.404902935 CEST	49988	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:35.404947042 CEST	443	49988	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.404982090 CEST	49988	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:35.404997110 CEST	443	49988	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.407335997 CEST	49993	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:35.407358885 CEST	443	49993	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.407424927 CEST	49993	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:35.407572031 CEST	49993	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:35.407582998 CEST	443	49993	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.433218002 CEST	443	49989	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.433582067 CEST	49989	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:35.433641911 CEST	443	49989	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.434025049 CEST	49989	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:35.434039116 CEST	443	49989	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.535304070 CEST	443	49989	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.535362959 CEST	443	49989	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.535427094 CEST	49989	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:35.535450935 CEST	443	49989	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.535553932 CEST	49989	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:35.535576105 CEST	443	49989	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.535600901 CEST	49989	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:35.535604000 CEST	443	49989	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.535636902 CEST	443	49989	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.537724972 CEST	49994	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:35.537740946 CEST	443	49994	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.537806034 CEST	49994	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:35.537981033 CEST	49994	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:35.537991047 CEST	443	49994	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.637204885 CEST	443	49990	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.637788057 CEST	49990	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:35.637825966 CEST	443	49990	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.638289928 CEST	49990	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:35.638302088 CEST	443	49990	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.722495079 CEST	443	49991	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.722881079 CEST	49991	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:35.722917080 CEST	443	49991	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.723269939 CEST	49991	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:35.723287106 CEST	443	49991	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.750886917 CEST	443	49990	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.750957966 CEST	443	49990	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.751029968 CEST	49990	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:35.751094103 CEST	443	49990	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.751130104 CEST	443	49990	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.751185894 CEST	49990	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:35.751243114 CEST	49990	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:35.751243114 CEST	49990	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:35.751276016 CEST	443	49990	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.751298904 CEST	443	49990	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.753953934 CEST	49995	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:35.753985882 CEST	443	49995	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.754071951 CEST	49995	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:35.754211903 CEST	49995	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:35.754229069 CEST	443	49995	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.767816067 CEST	443	49992	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.768101931 CEST	49992	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:35.768115997 CEST	443	49992	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.768460989 CEST	49992	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:35.768465996 CEST	443	49992	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.822866917 CEST	443	49991	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.822917938 CEST	443	49991	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.822982073 CEST	49991	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:35.823014021 CEST	443	49991	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.823156118 CEST	49991	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:35.823156118 CEST	49991	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:35.823190928 CEST	443	49991	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.823540926 CEST	443	49991	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.823636055 CEST	443	49991	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.823689938 CEST	49991	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:35.825066090 CEST	49996	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:35.825154066 CEST	443	49996	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.825242043 CEST	49996	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:35.825345039 CEST	49996	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:35.825378895 CEST	443	49996	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.869087934 CEST	443	49992	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.869136095 CEST	443	49992	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.869302988 CEST	49992	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:35.869415998 CEST	49992	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:35.869426012 CEST	443	49992	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.869463921 CEST	49992	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:35.869468927 CEST	443	49992	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.871265888 CEST	49997	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:35.871341944 CEST	443	49997	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:35.871457100 CEST	49997	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:35.871546030 CEST	49997	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:35.871572971 CEST	443	49997	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:36.075495958 CEST	443	49993	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:36.075895071 CEST	49993	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:36.075907946 CEST	443	49993	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:36.076395988 CEST	49993	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:36.076400042 CEST	443	49993	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:36.177895069 CEST	443	49993	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:36.178029060 CEST	443	49993	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:36.178109884 CEST	49993	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:36.178200006 CEST	49993	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:36.178214073 CEST	443	49993	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:36.178222895 CEST	49993	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:36.178226948 CEST	443	49993	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:36.180720091 CEST	49998	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:36.180742979 CEST	443	49998	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:36.180814981 CEST	49998	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:36.180947065 CEST	49998	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:36.180960894 CEST	443	49998	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:36.202637911 CEST	443	49994	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:36.202945948 CEST	49994	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:36.202967882 CEST	443	49994	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:36.203295946 CEST	49994	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:36.203299999 CEST	443	49994	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:36.302795887 CEST	443	49994	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:36.302872896 CEST	443	49994	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:36.302926064 CEST	49994	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:36.303009987 CEST	49994	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:36.303016901 CEST	443	49994	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:36.303025961 CEST	49994	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:36.303029060 CEST	443	49994	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:36.304856062 CEST	49999	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:36.304943085 CEST	443	49999	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:36.305025101 CEST	49999	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:36.305126905 CEST	49999	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:36.305160999 CEST	443	49999	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:36.407819986 CEST	443	49995	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:36.410653114 CEST	49995	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:36.410674095 CEST	443	49995	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:36.411122084 CEST	49995	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:36.411127090 CEST	443	49995	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:36.476407051 CEST	443	49996	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:36.476883888 CEST	49996	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:36.476949930 CEST	443	49996	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:36.477415085 CEST	49996	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:36.477432966 CEST	443	49996	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:36.508157015 CEST	443	49995	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:36.508323908 CEST	443	49995	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:36.508388996 CEST	49995	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:36.508411884 CEST	49995	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:36.508423090 CEST	443	49995	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:36.508430958 CEST	49995	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:36.508435965 CEST	443	49995	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:36.510622978 CEST	50000	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:36.510706902 CEST	443	50000	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:36.510791063 CEST	50000	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:36.510886908 CEST	50000	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:36.510910988 CEST	443	50000	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:36.560108900 CEST	443	49997	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:36.560451031 CEST	49997	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:36.560482979 CEST	443	49997	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:36.560844898 CEST	49997	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:36.560851097 CEST	443	49997	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:36.578629017 CEST	443	49996	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:36.578682899 CEST	443	49996	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:36.578743935 CEST	49996	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:36.578772068 CEST	443	49996	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:36.578815937 CEST	443	49996	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:36.578825951 CEST	49996	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:36.578860044 CEST	49996	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:36.578912973 CEST	49996	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:36.578943014 CEST	443	49996	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:36.578968048 CEST	49996	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:36.578982115 CEST	443	49996	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:36.580738068 CEST	50001	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:36.580842018 CEST	443	50001	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:36.580941916 CEST	50001	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:36.581048965 CEST	50001	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:36.581072092 CEST	443	50001	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:36.667905092 CEST	443	49997	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:36.667937040 CEST	443	49997	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:36.667998075 CEST	443	49997	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:36.667999983 CEST	49997	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:36.668042898 CEST	49997	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:36.668176889 CEST	49997	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:36.668176889 CEST	49997	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:36.668195009 CEST	443	49997	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:36.668205023 CEST	443	49997	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:36.670394897 CEST	50002	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:36.670483112 CEST	443	50002	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:36.670567036 CEST	50002	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:36.670664072 CEST	50002	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:36.670698881 CEST	443	50002	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:36.832716942 CEST	443	49998	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:36.833220959 CEST	49998	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:36.833239079 CEST	443	49998	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:36.833688021 CEST	49998	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:36.833693027 CEST	443	49998	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:36.934885979 CEST	443	49998	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:36.934938908 CEST	443	49998	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:36.935040951 CEST	49998	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:36.935055017 CEST	443	49998	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:36.935126066 CEST	49998	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:36.977329969 CEST	443	49999	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:36.977840900 CEST	49999	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:36.977900982 CEST	443	49999	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:36.978255987 CEST	49999	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:36.978271008 CEST	443	49999	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.020972967 CEST	443	49998	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.021101952 CEST	443	49998	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.021161079 CEST	49998	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.021202087 CEST	49998	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.021255016 CEST	49998	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.021282911 CEST	443	49998	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.021296024 CEST	49998	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.021302938 CEST	443	49998	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.024101973 CEST	50003	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.024189949 CEST	443	50003	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.024293900 CEST	50003	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.024420977 CEST	50003	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.024460077 CEST	443	50003	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.080306053 CEST	443	49999	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.080352068 CEST	443	49999	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.080420971 CEST	49999	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.080482006 CEST	443	49999	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.080585957 CEST	49999	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.080590010 CEST	443	49999	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.080610991 CEST	49999	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.080640078 CEST	443	49999	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.080650091 CEST	49999	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.080678940 CEST	443	49999	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.082488060 CEST	50004	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.082505941 CEST	443	50004	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.082578897 CEST	50004	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.082669020 CEST	50004	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.082680941 CEST	443	50004	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.161246061 CEST	443	50000	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.162076950 CEST	50000	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.162172079 CEST	443	50000	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.162209034 CEST	50000	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.162223101 CEST	443	50000	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.234323978 CEST	443	50001	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.234654903 CEST	50001	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.234695911 CEST	443	50001	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.235023975 CEST	50001	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.235038042 CEST	443	50001	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.268378973 CEST	443	50000	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.268438101 CEST	443	50000	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.268479109 CEST	443	50000	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.268516064 CEST	50000	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.268584013 CEST	443	50000	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.268640995 CEST	50000	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.268665075 CEST	50000	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.322642088 CEST	443	50002	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.323374987 CEST	50002	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.323470116 CEST	443	50002	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.323667049 CEST	50002	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.323682070 CEST	443	50002	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.337304115 CEST	443	50001	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.337363005 CEST	443	50001	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.337462902 CEST	50001	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.337483883 CEST	443	50001	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.337513924 CEST	443	50001	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.337546110 CEST	50001	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.337575912 CEST	50001	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.337811947 CEST	50001	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.337811947 CEST	50001	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.337846994 CEST	443	50001	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.337869883 CEST	443	50001	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.340090990 CEST	50005	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.340159893 CEST	443	50005	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.340245962 CEST	50005	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.340373993 CEST	50005	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.340393066 CEST	443	50005	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.352715015 CEST	443	50000	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.352778912 CEST	443	50000	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.352816105 CEST	50000	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.352880955 CEST	443	50000	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.352916002 CEST	50000	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.352917910 CEST	443	50000	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.353161097 CEST	50000	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.353229046 CEST	50000	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.353260994 CEST	443	50000	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.353286982 CEST	50000	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.353301048 CEST	443	50000	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.355149031 CEST	50006	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.355201006 CEST	443	50006	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.355285883 CEST	50006	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.355454922 CEST	50006	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.355484962 CEST	443	50006	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.425436020 CEST	443	50002	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.425452948 CEST	443	50002	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.425489902 CEST	443	50002	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.425514936 CEST	50002	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.425548077 CEST	50002	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.425839901 CEST	50002	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.425839901 CEST	50002	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.425860882 CEST	443	50002	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.425880909 CEST	443	50002	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.429446936 CEST	50007	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.429476976 CEST	443	50007	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.429569006 CEST	50007	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.429835081 CEST	50007	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.429851055 CEST	443	50007	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.681849957 CEST	443	50003	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.682399035 CEST	50003	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.682487965 CEST	443	50003	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.682820082 CEST	50003	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.682838917 CEST	443	50003	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.800097942 CEST	443	50004	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.803349018 CEST	50004	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.803359032 CEST	443	50004	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.803862095 CEST	50004	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.803869009 CEST	443	50004	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.808548927 CEST	443	50003	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.808662891 CEST	443	50003	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.808756113 CEST	50003	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.808901072 CEST	50003	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.808901072 CEST	50003	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.808929920 CEST	443	50003	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.808959961 CEST	443	50003	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.811995029 CEST	50008	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.812043905 CEST	443	50008	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.812115908 CEST	50008	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.812314987 CEST	50008	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.812330961 CEST	443	50008	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.904742002 CEST	443	50004	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.904877901 CEST	443	50004	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.905030966 CEST	50004	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.905030966 CEST	50004	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.905030966 CEST	50004	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.907491922 CEST	50009	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.907547951 CEST	443	50009	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:37.907651901 CEST	50009	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.907790899 CEST	50009	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:37.907820940 CEST	443	50009	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:38.042246103 CEST	443	50005	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:38.042958021 CEST	50005	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:38.042982101 CEST	443	50005	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:38.043361902 CEST	50005	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:38.043370008 CEST	443	50005	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:38.069250107 CEST	443	50006	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:38.069591999 CEST	50006	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:38.069607019 CEST	443	50006	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:38.069945097 CEST	50006	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:38.069951057 CEST	443	50006	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:38.105811119 CEST	443	50007	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:38.106380939 CEST	50007	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:38.106404066 CEST	443	50007	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:38.106730938 CEST	50007	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:38.106734991 CEST	443	50007	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:38.144125938 CEST	443	50005	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:38.144262075 CEST	443	50005	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:38.144330025 CEST	50005	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:38.144450903 CEST	50005	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:38.144481897 CEST	443	50005	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:38.144507885 CEST	50005	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:38.144521952 CEST	443	50005	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:38.147098064 CEST	50010	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:38.147183895 CEST	443	50010	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:38.147279024 CEST	50010	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:38.147397995 CEST	50010	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:38.147433043 CEST	443	50010	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:38.174735069 CEST	443	50006	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:38.174910069 CEST	443	50006	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:38.174985886 CEST	50006	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:38.179011106 CEST	50006	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:38.179053068 CEST	443	50006	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:38.179084063 CEST	50006	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:38.179099083 CEST	443	50006	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:38.182018995 CEST	50011	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:38.182075024 CEST	443	50011	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:38.182147026 CEST	50011	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:38.182279110 CEST	50011	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:38.182295084 CEST	443	50011	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:38.206928015 CEST	443	50007	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:38.206968069 CEST	443	50007	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:38.207016945 CEST	443	50007	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:38.207024097 CEST	50007	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:38.207072973 CEST	50007	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:38.207186937 CEST	50007	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:38.207196951 CEST	443	50007	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:38.207206964 CEST	50007	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:38.207211018 CEST	443	50007	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:38.216778040 CEST	50004	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:38.216784000 CEST	443	50004	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:38.480382919 CEST	443	50008	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:38.480918884 CEST	50008	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:38.480933905 CEST	443	50008	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:38.481379986 CEST	50008	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:38.481384993 CEST	443	50008	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:38.483203888 CEST	443	50009	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:38.483639002 CEST	50009	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:38.483683109 CEST	443	50009	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:38.483931065 CEST	50009	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:38.483939886 CEST	443	50009	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:38.581923008 CEST	443	50008	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:38.582052946 CEST	443	50008	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:38.582122087 CEST	50008	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:38.582256079 CEST	50008	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:38.582273006 CEST	443	50008	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:38.582302094 CEST	50008	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:38.582309008 CEST	443	50008	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:38.585210085 CEST	443	50009	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:38.585342884 CEST	443	50009	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:38.585412025 CEST	50009	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:38.585608006 CEST	50009	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:38.585608959 CEST	50009	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:38.585639954 CEST	443	50009	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:38.585658073 CEST	443	50009	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:38.801743031 CEST	443	50010	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:38.802367926 CEST	50010	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:38.802380085 CEST	443	50010	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:38.803025007 CEST	50010	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:38.803030968 CEST	443	50010	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:38.853563070 CEST	443	50011	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:38.854191065 CEST	50011	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:38.854212046 CEST	443	50011	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:38.854773998 CEST	50011	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:38.854780912 CEST	443	50011	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:38.903867006 CEST	443	50010	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:38.903934002 CEST	443	50010	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:38.904115915 CEST	50010	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:38.904159069 CEST	50010	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:38.904159069 CEST	50010	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:38.904179096 CEST	443	50010	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:38.904192924 CEST	443	50010	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:38.957144022 CEST	443	50011	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:38.957202911 CEST	443	50011	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:38.957264900 CEST	50011	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:38.957490921 CEST	50011	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:38.957515001 CEST	443	50011	13.107.246.45	192.168.2.4
Oct 14, 2024 04:45:38.957529068 CEST	50011	443	192.168.2.4	13.107.246.45
Oct 14, 2024 04:45:38.957535982 CEST	443	50011	13.107.246.45	192.168.2.4

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 14, 2024 04:44:01.075259924 CEST	1.1.1.1	192.168.2.4	0x63ab	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Oct 14, 2024 04:44:01.075259924 CEST	1.1.1.1	192.168.2.4	0x63ab	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Oct 14, 2024 04:44:02.860434055 CEST	1.1.1.1	192.168.2.4	0x93fc	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 14, 2024 04:44:02.860434055 CEST	1.1.1.1	192.168.2.4	0x93fc	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Oct 14, 2024 04:44:54.282847881 CEST	1.1.1.1	192.168.2.4	0xa1b7	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 14, 2024 04:44:54.282847881 CEST	1.1.1.1	192.168.2.4	0xa1b7	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	22:43:56
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\#U0415Sh#U0430rk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\#U0415Sh#U0430rk.exe"
Imagebase:	0xef0000
File size:	501'800 bytes
MD5 hash:	1ADDA3C7508B412FBB8C72EAA9EEA548
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1851791281.0000000000F1B000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	22:43:58
Start date:	13/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0xa00000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000001.00000002.1784795621.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000001.00000002.1786962909.0000000002E34000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	22:43:58
Start date:	13/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7304 -s 296
Imagebase:	0x8a0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	6.5%
Total number of Nodes:	1251
Total number of Limit Nodes:	15

Executed Functions

Function 00EF1FEA Relevance: 7.7, APIs: 5, Instructions: 153
memorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(00F66D40,000004E4,00000040,?), ref: 00EF2101
GetCurrentThreadId.KERNEL32 ref: 00EF2138
GetConsoleWindow.KERNEL32(00000001), ref: 00EF2167
ShowWindow.USER32(00000000), ref: 00EF216E
std::_Throw_Cpp_error.LIBCPMT ref: 00EF218D

Memory Dump Source

Source File: 00000000.00000002.1851729503.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1851708778.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851767957.0000000000F11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F4F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851874526.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851899358.0000000000F68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851922106.0000000000F6A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_#U0415Sh#U0430rk.jbxd

Yara matches

Similarity

API ID: Window$ConsoleCpp_errorCurrentProtectShowThreadThrow_Virtualstd::_
String ID:
API String ID: 1484634515-0
Opcode ID: fda10bb0bb42cbbc8cb2e72e88722c53ce04cd7879295c23df29738177b89dcb
Instruction ID: 6be138c402406e9f4457f66817de2ea4ad85c375f87f363e1c0abcfe5ecc4101
Opcode Fuzzy Hash: fda10bb0bb42cbbc8cb2e72e88722c53ce04cd7879295c23df29738177b89dcb
Instruction Fuzzy Hash: F741CE33D0021EABE3146AB18C42BFFBEA9EF44750F40615ABB06B71E0E7348B41C694

Function 00F02B19 Relevance: .0, Instructions: 29
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1851729503.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1851708778.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851767957.0000000000F11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F4F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851874526.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851899358.0000000000F68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851922106.0000000000F6A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_#U0415Sh#U0430rk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 229df1d2640d1bf3e85ef831d99d995a0661459152ff753d7f821462befa7621
Instruction ID: 3c0b5b502bc3a59c06f216692be0acfc9e597153777014fe0e27db52bfebab4b
Opcode Fuzzy Hash: 229df1d2640d1bf3e85ef831d99d995a0661459152ff753d7f821462befa7621
Instruction Fuzzy Hash: 5EF06571A11224DBCB26CB4CC949B99B3ACEB45B61F114196F501EB191C7B4DD40E7E0

Function 00F01C2F Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,4665E89B,?,00F01D3C,?,?,?,00000000), ref: 00F01CF0

Strings

ext-ms-, xrefs: 00F01C9A
api-ms-, xrefs: 00F01C86

Memory Dump Source

Source File: 00000000.00000002.1851729503.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1851708778.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851767957.0000000000F11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F4F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851874526.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851899358.0000000000F68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851922106.0000000000F6A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_#U0415Sh#U0430rk.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: cd5c374d3750f0ab8e3587eeb5801ce940939ac40e185809a2f08d0896548ff7
Instruction ID: dbafe248777de4744246d62a7521e5f5531332446d642e5d3281d7138ddf9c4d
Opcode Fuzzy Hash: cd5c374d3750f0ab8e3587eeb5801ce940939ac40e185809a2f08d0896548ff7
Instruction Fuzzy Hash: CB213D72E81218ABD7319B60DC55ADA7768FB417B0F158214ED16E72D0DB30ED00F6D0

Function 00EF9EBB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 51
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(?,?,Function_00009D5F,00000000,00000000,?), ref: 00EF9F04
GetLastError.KERNEL32(?,00EF2129,00000000,00000000,00EF2C5B,00000000,00000000), ref: 00EF9F10
__dosmaperr.LIBCMT ref: 00EF9F17

Strings

[,, xrefs: 00EF9F2C

Memory Dump Source

Source File: 00000000.00000002.1851729503.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1851708778.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851767957.0000000000F11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F4F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851874526.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851899358.0000000000F68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851922106.0000000000F6A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_#U0415Sh#U0430rk.jbxd

Yara matches

Similarity

API ID: CreateErrorLastThread__dosmaperr
String ID: [,
API String ID: 2744730728-389477274
Opcode ID: 1a752f9c80f0ccd12d5200f4f3515f9ed684ede7eca808af69d6c1d3799e033c
Instruction ID: 907bdac47dbfb344521149e6d1fba93ad4a83acf0f4543a58634df7c30217ab3
Opcode Fuzzy Hash: 1a752f9c80f0ccd12d5200f4f3515f9ed684ede7eca808af69d6c1d3799e033c
Instruction Fuzzy Hash: DF018C7261020DEBCF159FA0DC05BFE7BA5EF40364F205159FA01A6192DB718A51DB90

Function 00EF9D5F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(00F19F68,0000000C), ref: 00EF9D72
ExitThread.KERNEL32 ref: 00EF9D79

Strings

4=, xrefs: 00EF9DAF

Memory Dump Source

Source File: 00000000.00000002.1851729503.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1851708778.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851767957.0000000000F11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F4F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851874526.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851899358.0000000000F68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851922106.0000000000F6A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_#U0415Sh#U0430rk.jbxd

Yara matches

Similarity

API ID: ErrorExitLastThread
String ID: 4=
API String ID: 1611280651-3841008636
Opcode ID: 9f1f3bf0e280a48ee628ccff18854bdfbfa9612645cb9f8e212888ae54762264
Instruction ID: ff82b9c1ac89905aed3ec5ffbca1e86095c66c49a5428e53aaf1036a424662df
Opcode Fuzzy Hash: 9f1f3bf0e280a48ee628ccff18854bdfbfa9612645cb9f8e212888ae54762264
Instruction Fuzzy Hash: A5F0C271A00608AFDB11AFB0CC1ABBE3BB4FF44300F204149F605A72A2CB356941EFA1

Function 00F01CFA Relevance: 1.6, APIs: 1, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1851729503.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1851708778.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851767957.0000000000F11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F4F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851874526.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851899358.0000000000F68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851922106.0000000000F6A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_#U0415Sh#U0430rk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26697c96f96d63b98210e881dc6ef8c41190de96b1bd0d123e7b560081275128
Instruction ID: eec38d03aca73e946bce0c1dc2e5a1cb4854467ec34c8f51fb176f6553efd7ad
Opcode Fuzzy Hash: 26697c96f96d63b98210e881dc6ef8c41190de96b1bd0d123e7b560081275128
Instruction Fuzzy Hash: 1401B537B016199BDF25CF6AEC41A9A3396BB893707258124FA10DB1E4EB30D801B790

Non-executed Functions

Function 00F0B551 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00F0B735

Strings

1#SNAN, xrefs: 00F0B65D
1#QNAN, xrefs: 00F0B664
1#IND, xrefs: 00F0B656
1#INF, xrefs: 00F0B687

Memory Dump Source

Source File: 00000000.00000002.1851729503.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1851708778.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851767957.0000000000F11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F4F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851874526.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851899358.0000000000F68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851922106.0000000000F6A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_#U0415Sh#U0430rk.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 24753dd889cf7556fa689d7e4b77c2323900cf085361742a5912fd85a50fc1a4
Instruction ID: 427c3c9f531ad3edead145e314f240467b8a4dfdba40823c9daf280e8396f31a
Opcode Fuzzy Hash: 24753dd889cf7556fa689d7e4b77c2323900cf085361742a5912fd85a50fc1a4
Instruction Fuzzy Hash: 43D22E72E082298FDB65CF28CD407EAB7B5EB44315F1445EAD44DE7280D778AE85AF80

Function 00F0A8AB Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00F0ABC9,00000002,00000000,?,?,?,00F0ABC9,?,00000000), ref: 00F0A944
GetLocaleInfoW.KERNEL32(?,20001004,00F0ABC9,00000002,00000000,?,?,?,00F0ABC9,?,00000000), ref: 00F0A96D
GetACP.KERNEL32(?,?,00F0ABC9,?,00000000), ref: 00F0A982

Strings

ACP, xrefs: 00F0A8C9
OCP, xrefs: 00F0A8FF

Memory Dump Source

Source File: 00000000.00000002.1851729503.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1851708778.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851767957.0000000000F11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F4F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851874526.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851899358.0000000000F68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851922106.0000000000F6A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_#U0415Sh#U0430rk.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 7f5416c1393e5b6464dd3687a96ea32cade123d0f1947b0a53d4366d5445fe91
Instruction ID: f745de75a91aa64ebc369b9cc69d90d8ecd91a45f7486d1e5e58f2158bab8f13
Opcode Fuzzy Hash: 7f5416c1393e5b6464dd3687a96ea32cade123d0f1947b0a53d4366d5445fe91
Instruction Fuzzy Hash: 6B21B333F00305AADB348B64C901BA7B3A6AB54BB0B57C164E94AD7184F732DE81F352

Function 00F0AA80 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F0282E: GetLastError.KERNEL32(?,?,00EF9D84,00F19F68,0000000C), ref: 00F02832
Part of subcall function 00F0282E: SetLastError.KERNEL32(00000000), ref: 00F028D4

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 00F0AB8C
IsValidCodePage.KERNEL32(00000000), ref: 00F0ABD5
IsValidLocale.KERNEL32(?,00000001), ref: 00F0ABE4
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00F0AC2C
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00F0AC4B

Memory Dump Source

Source File: 00000000.00000002.1851729503.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1851708778.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851767957.0000000000F11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F4F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851874526.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851899358.0000000000F68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851922106.0000000000F6A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_#U0415Sh#U0430rk.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: d33ba1ce01d1e17970cc45c3a20dacc89c1895409b82da6a9b34d7f5a5dbd476
Instruction ID: 72e8aa7f76a06c9e2f48f298fc25d271b24d1750bfe0f70cd203c579b449d3cb
Opcode Fuzzy Hash: d33ba1ce01d1e17970cc45c3a20dacc89c1895409b82da6a9b34d7f5a5dbd476
Instruction Fuzzy Hash: 20519FB1E00309AFEB10DFA5CC45BAEB3B9BF88710F044469A901EB1D1E7749944FB62

Function 00F02D9D Relevance: 6.3, APIs: 4, Instructions: 337COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00F02E2A

Memory Dump Source

Source File: 00000000.00000002.1851729503.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1851708778.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851767957.0000000000F11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F4F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851874526.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851899358.0000000000F68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851922106.0000000000F6A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_#U0415Sh#U0430rk.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 02312408630170b3c25dee6112d7f3f8a09a7014db778087c09366575c92c367
Instruction ID: ff82877b529e13a45a186a043525b241e306e598a89963482b9f60ecebd6f962
Opcode Fuzzy Hash: 02312408630170b3c25dee6112d7f3f8a09a7014db778087c09366575c92c367
Instruction Fuzzy Hash: 25B15732E052469FDB258F28C885BFEBBB9EF55354F14416AE805AB2C1C2349D01FBB0

Function 00F07C3B Relevance: 6.1, APIs: 4, Instructions: 129fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000), ref: 00F07CD6
FindNextFileW.KERNEL32(00000000,?), ref: 00F07D51
FindClose.KERNEL32(00000000), ref: 00F07D73
FindClose.KERNEL32(00000000), ref: 00F07D96

Memory Dump Source

Source File: 00000000.00000002.1851729503.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1851708778.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851767957.0000000000F11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F4F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851874526.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851899358.0000000000F68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851922106.0000000000F6A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_#U0415Sh#U0430rk.jbxd

Yara matches

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: 13dcd0675b52fbe3098a3bc3af6a44627afe5ea072ccde4b03c40c068aaf6b97
Instruction ID: 2aeca9e8416c3ff635ef11d5d6c09a11aab8b0d26027d43a598db3c1c5a7b4cb
Opcode Fuzzy Hash: 13dcd0675b52fbe3098a3bc3af6a44627afe5ea072ccde4b03c40c068aaf6b97
Instruction Fuzzy Hash: FE41A171D05729AFDB20EF65DC89ABAB3B9EF84315F1081D5E505A7180E630AE80FA60

Function 00EF5F93 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00EF5F9F
IsDebuggerPresent.KERNEL32 ref: 00EF606B
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00EF6084
UnhandledExceptionFilter.KERNEL32(?), ref: 00EF608E

Memory Dump Source

Source File: 00000000.00000002.1851729503.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1851708778.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851767957.0000000000F11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F4F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851874526.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851899358.0000000000F68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851922106.0000000000F6A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_#U0415Sh#U0430rk.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: c188c968924c2a83162b296d934b926a8bbc46aa3999ec4212be406d44738b41
Instruction ID: abbdd0643dcbb7f2c2a358aed077e417ef4b2bd86e7c02d46f50e025d6f7c749
Opcode Fuzzy Hash: c188c968924c2a83162b296d934b926a8bbc46aa3999ec4212be406d44738b41
Instruction Fuzzy Hash: 6431E575D0521C9BDF21DFA4D9497CDBBB8BF08304F1041AAE60CAB250EB709B859F45

Function 00EF1AC2 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 187COMMON

Download Yara Rule

APIs

Part of subcall function 00EF2B18: __EH_prolog3_catch.LIBCMT ref: 00EF2B1F

_Deallocate.LIBCONCRT ref: 00EF1C9D
_Deallocate.LIBCONCRT ref: 00EF1CEA

Strings

Current val: %d, xrefs: 00EF1C76

Memory Dump Source

Source File: 00000000.00000002.1851729503.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1851708778.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851767957.0000000000F11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F4F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851874526.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851899358.0000000000F68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851922106.0000000000F6A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_#U0415Sh#U0430rk.jbxd

Yara matches

Similarity

API ID: Deallocate$H_prolog3_catch
String ID: Current val: %d
API String ID: 1212816977-1825967858
Opcode ID: d8ae670a9321870376e91b1a0d54c48949528ebcc887c495ad94f81e99638e11
Instruction ID: 4a7752bd0898f185cc32121692b637dd2794204c32af27e0e2653b422772f275
Opcode Fuzzy Hash: d8ae670a9321870376e91b1a0d54c48949528ebcc887c495ad94f81e99638e11
Instruction Fuzzy Hash: 9B619B7251C7598FC324DF29D48026BFBE0AFD8724F151A6EFAD4A3242D735E9048B92

Function 00EF51AF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,00EF5151,?,00000000,00000000,?,00EF5110,?,?,?,?,00EF504F,?), ref: 00EF51E7
GetSystemTimeAsFileTime.KERNEL32(?,4665E89B,?,?,00F10535,000000FF,?,00EF5151,?,00000000,00000000,?,00EF5110,?,?), ref: 00EF51EB

Strings

4=, xrefs: 00EF51E1

Memory Dump Source

Source File: 00000000.00000002.1851729503.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1851708778.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851767957.0000000000F11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F4F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851874526.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851899358.0000000000F68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851922106.0000000000F6A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_#U0415Sh#U0430rk.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$Precise
String ID: 4=
API String ID: 743729956-3841008636
Opcode ID: 606ff8bf95ba8cba47c7f749fdac9d80995fa7a781cd826aaafcba740aa74d59
Instruction ID: 161f0d80ca89b2ef55ac044eaab281b8d865dc0cfce053d6f9cbd07af1c2e9dc
Opcode Fuzzy Hash: 606ff8bf95ba8cba47c7f749fdac9d80995fa7a781cd826aaafcba740aa74d59
Instruction Fuzzy Hash: CDF03032A44A5CEBC7119F45DC44B99B7A8F708B14F014226EE12A7794DB74A9409B80

Function 00F0A52F Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00F0282E: GetLastError.KERNEL32(?,?,00EF9D84,00F19F68,0000000C), ref: 00F02832
Part of subcall function 00F0282E: SetLastError.KERNEL32(00000000), ref: 00F028D4

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00F0A583
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00F0A5CD
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00F0A693

Memory Dump Source

Source File: 00000000.00000002.1851729503.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1851708778.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851767957.0000000000F11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F4F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851874526.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851899358.0000000000F68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851922106.0000000000F6A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_#U0415Sh#U0430rk.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 8713a7b4a52ce1a19efe6fd6aead285ade5431fc3929e3afcc7ffb644cdc079d
Instruction ID: 54a18c62a5b39e47bf06abb0a8b41caea13bd25e487104dd3e2b708807411bb3
Opcode Fuzzy Hash: 8713a7b4a52ce1a19efe6fd6aead285ade5431fc3929e3afcc7ffb644cdc079d
Instruction Fuzzy Hash: F6619D7190030B9BDB289F24CD82BBA77B8EF04310F1481AAE915C65C5E779E985FB51

Function 00EFBE0F Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00EFBF07
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00EFBF11
UnhandledExceptionFilter.KERNEL32(-00000327,?,?,?,?,?,00000000), ref: 00EFBF1E

Memory Dump Source

Source File: 00000000.00000002.1851729503.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1851708778.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851767957.0000000000F11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F4F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851874526.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851899358.0000000000F68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851922106.0000000000F6A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_#U0415Sh#U0430rk.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 06b1dcc680ebc17288b5789c66fd85db07dc51ed11db6d4c11de6ca950f65cf4
Instruction ID: 0cf2ae23040c9dc082f8525c25a6774781cdcaafa8a61289db937176e8c44257
Opcode Fuzzy Hash: 06b1dcc680ebc17288b5789c66fd85db07dc51ed11db6d4c11de6ca950f65cf4
Instruction Fuzzy Hash: AF31D27590122CABCB21DF28DD887DDBBB8BF08314F5092EAE51CA7251E7309B858F44

Function 00F01F50 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00F00946,?,20001004,00000000,00000002,?,?,00EFFF48), ref: 00F01F84

Strings

4=, xrefs: 00F01F6F

Memory Dump Source

Source File: 00000000.00000002.1851729503.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1851708778.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851767957.0000000000F11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F4F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851874526.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851899358.0000000000F68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851922106.0000000000F6A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_#U0415Sh#U0430rk.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: 4=
API String ID: 2299586839-3841008636
Opcode ID: 048b1e7c902b98ee79a279448625b5e50490790c58d43c45ce46bb0b1c94929f
Instruction ID: a34c157bf1429724029bb1352b3beed847ffac52dd0790db42138fada629dcef
Opcode Fuzzy Hash: 048b1e7c902b98ee79a279448625b5e50490790c58d43c45ce46bb0b1c94929f
Instruction Fuzzy Hash: B7E01A36500219BBCF222F61DC08E9E7A1AFB44761F018011FD05662A0CB768D61BAD0

Function 00EFE190 Relevance: 3.4, APIs: 2, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1851729503.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1851708778.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851767957.0000000000F11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F4F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851874526.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851899358.0000000000F68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851922106.0000000000F6A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_#U0415Sh#U0430rk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92ae356b703282245e46982a16b0c15d5e2b54d97083e81566a83ef1af4d191c
Instruction ID: 9902fab1fecab60ab4db40345e78a639aedac6b01a3ca450ff60cb256c507515
Opcode Fuzzy Hash: 92ae356b703282245e46982a16b0c15d5e2b54d97083e81566a83ef1af4d191c
Instruction Fuzzy Hash: BFF12D71E0121D9FDF14CFA8D8846ADBBB1FF88318F159269E915BB391D730AE058B90

Function 00F06E51 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00F06E4C,?,?,00000008,?,?,00F0FC05,00000000), ref: 00F0707E

Memory Dump Source

Source File: 00000000.00000002.1851729503.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1851708778.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851767957.0000000000F11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F4F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851874526.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851899358.0000000000F68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851922106.0000000000F6A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_#U0415Sh#U0430rk.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 02b3cdf6dab5e960303c52406911045162d177aac02b524f5088356699e0c831
Instruction ID: 116563fcb1daad9b5a24878d27be1eeb810736c3f1111d9f95f0a4ba5611c516
Opcode Fuzzy Hash: 02b3cdf6dab5e960303c52406911045162d177aac02b524f5088356699e0c831
Instruction Fuzzy Hash: 3EB16C32A10609CFD714CF28C486B657BE1FF45365F258698E89ACF2E1C335E992EB40

Function 00EF58F5 Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00EF590B

Memory Dump Source

Source File: 00000000.00000002.1851729503.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1851708778.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851767957.0000000000F11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F4F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851874526.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851899358.0000000000F68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851922106.0000000000F6A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_#U0415Sh#U0430rk.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 233bc2b9c27db753783c927d71a8034a31d634a80a495e3b904db07b40648ad3
Instruction ID: af3cdfe57ce48e953769e36bfa978888289b2746f906df1c49861a8301d72f8b
Opcode Fuzzy Hash: 233bc2b9c27db753783c927d71a8034a31d634a80a495e3b904db07b40648ad3
Instruction Fuzzy Hash: D9A13CB2911B0DCFDB18CF54D8916EEBBB0FB58328F25912AD625E72A0D3749940DF50

Function 00F0A782 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00F0282E: GetLastError.KERNEL32(?,?,00EF9D84,00F19F68,0000000C), ref: 00F02832
Part of subcall function 00F0282E: SetLastError.KERNEL32(00000000), ref: 00F028D4

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00F0A7D6

Memory Dump Source

Source File: 00000000.00000002.1851729503.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1851708778.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851767957.0000000000F11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F4F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851874526.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851899358.0000000000F68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851922106.0000000000F6A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_#U0415Sh#U0430rk.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 1bc96df776f30e6efe81c30d16c30210fd0862e1921dbbbf03fbf8824011d3fc
Instruction ID: bb86228767bf152dd8e0172a4db641b09a81c38172ba539213f1a488fb3b901b
Opcode Fuzzy Hash: 1bc96df776f30e6efe81c30d16c30210fd0862e1921dbbbf03fbf8824011d3fc
Instruction Fuzzy Hash: DB21D772A01306ABDB18AB25DD41ABA33F8EF44310B14807AFD01D61C1EB74ED45F751

Function 00EFB25E Relevance: 1.6, Strings: 1, Instructions: 314COMMON

Download Yara Rule

Strings

0, xrefs: 00EFB3E8

Memory Dump Source

Source File: 00000000.00000002.1851729503.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1851708778.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851767957.0000000000F11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F4F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851874526.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851899358.0000000000F68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851922106.0000000000F6A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_#U0415Sh#U0430rk.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 6e7c8ee28bfc9ba2490ebbe6a4d41a0dfd111d6f6e4f0502d0e4bca0f23dace5
Instruction ID: e8f4e38eb1981315aa084de585fc06dd39d5639e987ef91fe54ffe3c67ec4b91
Opcode Fuzzy Hash: 6e7c8ee28bfc9ba2490ebbe6a4d41a0dfd111d6f6e4f0502d0e4bca0f23dace5
Instruction Fuzzy Hash: A8B1E47090060E8BDB24CF68C9916BEB7F6AF05308F14651ED752F72A1DB749D05CB51

Function 00F0A409 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F0282E: GetLastError.KERNEL32(?,?,00EF9D84,00F19F68,0000000C), ref: 00F02832
Part of subcall function 00F0282E: SetLastError.KERNEL32(00000000), ref: 00F028D4

EnumSystemLocalesW.KERNEL32(00F0A52F,00000001,00000000,?,-00000050,?,00F0AB60,00000000,?,?,?,00000055,?), ref: 00F0A47B

Memory Dump Source

Source File: 00000000.00000002.1851729503.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1851708778.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851767957.0000000000F11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F4F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851874526.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851899358.0000000000F68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851922106.0000000000F6A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_#U0415Sh#U0430rk.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 64f4422f4c753aa4c3583e67220e1a0a7d8661013a3a2cadd0dab9d476a4eb62
Instruction ID: da97566b686cc40d549d48ccb2d5d585f35536b07f5d94f24f892863a4b6be8c
Opcode Fuzzy Hash: 64f4422f4c753aa4c3583e67220e1a0a7d8661013a3a2cadd0dab9d476a4eb62
Instruction Fuzzy Hash: AB114C3F6003015FDB18DF38DC955BAB792FF80328B19442CE94687680E3B5B942E740

Function 00F0A9B1 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00F0282E: GetLastError.KERNEL32(?,?,00EF9D84,00F19F68,0000000C), ref: 00F02832
Part of subcall function 00F0282E: SetLastError.KERNEL32(00000000), ref: 00F028D4

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00F0A74B,00000000,00000000,?), ref: 00F0A9DD

Memory Dump Source

Source File: 00000000.00000002.1851729503.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1851708778.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851767957.0000000000F11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F4F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851874526.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851899358.0000000000F68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851922106.0000000000F6A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_#U0415Sh#U0430rk.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: e76b8ce9b09bd643cc014b4056968726b1fa4a14fe179d2aee96e77921066e1d
Instruction ID: 2bf8dac0d506acd7fd8c8cd9c0d594c0cbc76878617a1fee98659ad4c0a7a3fa
Opcode Fuzzy Hash: e76b8ce9b09bd643cc014b4056968726b1fa4a14fe179d2aee96e77921066e1d
Instruction Fuzzy Hash: 43F0F936F00311BBDB255664CD05BBB7754EB40364F054429EC06B31C0DA38FE41F5A1

Function 00F0A4A4 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F0282E: GetLastError.KERNEL32(?,?,00EF9D84,00F19F68,0000000C), ref: 00F02832
Part of subcall function 00F0282E: SetLastError.KERNEL32(00000000), ref: 00F028D4

EnumSystemLocalesW.KERNEL32(00F0A782,00000001,?,?,-00000050,?,00F0AB24,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 00F0A4EE

Memory Dump Source

Source File: 00000000.00000002.1851729503.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1851708778.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851767957.0000000000F11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F4F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851874526.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851899358.0000000000F68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851922106.0000000000F6A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_#U0415Sh#U0430rk.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 8c47005ddda4449b8597129889363c4ea52940cbfd1ba0828ac4cb53f5c5f4d6
Instruction ID: bca1aaff502932509d38ce50257aee4f67655aea1bcc7b504e84bc8b5f8dee7d
Opcode Fuzzy Hash: 8c47005ddda4449b8597129889363c4ea52940cbfd1ba0828ac4cb53f5c5f4d6
Instruction Fuzzy Hash: 70F0F63E7003045FDB249F399C86ABA7B91FF80368B05842DFA458B6E0D6B5AD41F650

Function 00F01A66 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 00EFC15D: EnterCriticalSection.KERNEL32(?,?,00F02506,?,00F1A2F8,00000008,00F026CA,?,?,?), ref: 00EFC16C

EnumSystemLocalesW.KERNEL32(Function_00011A59,00000001,00F1A298,0000000C,00F01E4C,?), ref: 00F01A9E

Memory Dump Source

Source File: 00000000.00000002.1851729503.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1851708778.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851767957.0000000000F11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F4F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851874526.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851899358.0000000000F68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851922106.0000000000F6A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_#U0415Sh#U0430rk.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 0404385da690c349295a894a328cdc384dc304d499cea5932cda908058cb63fb
Instruction ID: 787f0f4036f10d586d44c7d752bb3cd2791127de0929ec9ae92d4b60a4d33467
Opcode Fuzzy Hash: 0404385da690c349295a894a328cdc384dc304d499cea5932cda908058cb63fb
Instruction Fuzzy Hash: A5F04F32A01219DFDB04DF98D802B9D77F0FB09725F10811AF515DB2A1DBB55901EF41

Function 00F0A3BE Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F0282E: GetLastError.KERNEL32(?,?,00EF9D84,00F19F68,0000000C), ref: 00F02832
Part of subcall function 00F0282E: SetLastError.KERNEL32(00000000), ref: 00F028D4

EnumSystemLocalesW.KERNEL32(00F0A317,00000001,?,?,?,00F0AB82,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00F0A3F5

Memory Dump Source

Source File: 00000000.00000002.1851729503.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1851708778.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851767957.0000000000F11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F4F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851874526.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851899358.0000000000F68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851922106.0000000000F6A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_#U0415Sh#U0430rk.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 225e350ce6ddf1633fedbe380529e487c884475537b61901f918a2cf4253a53b
Instruction ID: e3c2fbb60526334767225fb062223743d47343fa032e1dc404320fb835c69aad
Opcode Fuzzy Hash: 225e350ce6ddf1633fedbe380529e487c884475537b61901f918a2cf4253a53b
Instruction Fuzzy Hash: 80F0553A70030557CB089F35DC09AAABF90EFC1720B0B8058EA058B690C776D842FB91

Function 00EF6120 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000612C,00EF532B), ref: 00EF6125

Memory Dump Source

Source File: 00000000.00000002.1851729503.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1851708778.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851767957.0000000000F11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F4F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851874526.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851899358.0000000000F68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851922106.0000000000F6A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_#U0415Sh#U0430rk.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 879cf1d3551b4c4aa2f5c414c18908966b55dee182c58658318c92213e33ab5e
Instruction ID: 8b9f38c158207b6b3d76a6d1b546e81010cc242c61736d1d6f1d3ce2d2e0ed94
Opcode Fuzzy Hash: 879cf1d3551b4c4aa2f5c414c18908966b55dee182c58658318c92213e33ab5e
Instruction Fuzzy Hash:

Function 00EF1D0A Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

Z81xbyuAua, xrefs: 00EF1E2C

Memory Dump Source

Source File: 00000000.00000002.1851729503.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1851708778.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851767957.0000000000F11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F4F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851874526.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851899358.0000000000F68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851922106.0000000000F6A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_#U0415Sh#U0430rk.jbxd

Yara matches

Similarity

API ID:
String ID: Z81xbyuAua
API String ID: 0-3121583705
Opcode ID: baf8b68282e2007f9fd17ea244361e92ee4fa203ab9196820350a067783ecc9c
Instruction ID: fb0c79bdcfc4548a16ad9afd68a4a33e898f63950a2d309b1cd41b722ede2a81
Opcode Fuzzy Hash: baf8b68282e2007f9fd17ea244361e92ee4fa203ab9196820350a067783ecc9c
Instruction Fuzzy Hash: 21410B76E1052F8BDB4CEEB8C8560BEBBB5EB46354B045279DE11EB3D1E2348A0187D0

Function 00F0ACE2 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00F0ACE2

Memory Dump Source

Source File: 00000000.00000002.1851729503.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1851708778.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851767957.0000000000F11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F4F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851874526.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851899358.0000000000F68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851922106.0000000000F6A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_#U0415Sh#U0430rk.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 0da5a6dc56893ac1e23787e8fe0126b55b3a3190b022218f79653502a0650230
Instruction ID: f945b60f70dd2f3eb24b2a86d02a219e8a272d138f305c0945b554a6329814fe
Opcode Fuzzy Hash: 0da5a6dc56893ac1e23787e8fe0126b55b3a3190b022218f79653502a0650230
Instruction Fuzzy Hash: 58A02230303208CF83A08F30AF0838C3AECFB28AC0302802CE208C0830EF308020BB02

Function 00F02B5D Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1851729503.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1851708778.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851767957.0000000000F11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F4F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851874526.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851899358.0000000000F68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851922106.0000000000F6A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_#U0415Sh#U0430rk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49dd7c0d121006efe31c3cd602c915a0361a8b0e70717307f03d36f8c7cad8ac
Instruction ID: accf0ccb7c5e5beaf5320f30bfd7e02109f8abf8ce1395ad0f60feaa1d1ebcd3
Opcode Fuzzy Hash: 49dd7c0d121006efe31c3cd602c915a0361a8b0e70717307f03d36f8c7cad8ac
Instruction Fuzzy Hash: 45E08C72911628EBCB24DFC8D90898AF3ECFB84B60B114196B505D3240C274DE00EBE0

Function 00EFF4C6 Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1851729503.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1851708778.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851767957.0000000000F11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F4F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851874526.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851899358.0000000000F68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851922106.0000000000F6A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_#U0415Sh#U0430rk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b479a11ccc6c2eceaea55d319ac4cd762b21b8c39f808f14f8525f6a159b148
Instruction ID: 48681ecc8c75b67f531567ff70ac0b3248aef8cd6fe5e2229bc605782cc236ca
Opcode Fuzzy Hash: 5b479a11ccc6c2eceaea55d319ac4cd762b21b8c39f808f14f8525f6a159b148
Instruction Fuzzy Hash: BEC08C3400090947CF39CF1082713B63354ABD2F86F8024DCC6228BA82C91E9C86EA10

Function 00EF516A Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 19
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00EF5170
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 00EF517E
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 00EF518F
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 00EF51A0

Strings

GetCurrentPackageId, xrefs: 00EF5178
GetSystemTimePreciseAsFileTime, xrefs: 00EF5184
GetTempPath2W, xrefs: 00EF5195
kernel32.dll, xrefs: 00EF516B

Memory Dump Source

Source File: 00000000.00000002.1851729503.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1851708778.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851767957.0000000000F11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F4F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851874526.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851899358.0000000000F68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851922106.0000000000F6A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_#U0415Sh#U0430rk.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: GetCurrentPackageId$GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1247241052
Opcode ID: 6feaf51ffde6f625d72bb2ee32992f54a97cbe8a8ec5be7814cddd2b9ba75143
Instruction ID: 87d4c0a8e50655212bcf7632f608f95d33bb847250326d6c24795b27ab4c94e2
Opcode Fuzzy Hash: 6feaf51ffde6f625d72bb2ee32992f54a97cbe8a8ec5be7814cddd2b9ba75143
Instruction Fuzzy Hash: 25E0EC71D89358BB8354EFB2BC0D9D57AB8FB497453028156FB01E226CD6B08490FF92

Function 00EF86D0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_ValidateLocalCookies.LIBCMT ref: 00EF8707
___except_validate_context_record.LIBVCRUNTIME ref: 00EF870F
_ValidateLocalCookies.LIBCMT ref: 00EF8798
__IsNonwritableInCurrentImage.LIBCMT ref: 00EF87C3
_ValidateLocalCookies.LIBCMT ref: 00EF8818

Strings

csm, xrefs: 00EF87AD
4=, xrefs: 00EF87DC

Memory Dump Source

Source File: 00000000.00000002.1851729503.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1851708778.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851767957.0000000000F11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F4F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851874526.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851899358.0000000000F68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851922106.0000000000F6A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_#U0415Sh#U0430rk.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: 4=$csm
API String ID: 1170836740-626813096
Opcode ID: 4918b25bca99de7a10737b3b0e70a7abb9bd227f8015a1823698957b784d2953
Instruction ID: a7cef2b8624ee20c7c49f8965fb4fe4b7fa0a36eeb48140de07f84a1c2ea6cbc
Opcode Fuzzy Hash: 4918b25bca99de7a10737b3b0e70a7abb9bd227f8015a1823698957b784d2953
Instruction Fuzzy Hash: D841B534A0020CDBCF10EF69C984BAE7BE4AF05318F149156EA14BB392DB31D911CB91

Function 00EF35FC Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 00EF3603
std::_Lockit::_Lockit.LIBCPMT ref: 00EF360D
int.LIBCPMT ref: 00EF3624

Part of subcall function 00EF166A: std::_Lockit::_Lockit.LIBCPMT ref: 00EF167B
Part of subcall function 00EF166A: std::_Lockit::~_Lockit.LIBCPMT ref: 00EF1695

std::_Facet_Register.LIBCPMT ref: 00EF365E
std::_Lockit::~_Lockit.LIBCPMT ref: 00EF367E
Concurrency::cancel_current_task.LIBCPMT ref: 00EF368B

Strings

4=, xrefs: 00EF366B

Memory Dump Source

Source File: 00000000.00000002.1851729503.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1851708778.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851767957.0000000000F11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F4F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851874526.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851899358.0000000000F68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851922106.0000000000F6A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_#U0415Sh#U0430rk.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID: 4=
API String ID: 55977855-3841008636
Opcode ID: de0f13f9a41ba857458008567bd39f792144e79ca9a3dd0f607860eb1dd4c3cc
Instruction ID: 9ae3c9b0f0ce852dfc9be7d25d29860975bc93bb562847735269d87422b2936a
Opcode Fuzzy Hash: de0f13f9a41ba857458008567bd39f792144e79ca9a3dd0f607860eb1dd4c3cc
Instruction Fuzzy Hash: C211DF7190021D9BCB00EB74C8456BEB7E4EF54724F61544AEA02B7292DFB09E00DB91

Function 00EF8C38 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 303
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

type_info::operator==.LIBVCRUNTIME ref: 00EF8D57
___TypeMatch.LIBVCRUNTIME ref: 00EF8E65
CallUnexpected.LIBVCRUNTIME ref: 00EF8FD2

Strings

csm, xrefs: 00EF8D8E
csm, xrefs: 00EF8C75
csm, xrefs: 00EF8CE2

Memory Dump Source

Source File: 00000000.00000002.1851729503.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1851708778.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851767957.0000000000F11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F4F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851874526.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851899358.0000000000F68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851922106.0000000000F6A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_#U0415Sh#U0430rk.jbxd

Yara matches

Similarity

API ID: CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 1206542248-393685449
Opcode ID: 8e28da327c8ca2a0bb8358f4ced0d7fbdb60ea293eeb195e6291c0b4aaf5c50f
Instruction ID: c18409249bf86d6b7ee6ab8eeecad5e6eb1eb5de4169ed31c636401903b29724
Opcode Fuzzy Hash: 8e28da327c8ca2a0bb8358f4ced0d7fbdb60ea293eeb195e6291c0b4aaf5c50f
Instruction Fuzzy Hash: B7B18B3290020DEFCF18DFA4CA819BEBBB6FF54314B54615AEA107B242DB31DA51CB91

Function 00EF32C5 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 00EF32CC
std::_Lockit::_Lockit.LIBCPMT ref: 00EF32D7
std::locale::_Setgloballocale.LIBCPMT ref: 00EF32F2
_Yarn.LIBCPMT ref: 00EF3308
std::_Lockit::~_Lockit.LIBCPMT ref: 00EF3345

Strings

4=, xrefs: 00EF3314, 00EF3338

Memory Dump Source

Source File: 00000000.00000002.1851729503.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1851708778.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851767957.0000000000F11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F4F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851874526.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851899358.0000000000F68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851922106.0000000000F6A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_#U0415Sh#U0430rk.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$H_prolog3Lockit::_Lockit::~_SetgloballocaleYarnstd::locale::_
String ID: 4=
API String ID: 156189095-3841008636
Opcode ID: 696c7f5fdeb7ad9c388220a672ed332e9642519763ae4badf9b22d1655d8a181
Instruction ID: ed36fa81d476e511a364f087e5895bff5453952f0bc442d0606ea17cc7ed6585
Opcode Fuzzy Hash: 696c7f5fdeb7ad9c388220a672ed332e9642519763ae4badf9b22d1655d8a181
Instruction Fuzzy Hash: 77018B75A00218ABCB06FB70D8459BC7BA1FF85750B155009EB2177391CF74AE42EBD2

Function 00EFF4E8 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 42
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,4665E89B,?,?,00000000,00F1060C,000000FF,?,00EFF478,00000002,?,00EFF44C,00EFC216), ref: 00EFF51D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00EFF52F
FreeLibrary.KERNEL32(00000000,?,?,00000000,00F1060C,000000FF,?,00EFF478,00000002,?,00EFF44C,00EFC216), ref: 00EFF551

Strings

CorExitProcess, xrefs: 00EFF527
mscoree.dll, xrefs: 00EFF516
4=, xrefs: 00EFF540

Memory Dump Source

Source File: 00000000.00000002.1851729503.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1851708778.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851767957.0000000000F11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F4F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851874526.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851899358.0000000000F68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851922106.0000000000F6A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_#U0415Sh#U0430rk.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: 4=$CorExitProcess$mscoree.dll
API String ID: 4061214504-2204432520
Opcode ID: 0fc35889da040a1c439048bd57a8ce81190d5e2339aada3e07fe6542eff529ef
Instruction ID: 7b138800ff4c6e75fc131af163bd666b9fdfc4774487931f02b6f5601d47c41b
Opcode Fuzzy Hash: 0fc35889da040a1c439048bd57a8ce81190d5e2339aada3e07fe6542eff529ef
Instruction Fuzzy Hash: F701A23194065DBBCB128F50CC09BFEBBB8FB48B15F014225E911F2290DB749A80DA44

Function 00F0D3ED Relevance: 9.3, APIs: 6, Instructions: 298
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1851729503.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1851708778.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851767957.0000000000F11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F4F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851874526.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851899358.0000000000F68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851922106.0000000000F6A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_#U0415Sh#U0430rk.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c54f47052f732cad32137986723a46972da6a0a1e3cf2698ad8b66a3a4c721e5
Instruction ID: c496016536f3005d65f2891bd07591754c5bf049f9d2608e2824da06c6654d85
Opcode Fuzzy Hash: c54f47052f732cad32137986723a46972da6a0a1e3cf2698ad8b66a3a4c721e5
Instruction Fuzzy Hash: 84B1EE75E00249AFDB11DFD8C980BBEBBB5AF89310F244159E514AB3D2CB719942FB60

Function 00EF88CA Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00EF88C1,00EF6E81,00EF6170), ref: 00EF88D8
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00EF88E6
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00EF88FF
SetLastError.KERNEL32(00000000,00EF88C1,00EF6E81,00EF6170), ref: 00EF8951

Memory Dump Source

Source File: 00000000.00000002.1851729503.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1851708778.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851767957.0000000000F11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F4F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851874526.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851899358.0000000000F68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851922106.0000000000F6A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_#U0415Sh#U0430rk.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 691fbc5373dd74d8642f203f69f83f923553a687dc1f558d4652aee22e480bdc
Instruction ID: 503134ebbf02b87daae4e90eb272014a3c53dbb99586ee14299ece3b71a59b81
Opcode Fuzzy Hash: 691fbc5373dd74d8642f203f69f83f923553a687dc1f558d4652aee22e480bdc
Instruction Fuzzy Hash: 9C01D83260D21EEFA6291B757D85ABB37C4EB89779321622EF328751F1FF914C00A185

Function 00EF89E1 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00EF8AA8
___AdjustPointer.LIBCMT ref: 00EF8ACB
___AdjustPointer.LIBCMT ref: 00EF8B67

Strings

4=, xrefs: 00EF8A40

Memory Dump Source

Source File: 00000000.00000002.1851729503.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1851708778.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851767957.0000000000F11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F4F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851874526.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851899358.0000000000F68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851922106.0000000000F6A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_#U0415Sh#U0430rk.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID: 4=
API String ID: 1740715915-3841008636
Opcode ID: 402b82a36376d6aae58fb867c1c94b87c50c2ffebf85c81af3db849570a660eb
Instruction ID: ca9c33abb2d50cf9dbf38151e89597d9fe00c572ba7d1bb264747a299fcb899c
Opcode Fuzzy Hash: 402b82a36376d6aae58fb867c1c94b87c50c2ffebf85c81af3db849570a660eb
Instruction Fuzzy Hash: 2E5106B6601A0EAFDB288F10CA41BBA77A4FF44318F14512EEA057B191EB31ED41C790

Function 00EF4FC5 Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00EF4FD9
AcquireSRWLockExclusive.KERNEL32(?), ref: 00EF4FF8
AcquireSRWLockExclusive.KERNEL32(?), ref: 00EF5026
TryAcquireSRWLockExclusive.KERNEL32(?), ref: 00EF5081
TryAcquireSRWLockExclusive.KERNEL32(?), ref: 00EF5098

Memory Dump Source

Source File: 00000000.00000002.1851729503.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1851708778.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851767957.0000000000F11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F4F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851874526.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851899358.0000000000F68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851922106.0000000000F6A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_#U0415Sh#U0430rk.jbxd

Yara matches

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: 158885312392e3b401c7e379f2ef217fa712413de4e69401d66af04ecf3fa304
Instruction ID: 7155bf79a26a1293e92ea84b216954804295545be72420771237211af8b10a86
Opcode Fuzzy Hash: 158885312392e3b401c7e379f2ef217fa712413de4e69401d66af04ecf3fa304
Instruction Fuzzy Hash: 87412C32900A0EDFCB20DF65C4809BAB3F5FF28315B60992AD756E7640DB30E985DB91

Function 00EF2A9F Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00EF2AAB
int.LIBCPMT ref: 00EF2ABE

Part of subcall function 00EF166A: std::_Lockit::_Lockit.LIBCPMT ref: 00EF167B
Part of subcall function 00EF166A: std::_Lockit::~_Lockit.LIBCPMT ref: 00EF1695

std::_Facet_Register.LIBCPMT ref: 00EF2AF1
std::_Lockit::~_Lockit.LIBCPMT ref: 00EF2B07
Concurrency::cancel_current_task.LIBCPMT ref: 00EF2B12

Memory Dump Source

Source File: 00000000.00000002.1851729503.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1851708778.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851767957.0000000000F11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F4F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851874526.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851899358.0000000000F68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851922106.0000000000F6A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_#U0415Sh#U0430rk.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 6ce4f43dc2bc5bc23cf6bfdd7514e927bb8f36e3bf4f0ada3429e8621402be85
Instruction ID: 9cb2d0232297786696a955b1ef45f2f3220d1510ea716c338c6a96b19dfc2537
Opcode Fuzzy Hash: 6ce4f43dc2bc5bc23cf6bfdd7514e927bb8f36e3bf4f0ada3429e8621402be85
Instruction Fuzzy Hash: 5201A77290011CEBCB15AF64D8059FD77A8EF807A4B24165DFB11BB291EF70AE01D791

Function 00EF4C78 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33threadCOMMON

Download Yara Rule

APIs

WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,00000000,?,?,00EF2152,?,?,00000000), ref: 00EF4C84
GetExitCodeThread.KERNEL32(?,00000000,?,?,00EF2152,?,?,00000000), ref: 00EF4C9D
CloseHandle.KERNEL32(?,?,?,00EF2152,?,?,00000000), ref: 00EF4CAF

Strings

R!, xrefs: 00EF4C8F

Memory Dump Source

Source File: 00000000.00000002.1851729503.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1851708778.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851767957.0000000000F11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F4F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851874526.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851899358.0000000000F68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851922106.0000000000F6A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_#U0415Sh#U0430rk.jbxd

Yara matches

Similarity

API ID: CloseCodeExitHandleObjectSingleThreadWait
String ID: R!
API String ID: 2551024706-3897313590
Opcode ID: 791325041196ef8296e8884e08c3e613c37a856c87803ac2d5f7a501f8956328
Instruction ID: 4b95af594b197b9f73f030efd2e2c7e7cc0b2c631748df7ca8cb611591b27d0b
Opcode Fuzzy Hash: 791325041196ef8296e8884e08c3e613c37a856c87803ac2d5f7a501f8956328
Instruction Fuzzy Hash: 0CF05E7290115CABEB108F64DC05FAA7FA8EB05774F295714FB25E62E0D730DE81AA80

Function 00EF9A12 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000011,00000000,00000800,?,00EF99C3,00000000,00000001,00F67EE4,?,?,?,00EF9B66,00000004,InitializeCriticalSectionEx,00F12C58,InitializeCriticalSectionEx), ref: 00EF9A1F
GetLastError.KERNEL32(?,00EF99C3,00000000,00000001,00F67EE4,?,?,?,00EF9B66,00000004,InitializeCriticalSectionEx,00F12C58,InitializeCriticalSectionEx,00000000,?,00EF991D), ref: 00EF9A29
LoadLibraryExW.KERNEL32(00000011,00000000,00000000,?,00000011,00EF8833), ref: 00EF9A51

Strings

api-ms-, xrefs: 00EF9A36

Memory Dump Source

Source File: 00000000.00000002.1851729503.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1851708778.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851767957.0000000000F11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F4F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851874526.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851899358.0000000000F68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851922106.0000000000F6A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_#U0415Sh#U0430rk.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 5bf23b9a754d9460d5ea546a56fcc8e06dff6e46fdf1a90ea442a6d8d8004d6a
Instruction ID: 8f55358b9f0c61919dbe48b13e859d8324db4036dadb7d0b3f60274087ecf475
Opcode Fuzzy Hash: 5bf23b9a754d9460d5ea546a56fcc8e06dff6e46fdf1a90ea442a6d8d8004d6a
Instruction Fuzzy Hash: 33E04F3078020CBBEF205FA0EC06FA93F55AB40B55F509021FB4DB84E2DB61DAD4B685

Function 00F05131 Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(4665E89B,00000000,00000000,00000000), ref: 00F05194

Part of subcall function 00F075F2: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00F069BD,?,00000000,-00000008), ref: 00F0769E

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00F053EF
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00F05437
GetLastError.KERNEL32 ref: 00F054DA

Memory Dump Source

Source File: 00000000.00000002.1851729503.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1851708778.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851767957.0000000000F11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F4F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851874526.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851899358.0000000000F68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851922106.0000000000F6A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_#U0415Sh#U0430rk.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: e0f76e0178df991059bad58ad2b76ff9ad5e1e41b333a7efed82e42883ebbf0b
Instruction ID: 7d07ea55d1458763726f9fb12771bd77303dc1b9c842178508fba11114d2d2c9
Opcode Fuzzy Hash: e0f76e0178df991059bad58ad2b76ff9ad5e1e41b333a7efed82e42883ebbf0b
Instruction Fuzzy Hash: 12D17B79D046589FCF11CFA8C890AEEBBB5FF48710F18812AE955E7291D770A842EF50

Function 00F0ED0F Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,00000000,?,00F0D7AA,00000000,00000001,00000000,00000000,?,00F0552E,00000000,00000000,00000000), ref: 00F0ED26
GetLastError.KERNEL32(?,00F0D7AA,00000000,00000001,00000000,00000000,?,00F0552E,00000000,00000000,00000000,00000000,00000000,?,00F05AB5,?), ref: 00F0ED32

Part of subcall function 00F0ECF8: CloseHandle.KERNEL32(FFFFFFFE,00F0ED42,?,00F0D7AA,00000000,00000001,00000000,00000000,?,00F0552E,00000000,00000000,00000000,00000000,00000000), ref: 00F0ED08

___initconout.LIBCMT ref: 00F0ED42

Part of subcall function 00F0ECBA: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00F0ECE9,00F0D797,00000000,?,00F0552E,00000000,00000000,00000000,00000000), ref: 00F0ECCD

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,?,00F0D7AA,00000000,00000001,00000000,00000000,?,00F0552E,00000000,00000000,00000000,00000000), ref: 00F0ED57

Memory Dump Source

Source File: 00000000.00000002.1851729503.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1851708778.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851767957.0000000000F11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F4F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851874526.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851899358.0000000000F68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851922106.0000000000F6A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_#U0415Sh#U0430rk.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 7a103a7f205f598900f3ff6f0f8dc111ba027df1d1724c82a4794ffbfc945c9f
Instruction ID: 8efa11e559ccb6fc050661734e6623063cca0cfa3ad6ed1b51f61ed2e7271a4e
Opcode Fuzzy Hash: 7a103a7f205f598900f3ff6f0f8dc111ba027df1d1724c82a4794ffbfc945c9f
Instruction Fuzzy Hash: 5AF0AC3690516CBBCF225FA5EC149DA3F26FB483B1B058411FE1D95571D73289A0FB90

Function 00EF40EE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

_Fputc.LIBCPMT ref: 00EF41C7

Strings

4=, xrefs: 00EF41A6

Memory Dump Source

Source File: 00000000.00000002.1851729503.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1851708778.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851767957.0000000000F11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F4F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851874526.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851899358.0000000000F68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851922106.0000000000F6A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_#U0415Sh#U0430rk.jbxd

Yara matches

Similarity

API ID: Fputc
String ID: 4=
API String ID: 3078413507-3841008636
Opcode ID: c1e3ba98148bfb4bc3df4c951b093ed31ed5fbf9a394afc828d277beb973b4a8
Instruction ID: d413f5432f6f4423c0164511d3aa5604bca60bb3a7c05b8adc8c696bd407fa9a
Opcode Fuzzy Hash: c1e3ba98148bfb4bc3df4c951b093ed31ed5fbf9a394afc828d277beb973b4a8
Instruction Fuzzy Hash: E3418EB290161EABCB14DF64C8808FFB7B9FF58354B141116E602B7691DB31EE95CB90

Function 00EF8FDD Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 00EF9002

Strings

RCC, xrefs: 00EF901C
MOC, xrefs: 00EF9014

Memory Dump Source

Source File: 00000000.00000002.1851729503.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1851708778.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851767957.0000000000F11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F4F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851874526.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851899358.0000000000F68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851922106.0000000000F6A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_#U0415Sh#U0430rk.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 216d046ef38989e38a077aaea7e2d8b664da288274328c36fd9ef7bc5df11b0e
Instruction ID: 2e6536731a177333cfb0e469d0a3cac9efec86e4d9836c032be8d960e9d0c298
Opcode Fuzzy Hash: 216d046ef38989e38a077aaea7e2d8b664da288274328c36fd9ef7bc5df11b0e
Instruction Fuzzy Hash: B341677190020DAFCF16DF98C981AEEBBB5FF48308F159099FA4477222D7359A50DB50

Function 00EF3352 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00EF335E
std::_Lockit::~_Lockit.LIBCPMT ref: 00EF33BA

Strings

4=, xrefs: 00EF3385, 00EF339F

Memory Dump Source

Source File: 00000000.00000002.1851729503.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1851708778.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851767957.0000000000F11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F4F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851874526.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851899358.0000000000F68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851922106.0000000000F6A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_#U0415Sh#U0430rk.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID: 4=
API String ID: 593203224-3841008636
Opcode ID: 2f8982060eec06d99f0037c0b8685813a15743eb9c77b3c5fee57d34f2e07578
Instruction ID: 6acf7f8e59d5fe137f49e98a4563cef68ac86b229d82448dd771c1575c090635
Opcode Fuzzy Hash: 2f8982060eec06d99f0037c0b8685813a15743eb9c77b3c5fee57d34f2e07578
Instruction Fuzzy Hash: CF019E35600218AFCF01DB25C899EAD77B8EF84764B154099EA01AB371DF70EE45CB50

Function 00EF1595 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00EF159C
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00EF15D4

Part of subcall function 00EF33C3: _Yarn.LIBCPMT ref: 00EF33E2
Part of subcall function 00EF33C3: _Yarn.LIBCPMT ref: 00EF3406

Strings

bad locale name, xrefs: 00EF15E2

Memory Dump Source

Source File: 00000000.00000002.1851729503.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1851708778.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851767957.0000000000F11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F4F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851874526.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851899358.0000000000F68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851922106.0000000000F6A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_#U0415Sh#U0430rk.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: d74d46b059d466f5fdfb470f18769ff8b36087bfc0cb5a5abe4fd8df1f303f24
Instruction ID: 80c3f307dcbaa21121eb13f82482350ac0047ce2f1a6b0fe11d19c931af37f1f
Opcode Fuzzy Hash: d74d46b059d466f5fdfb470f18769ff8b36087bfc0cb5a5abe4fd8df1f303f24
Instruction Fuzzy Hash: 1EF03071506B849E83319F7A8481457FBE4BE28310390DE6FE1DED3A11D734E504CB6A

Function 00F01FCE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?), ref: 00F0200E

Strings

InitializeCriticalSectionEx, xrefs: 00F01FDE
4=, xrefs: 00F01FFE

Memory Dump Source

Source File: 00000000.00000002.1851729503.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1851708778.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851767957.0000000000F11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F4F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851874526.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851899358.0000000000F68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851922106.0000000000F6A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_#U0415Sh#U0430rk.jbxd

Yara matches

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: 4=$InitializeCriticalSectionEx
API String ID: 2593887523-2328451367
Opcode ID: 8d9d77248638855e74c39d33f7fa23141c5853a520c5c06880c8ed88f36d457d
Instruction ID: 5c5f9e48b81f3d554a273d62335a781891551ac8a26377bc02ca4e93f5bc3844
Opcode Fuzzy Hash: 8d9d77248638855e74c39d33f7fa23141c5853a520c5c06880c8ed88f36d457d
Instruction Fuzzy Hash: 00E0123668025CB7CB111F51DC09EDE7F15FB44771F058011FE19651A0C672D9A1FAD1

Function 00F01E51 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 00F01E85

Strings

FlsAlloc, xrefs: 00F01E61
4=, xrefs: 00F01E7B

Memory Dump Source

Source File: 00000000.00000002.1851729503.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1851708778.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851767957.0000000000F11000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F1B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F4F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851791281.0000000000F5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851874526.0000000000F66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851899358.0000000000F68000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1851922106.0000000000F6A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_#U0415Sh#U0430rk.jbxd

Yara matches

Similarity

API ID: Alloc
String ID: 4=$FlsAlloc
API String ID: 2773662609-1020339419
Opcode ID: 604425680c0096b603824ddabd2b740acd5379bb841d06a15e97a064a6e553e7
Instruction ID: 927b43489756514a168718c79ef218f7b634133bf7ef373ce0384e228d825bf2
Opcode Fuzzy Hash: 604425680c0096b603824ddabd2b740acd5379bb841d06a15e97a064a6e553e7
Instruction Fuzzy Hash: 22E0C236A8026877C62023A19C0A9DFBE18EF80B70B464120FF09662D1DAA19891B6D2

Analysis Process: MSBuild.exePID: 7356, Parent PID: 7304COMMON

Execution Graph

Execution Coverage:	7.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	38
Total number of Limit Nodes:	7

Executed Functions

Function 0102D0A8 Relevance: 6.1, APIs: 4, Instructions: 131
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0102D136
GetCurrentThread.KERNEL32 ref: 0102D173
GetCurrentProcess.KERNEL32 ref: 0102D1B0
GetCurrentThreadId.KERNEL32 ref: 0102D209

Memory Dump Source

Source File: 00000001.00000002.1785920409.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1020000_MSBuild.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: cd7f27cc11247d7dfec0e9ba4819ae99c2d7a2e0d7e02954b76bd32dead95b1a
Instruction ID: 3aeb88d6dc82c8ede31d2de7670f0f1bb629ce0a30220ea20b629744a9f7d95f
Opcode Fuzzy Hash: cd7f27cc11247d7dfec0e9ba4819ae99c2d7a2e0d7e02954b76bd32dead95b1a
Instruction Fuzzy Hash: DB5165B09002499FDB44DFAADA48BDEBBF1AF88304F208459E059A73A0D7349984CF65

Function 0102D0B8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0102D136
GetCurrentThread.KERNEL32 ref: 0102D173
GetCurrentProcess.KERNEL32 ref: 0102D1B0
GetCurrentThreadId.KERNEL32 ref: 0102D209

Memory Dump Source

Source File: 00000001.00000002.1785920409.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1020000_MSBuild.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 8bb2fff02eadf337e00f7cd086ac18e42e50f7075f11b7e011e0a9e5e984690c
Instruction ID: 4ada04f0c77b28620340852759db3e9befbc38fc2dd173c42f674198111f15b5
Opcode Fuzzy Hash: 8bb2fff02eadf337e00f7cd086ac18e42e50f7075f11b7e011e0a9e5e984690c
Instruction Fuzzy Hash: AC5157B09002099FDB54DFAAD948BDEBBF1EF88314F208459E059A73A0D7349984CF65

Function 0102AE30 Relevance: 1.7, APIs: 1, Instructions: 196
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0102B086

Memory Dump Source

Source File: 00000001.00000002.1785920409.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1020000_MSBuild.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: bb061ee6c70c6d7197c13860ddebce269ebf5c9cb4ff3a0b4b9393eb28d92250
Instruction ID: 9f120f1d977eeab50222d9cac045d62a626e06c173a1aca5967cefd314d4fa8d
Opcode Fuzzy Hash: bb061ee6c70c6d7197c13860ddebce269ebf5c9cb4ff3a0b4b9393eb28d92250
Instruction Fuzzy Hash: F87134B0A00B15CFDB64DF6AC54079ABBF5BF88304F00896DD48AD7A51DB79E849CB90

Function 01025935 Relevance: 1.6, APIs: 1, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 010259F1

Memory Dump Source

Source File: 00000001.00000002.1785920409.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1020000_MSBuild.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: d657f5e7e67d4321c8313242c26b69482d4d9c4d227c16476b27db072211489a
Instruction ID: d6d65585fb9fb45cc54e38596cb7ebce28687e0b051843528d0199fa8ce58c32
Opcode Fuzzy Hash: d657f5e7e67d4321c8313242c26b69482d4d9c4d227c16476b27db072211489a
Instruction Fuzzy Hash: 3B41E2B0C00329CBDB24DFA9C884BCDBBB5BF49314F2480AAD448AB255DB756985CF91

Function 01024248 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 010259F1

Memory Dump Source

Source File: 00000001.00000002.1785920409.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1020000_MSBuild.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 9d213215f774fb9bd6bec8bf65ee0c53e2de833dcf284f1ec7a912e88d23d419
Instruction ID: 852ec6b97e9988416c6f47c3766c1a02781ac5f44632fa21c02193e73ecd2577
Opcode Fuzzy Hash: 9d213215f774fb9bd6bec8bf65ee0c53e2de833dcf284f1ec7a912e88d23d419
Instruction Fuzzy Hash: D74102B0C00329CADB24DFAAC844BDEBBF5FF48314F20806AD448AB251DB756945CF90

Function 0102D300 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0102D387

Memory Dump Source

Source File: 00000001.00000002.1785920409.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1020000_MSBuild.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: bced78d2ca0b878231414ee4e815e0e837ae4ba0652a84e31b8d8e50e3085617
Instruction ID: 7d758a13569fc4ed266d0b2aa86696f327dc46192af5d9a3f5eb4d6a542f5a50
Opcode Fuzzy Hash: bced78d2ca0b878231414ee4e815e0e837ae4ba0652a84e31b8d8e50e3085617
Instruction Fuzzy Hash: 6B21E4B59002189FDB10CF9AD584ADEBFF4FB48310F14801AE958A3310D374A940CFA5

Function 0102D2F9 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0102D387

Memory Dump Source

Source File: 00000001.00000002.1785920409.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1020000_MSBuild.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 28bd94dbe6108b16937559248105e087ba3d0df8b2f95632f5664052c5a99ad8
Instruction ID: b6acfb7662d31bdf27af011f424f10e51c6c4ca0d68eb62c708eeceab392205c
Opcode Fuzzy Hash: 28bd94dbe6108b16937559248105e087ba3d0df8b2f95632f5664052c5a99ad8
Instruction Fuzzy Hash: 0A21E0B5900219DFDB10CFAAD585ADEBBF4EB48310F24842AE958A7210D378A944CFA1

Function 0102B020 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0102B086

Memory Dump Source

Source File: 00000001.00000002.1785920409.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1020000_MSBuild.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 503a4851e8f2ccf62c658b141bbc9860b575e3c107aed251e8b0b6c3f966c0aa
Instruction ID: 0dd26303ea40ed7583005fd3212cc089728e9dd5058d2ebd70d89d4b0cb094c0
Opcode Fuzzy Hash: 503a4851e8f2ccf62c658b141bbc9860b575e3c107aed251e8b0b6c3f966c0aa
Instruction Fuzzy Hash: D3110FB5C003598FDB20DF9AC444ADEFBF4AB88220F10846AD4A8A7210C379A545CFA5

Function 00FBD4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1785480277.0000000000FBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fbd000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae450dddf68ffe2e08e7ce8206b588b503aeff94f0f7d4e9fac071cbf17444e4
Instruction ID: e18a193b1e7a7b421e676dac51a8c8e3623d8c4f130335b20c0b2f3a40f4d55d
Opcode Fuzzy Hash: ae450dddf68ffe2e08e7ce8206b588b503aeff94f0f7d4e9fac071cbf17444e4
Instruction Fuzzy Hash: F9214572900200DFCB15DF14C9C0B66BF65FB98328F28C169E8090B256D336D846EEA2

Function 00FCD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1785525479.0000000000FCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fcd000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8cc004b166feafd32555033890b35d5c3add8b4e5d32f5c5a4b89971bb1c34e
Instruction ID: 9c403de741f4c9494a42032edf58a6befa7c87a85cc01fbfdad5cdd4f3f77153
Opcode Fuzzy Hash: d8cc004b166feafd32555033890b35d5c3add8b4e5d32f5c5a4b89971bb1c34e
Instruction Fuzzy Hash: E421F571584201DFCB14DF18D6C5F1ABBA5FB84324F20C57DD84A4B25AC336D847DA61

Function 00FCD005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1785525479.0000000000FCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fcd000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92747110116f4c55f311046300e42c842ef0c55a4bdcf0ffb022eddf3cbbb537
Instruction ID: f9f98cf71fcb3facc7558f3d05d768d3e324d6d7ec3659c08fe4b35d60d69240
Opcode Fuzzy Hash: 92747110116f4c55f311046300e42c842ef0c55a4bdcf0ffb022eddf3cbbb537
Instruction Fuzzy Hash: 662183755493808FD702CF24D594B15BF71EB46314F28C5EED8498F6A7C33A980ACB62

Function 00FBD4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1785480277.0000000000FBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fbd000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 3f09e9e397843732563c07f2d5419ebd0f12b85bb912549c4f721de356fb7245
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: D411D676904240CFCB15CF14D5C4B56BF71FB94328F28C5A9D8450B656C336D456DFA2

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
185.196.9.26	GX9zyKVNXR.exe	Get hash	malicious	RedLine	Browse
	Lys2hJAvd1.exe	Get hash	malicious	RedLine	Browse
	JfvFiUr0DO.exe	Get hash	malicious	RedLine	Browse
	gLKtR4HuEw.exe	Get hash	malicious	RedLine	Browse
	injector V2.5.exe	Get hash	malicious	RedLine	Browse
	Jeverly.exe	Get hash	malicious	RedLine	Browse
	by_execute.exe	Get hash	malicious	RedLine	Browse
	Shark#U041ePShC.exe	Get hash	malicious	RedLine	Browse
	GipsonyVelo.exe	Get hash	malicious	RedLine	Browse
	sRMytgfRpJ.exe	Get hash	malicious	RedLine	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	Compliance_Report_Final_Q3_8c3f5541a91374b5bf18ac88017a597742a1891a.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	https://60ms64xz.r.eu-west-1.awstrack.me/L0/https:%2F%2Fnym1-ib.adnxs.com%2Fclick2%3Fe=wqT_3QKhAfCBoQAAAAMAxBkFAQj1xf22BhCN5rHDq8rIsXYY6OvVqs3R1c9aIPXtswsoykEwhx04AkDV-qXwAUiY1VJQAFoDVVNEYgNVU0RorAJw-gF4kfdrgAG5zAOIAQGQAQGYAQWgAQKpAVM7_DVZo44_sQHWE0zrJXyFP7kBAAAAwMzM7D_BAREUDMkBUDsJKDDYAQDgAQDwAdEO-AEA%2Fs=555aa6e5683ce51c048a98b83e6a923b5a8d9a2c%2Fbcr=AAAAAAAA8D8=%2Fcnd=%25218hVjbgiv18IdENX6pfABGJjVUiAAKAAxmpmZmZmZuT86CU5ZTTI6NTI1NECoR0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca=MzcxOSNOWU0yOjUyNTQ=%2Fbn=58937%2Fclickenc=http%253A%252F%252Faa.ns.agingbydesignministry.org%3FMlcinsurance=grant.harpur@mlcinsurance.com.au/1/0102019284444055-c8ec5399-450a-413f-acab-546e07ef32e7-000000/Qxx4uNY6H1RoEfFUkvzFba2SPik=395	Get hash	malicious	Unknown	Browse	13.107.246.45
	http://chwcs91azo1jf8f6b6acu6sf7da7lxazxwg6fo8epa.sbxaccountants.com.au/	Get hash	malicious	Captcha Phish	Browse	13.107.246.45
	SecuriteInfo.com.Riskware.Application.2939.9339.dll	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://fexegreuyauja-8124.vercel.app/mixc.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	https://www.iglawfirm.com/services/antai-fr/infospage.php	Get hash	malicious	Unknown	Browse	13.107.246.45
	http://bancolombia-seguridad-co.glitch.me/	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://japroippouquafou-5881.vercel.app/mixc.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	http://posegulefra-4459.vercel.app/mixcc.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	https://currenntlyattyah06.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
bg.microsoft.map.fastly.net	file.exe	Get hash	malicious	LummaC	Browse	199.232.210.172
	https://fexegreuyauja-8124.vercel.app/mixc.html	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172
	https://shawnoreplyonlineaccess.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172
	https://webmaillshavv.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172
	http://bancolombia-seguridad-co.glitch.me/	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://pub-6e60812ea6034887a73a58b17a92a80f.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	199.232.210.172
	https://f120987.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172
	https://shawri.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172
	https://account-update-amazon-changepassword.yebw2bfps.top/	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://currenntlyattyah06.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	199.232.210.172
fp2e7a.wpc.phicdn.net	https://60ms64xz.r.eu-west-1.awstrack.me/L0/https:%2F%2Fnym1-ib.adnxs.com%2Fclick2%3Fe=wqT_3QKhAfCBoQAAAAMAxBkFAQj1xf22BhCN5rHDq8rIsXYY6OvVqs3R1c9aIPXtswsoykEwhx04AkDV-qXwAUiY1VJQAFoDVVNEYgNVU0RorAJw-gF4kfdrgAG5zAOIAQGQAQGYAQWgAQKpAVM7_DVZo44_sQHWE0zrJXyFP7kBAAAAwMzM7D_BAREUDMkBUDsJKDDYAQDgAQDwAdEO-AEA%2Fs=555aa6e5683ce51c048a98b83e6a923b5a8d9a2c%2Fbcr=AAAAAAAA8D8=%2Fcnd=%25218hVjbgiv18IdENX6pfABGJjVUiAAKAAxmpmZmZmZuT86CU5ZTTI6NTI1NECoR0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca=MzcxOSNOWU0yOjUyNTQ=%2Fbn=58937%2Fclickenc=http%253A%252F%252Faa.ns.agingbydesignministry.org%3FMlcinsurance=grant.harpur@mlcinsurance.com.au/1/0102019284444055-c8ec5399-450a-413f-acab-546e07ef32e7-000000/Qxx4uNY6H1RoEfFUkvzFba2SPik=395	Get hash	malicious	Unknown	Browse	192.229.221.95
	http://chwcs91azo1jf8f6b6acu6sf7da7lxazxwg6fo8epa.sbxaccountants.com.au/	Get hash	malicious	Captcha Phish	Browse	192.229.221.95
	SecuriteInfo.com.Riskware.Application.25773.563.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	SecuriteInfo.com.FileRepMalware.7131.28226.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://fexegreuyauja-8124.vercel.app/mixc.html	Get hash	malicious	HTMLPhisher	Browse	192.229.221.95
	https://verfiy-blue-badge-sign-up.vercel.app/	Get hash	malicious	HTMLPhisher	Browse	192.229.221.95
	https://shawnoreplyonlineaccess.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	192.229.221.95
	https://onedoc3.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	192.229.221.95
	https://webmaillshavv.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	192.229.221.95
	https://shawwebmailll.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	192.229.221.95

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SIMPLECARRIERCH	fBcMVl6ns6.lnk	Get hash	malicious	RHADAMANTHYS	Browse	185.196.9.174
	rpQF1aDIK4.lnk	Get hash	malicious	RHADAMANTHYS	Browse	185.196.9.174
	test.ps1	Get hash	malicious	RHADAMANTHYS	Browse	185.196.9.174
	path.ps1	Get hash	malicious	DcRat	Browse	185.196.9.174
	g3y89237.exe	Get hash	malicious	DcRat	Browse	185.196.9.174
	z71htmivzKAUpOkr2J.exe	Get hash	malicious	AgentTesla	Browse	185.196.9.150
	1tstvk3Sls.exe	Get hash	malicious	RHADAMANTHYS	Browse	185.196.11.237
	GX9zyKVNXR.exe	Get hash	malicious	RedLine	Browse	185.196.9.26
	Lys2hJAvd1.exe	Get hash	malicious	RedLine	Browse	185.196.9.26
	JfvFiUr0DO.exe	Get hash	malicious	RedLine	Browse	185.196.9.26

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	Compliance_Report_Final_Q3_8c3f5541a91374b5bf18ac88017a597742a1891a.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	20Listen.eml	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	https://60ms64xz.r.eu-west-1.awstrack.me/L0/https:%2F%2Fnym1-ib.adnxs.com%2Fclick2%3Fe=wqT_3QKhAfCBoQAAAAMAxBkFAQj1xf22BhCN5rHDq8rIsXYY6OvVqs3R1c9aIPXtswsoykEwhx04AkDV-qXwAUiY1VJQAFoDVVNEYgNVU0RorAJw-gF4kfdrgAG5zAOIAQGQAQGYAQWgAQKpAVM7_DVZo44_sQHWE0zrJXyFP7kBAAAAwMzM7D_BAREUDMkBUDsJKDDYAQDgAQDwAdEO-AEA%2Fs=555aa6e5683ce51c048a98b83e6a923b5a8d9a2c%2Fbcr=AAAAAAAA8D8=%2Fcnd=%25218hVjbgiv18IdENX6pfABGJjVUiAAKAAxmpmZmZmZuT86CU5ZTTI6NTI1NECoR0kAAAAAAADwP1EAAAAAAAAAAFkAAAAAAAAAAGEAAAAAAAAAAGkAAAAAAAAAAHEAAAAAAAAAAHgAiQEAAAAAAADwPw..%2Fcca=MzcxOSNOWU0yOjUyNTQ=%2Fbn=58937%2Fclickenc=http%253A%252F%252Faa.ns.agingbydesignministry.org%3FMlcinsurance=grant.harpur@mlcinsurance.com.au/1/0102019284444055-c8ec5399-450a-413f-acab-546e07ef32e7-000000/Qxx4uNY6H1RoEfFUkvzFba2SPik=395	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://payrollruntimesheet.weebly.com/verify.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	https://john17237.wixsite.com/my-site	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	http://chwcs91azo1jf8f6b6acu6sf7da7lxazxwg6fo8epa.sbxaccountants.com.au/	Get hash	malicious	Captcha Phish	Browse	13.107.246.45
	http://gigabytecomputerbd.com/	Get hash	malicious	Unknown	Browse	13.107.246.45
	http://painel.simpatiafm.com.br/	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://fexegreuyauja-8124.vercel.app/mixc.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	https://pub-c5538851da6244d790b9ba2a84c8b2af.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report #U0415Sh#U0430rk.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_#U0415Sh#U0430rk_4374819b0365f6888fbc19b060573179d2634f_bd242e1d_6c909fbb-e48c-4691-952e-96518334b0cd\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF90D.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF9AA.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFA19.tmp.xml

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MSBuild.exe.log

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Windows Analysis Report
#U0415Sh#U0430rk.exe

Function 00EF1FEA Relevance: 7.7, APIs: 5, Instructions: 153
memorythreadCOMMON

Function 00F02B19 Relevance: .0, Instructions: 29
COMMON

Function 00F01C2F Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Function 00EF9EBB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 51
threadCOMMON

Function 00EF9D5F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38
threadCOMMON

Function 00F01CFA Relevance: 1.6, APIs: 1, Instructions: 57
COMMONLIBRARYCODE

Function 00EF516A Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 19
libraryloaderCOMMON

Function 00EF86D0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 120
COMMON

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre