Edit tour

Windows Analysis Report
https://tankumar.com.my/ri2Ps3Rharddy9bFe5nk17lFe5yx0qai2Prss3RWO3pFe5dy9s3RWO3BM2

Overview

General Information

Sample URL:	https://tankumar.com.my/ri2Ps3Rharddy9bFe5nk17lFe5yx0qai2Prss3RWO3pFe5dy9s3RWO3BM2
Analysis ID:	1541359
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected suspicious crossdomain redirect

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64

chrome.exe (PID: 2672 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6496 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=2124,i,56603392817245158,780581492459507991,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6776 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://tankumar.com.my/ri2Ps3Rharddy9bFe5nk17lFe5yx0qai2Prss3RWO3pFe5dy9s3RWO3BM2" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.8:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.8:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.8:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.8:49720 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

HTTP traffic: Redirect from: tankumar.com.my to hhttps://docusign.hparmer.com/?organisation=airscope.com&dse=cmljagfyzc5izw50bgv5qgfpcnnjb3bllmnvbq==#/common/authorize?document=0.85991446853611-0ff1-0.53880688759443&auth=10.17580711104712-0.3254881749514

Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45

Source: global traffic	HTTP traffic detected: GET /ri2Ps3Rharddy9bFe5nk17lFe5yx0qai2Prss3RWO3pFe5dy9s3RWO3BM2 HTTP/1.1Host: tankumar.com.myConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=T4f3UfVw36CouvC&MD=Tz6pSezy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=T4f3UfVw36CouvC&MD=Tz6pSezy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: tankumar.com.my
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.8:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.8:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.8:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.8:49720 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@16/6@4/6

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=2124,i,56603392817245158,780581492459507991,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://tankumar.com.my/ri2Ps3Rharddy9bFe5nk17lFe5yx0qai2Prss3RWO3pFe5dy9s3RWO3BM2"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=2124,i,56603392817245158,780581492459507991,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.google.com	142.250.184.228	true	false		unknown
tankumar.com.my	110.4.45.233	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://tankumar.com.my/ri2Ps3Rharddy9bFe5nk17lFe5yx0qai2Prss3RWO3pFe5dy9s3RWO3BM2	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.184.228	www.google.com	United States	15169	GOOGLEUS	false
110.4.45.233	tankumar.com.my	Malaysia	46015	EXABYTES-AS-APExaBytesNetworkSdnBhdMY	false

Private

IP
192.168.2.23
192.168.2.8
192.168.2.4

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1541359
Start date and time:	2024-10-24 18:16:28 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://tankumar.com.my/ri2Ps3Rharddy9bFe5nk17lFe5yx0qai2Prss3RWO3pFe5dy9s3RWO3BM2
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@16/6@4/6
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.110.84, 142.250.185.67, 142.250.185.142, 34.104.35.123, 192.229.221.95, 20.3.187.198, 52.165.164.15, 142.250.184.227
Excluded domains from analysis (whitelisted): fe3.delivery.mp.microsoft.com, fs.microsoft.com, clients2.google.com, ocsp.digicert.com, accounts.google.com, edgedl.me.gvt1.com, slscr.update.microsoft.com, glb.cws.prod.dcat.dsp.trafficmanager.net, update.googleapis.com, clientservices.googleapis.com, clients.l.google.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: https://tankumar.com.my/ri2Ps3Rharddy9bFe5nk17lFe5yx0qai2Prss3RWO3pFe5dy9s3RWO3BM2

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 15:17:28 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9752285469163837
Encrypted:	false
SSDEEP:	48:8q0dzjTPHwfHAidAKZdA1oehwiZUklqehQy+3:8q8jbwv/y
MD5:	61CFE086585A85C6947B81A2B2F4389E
SHA1:	3DEE50174C95BD5EE3F1E4211C28183352E958C4
SHA-256:	D45FB5F26798895C821D559D9C81E0DCD0611E9E2E56C60CD9734DFC54BD9727
SHA-512:	5D62865E98FDCA0D42C192411DD89DD62FB7628DAA9862629576E8E700AE9541668917744BDA4FB157E49FB91B546D487A25C21CC1106ED2EF4C3376720C09DD
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....]@80&..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IXY-.....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VXY-.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VXY-.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VXY-............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VXY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........W.Dr.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 15:17:27 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9913145516600235
Encrypted:	false
SSDEEP:	48:8Qq0dzjTPHwfHAidAKZdA1leh/iZUkAQkqehvy+2:8T8jbw19QWy
MD5:	7916F2EFF4BE77CE59C9B3020E4455FB
SHA1:	F5FE6CDF174ECFADFB00D6E1C0BAB12A8C5BCCBD
SHA-256:	A16DA6A536929325B6BDB841D118E55D040C458C6E3F97FA42A01E6BDC8EF536
SHA-512:	1B1F3E53FFC89D3B5D7BB4930541A33FE6E8DB7D0B96E58F367879349D465999F0250EAB7AAA636EA5F5A1C253F4D5A289D219FC5F3E9101777D287DF8528F23
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....;..80&..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IXY-.....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VXY-.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VXY-.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VXY-............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VXY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........W.Dr.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 07:00:51 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.003386572708239
Encrypted:	false
SSDEEP:	48:8u0dzjTPHbHAidAKZdA14t5eh7sFiZUkmgqeh7sdy+BX:8u8jbRnLy
MD5:	08D9ADDD6FF1B12EFCBD380005E7D361
SHA1:	454C4D5C9326E9ADF60CD8D855F608063874A82D
SHA-256:	820E72691A37E8EDC260F16B064BB2B18A2AD45A03C3163CF44BFCFA3D6A31FE
SHA-512:	732272B62316D2DB3D9C1043169371D94EA05B8677BE6776E36AC3035E0A2646C0E156F2349436956F2BA59C6FD66BA03F930AAAC4083FFCC9DCD93ACD658625
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....C..b...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IXY-.....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VXY-.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VXY-.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VXY-............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VEW.@...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........W.Dr.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 15:17:27 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.988861164504884
Encrypted:	false
SSDEEP:	48:800dzjTPHwfHAidAKZdA16ehDiZUkwqehjy+R:808jbwmVy
MD5:	C2F68B7D215EDD75860094CD8C133593
SHA1:	BBFB79C5B407B83A52BFF5D7D6A6053B6604909B
SHA-256:	3BBBCCF52C173C234653F079730E3B7D2FD0426FE9C1B57C25E96D9420DA0257
SHA-512:	5042E26150ADDF353A08A6B839DB740B623AE30F633AD85048368A69DD6AD141A43E3732C0D441696565C3EC079C92FAA038795F0E2004DCBA30995A1D703667
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....-.80&..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IXY-.....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VXY-.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VXY-.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VXY-............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VXY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........W.Dr.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 15:17:27 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9790351297947337
Encrypted:	false
SSDEEP:	48:8Yq0dzjTPHwfHAidAKZdA1UehBiZUk1W1qehJy+C:8Yq8jbwm9py
MD5:	26E30310BF2529F5890D515D49741042
SHA1:	90D7C5BEBF6BF9D5EF43379472160FE290159777
SHA-256:	A7CF8CA4B71884E4D13DAACCE1CF33778973C6B1BD8B71A91A7E2CE7DB7F6C27
SHA-512:	3D62F41F7F85C14B97984726730BD833535355E9183531D4EF0789EA8B35D1A2AA3D283C1FC4A0FC586C250B9CF3AADA64FAC24F30D80233DCD476C68D46B99A
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....{%80&..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IXY-.....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VXY-.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VXY-.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VXY-............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VXY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........W.Dr.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 24 15:17:27 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.988407998275761
Encrypted:	false
SSDEEP:	48:89XK0dzjTPHwfHAidAKZdA1duTrehOuTbbiZUk5OjqehOuTbLy+yT+:89XK8jbw3TYTbxWOvTbLy7T
MD5:	5328DF7D562AAD6233D16F0518632BAC
SHA1:	C9AD39C6D795A67B36B0A027409DDCDF06A8CE13
SHA-256:	1F6BC3E85AAC21613116E32A2475988A214A35A8F0FF8B3D1D5B57E13D39B9C5
SHA-512:	DB6FD381565AE44A06E9B6AAC18BBD3FEF4663EFA11F71EB75B81F4B4549BFB0EEA73A837D9B6444C356C556862E4777D077A2CE04180C8C48A4710C5C77F413
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.......80&..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IXY-.....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VXY-.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VXY-.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VXY-............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VXY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........W.Dr.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Static File Info

⊘No static file info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 24, 2024 18:17:15.604388952 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:15.605113029 CEST	49677	80	192.168.2.8	192.229.211.108
Oct 24, 2024 18:17:15.606031895 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:15.606120110 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:15.607569933 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:15.608098984 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:15.609754086 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:15.609786987 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:15.609821081 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:15.609843969 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:15.609899044 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:15.611988068 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:15.612071991 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:15.613610983 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:15.617463112 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:15.699534893 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:15.703025103 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:15.733819008 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:15.733910084 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:15.734087944 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:15.735403061 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:15.735554934 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:15.735626936 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:15.737809896 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:15.737900972 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:15.738564968 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:15.738676071 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:15.743403912 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:15.744076967 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:15.826390982 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:15.829495907 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:15.861202002 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:15.861248016 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:15.861351967 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:15.861510992 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:15.862310886 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:15.862382889 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:15.862389088 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:15.862934113 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:15.863019943 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:15.865164995 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:15.865422010 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:15.866017103 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:15.866215944 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:15.870785952 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:15.871561050 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:15.952465057 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:15.956199884 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:15.991771936 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:15.991863012 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:15.991986036 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:15.991990089 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:15.992465973 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:15.992520094 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:15.992538929 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:15.992681026 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:15.992742062 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:15.995996952 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:15.995996952 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:15.996833086 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:15.997128010 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:16.001442909 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.002463102 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.083673954 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.087145090 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:16.133333921 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.144685030 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.144715071 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.144726992 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.144915104 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.144962072 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:16.144994020 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:16.148757935 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:16.149034023 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:16.149727106 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:16.149837971 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:16.160298109 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.212460995 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.215845108 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:16.221339941 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.283344030 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.283396006 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.283489943 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.283504009 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:16.283637047 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.283792973 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:16.284411907 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.287385941 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:16.287822008 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:16.288341045 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:16.288470984 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:16.295743942 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.295794964 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.295825005 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.295855045 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.340681076 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.343915939 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:16.349414110 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.410027027 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.411444902 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.411499023 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.411530018 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:16.411607981 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.411655903 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:16.412126064 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.413965940 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:16.414582014 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:16.415287018 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:16.415328026 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:16.419960976 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.420954943 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.467852116 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.471098900 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:16.476423979 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.538053989 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.538640976 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.538716078 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:16.541394949 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:16.541537046 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:16.543036938 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.543380022 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.543426037 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:16.546363115 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:16.547158957 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:16.547426939 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.547753096 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.552247047 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.552440882 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.593993902 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.597198963 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:16.602689981 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.672956944 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.673167944 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.673240900 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:16.673330069 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.674076080 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.674127102 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:16.674132109 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.675345898 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.675415039 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:16.676584959 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:16.677114964 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:16.677515984 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:16.677695036 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:16.682014942 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.682435989 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.682995081 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.683057070 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.728667974 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.732111931 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:16.737494946 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.803226948 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.803338051 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.803513050 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:16.803514957 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.803680897 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.803726912 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:16.803983927 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.806804895 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:16.806862116 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:16.807380915 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:16.807611942 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:16.812136889 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.812180996 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.812642097 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.812870979 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.869693995 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.872349024 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:16.877676964 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.935391903 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.935412884 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.935544968 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:16.937712908 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.938283920 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.938355923 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:16.938591003 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:16.941087961 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:16.941907883 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:16.944284916 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.944700956 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.946691990 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:16.947432041 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:16.997317076 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.021589994 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.026002884 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:17.031644106 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.179224014 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.179250956 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.179344893 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:17.179497957 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.180187941 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.180248976 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:17.180253983 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.182890892 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:17.182971954 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:17.183701038 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:17.183845997 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:17.188227892 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.188606977 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.189713955 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.241906881 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.244920969 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:17.250413895 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.311530113 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.311556101 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.311645985 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:17.313179970 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.314385891 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.314444065 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:17.314897060 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:17.314994097 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.315345049 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:17.316715002 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:17.317363024 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:17.320307970 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.321398020 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.322079897 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.322737932 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.370856047 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.373377085 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:17.379106045 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.454813957 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.454860926 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.454941988 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:17.457376957 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.457849026 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:17.457946062 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.457984924 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.458023071 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:17.458055973 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:17.458260059 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.460411072 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:17.460565090 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:17.461040020 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:17.463330984 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.466144085 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.466876030 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.505093098 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.508233070 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:17.557164907 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.595882893 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.595904112 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.596019030 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:17.597372055 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.598854065 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:17.599026918 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:17.601599932 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.603363991 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.603437901 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:17.603560925 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:17.604316950 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.604469061 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.605335951 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:17.608922005 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.610773087 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.636717081 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.639800072 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:17.689156055 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.745716095 CEST	49673	443	192.168.2.8	23.206.229.226
Oct 24, 2024 18:17:17.774398088 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.774588108 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.774771929 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:17.774956942 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.777857065 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:17.777864933 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.777921915 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:17.777937889 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:17.778074026 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.779436111 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.779504061 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:17.780061007 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:17.781212091 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:17.783353090 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.785617113 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.786602020 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.796072960 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.798297882 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:17.849150896 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.903909922 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.903930902 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.903994083 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:17.904067039 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.904618979 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.904666901 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:17.904927015 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.907780886 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:17.907844067 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:17.908504963 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:17.908561945 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:17.913096905 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.913280964 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.914127111 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.921219110 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:17.923871994 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:17.977268934 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.032428026 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.032932043 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.033018112 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:18.033020973 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.033139944 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.033185959 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:18.034832954 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.037046909 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:18.037331104 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:18.038490057 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:18.038578033 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:18.042521954 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.042695999 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.043920040 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.044166088 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.046928883 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.049526930 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:18.089397907 CEST	49672	443	192.168.2.8	23.206.229.226
Oct 24, 2024 18:17:18.097110033 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.161958933 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.162425041 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.162467003 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.162487984 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:18.162791014 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.162837029 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:18.163155079 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.166301966 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:18.171643019 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.172343016 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:18.173537970 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:18.173648119 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:18.174794912 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.177232981 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:18.178852081 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.182627916 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.290189028 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.293448925 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:18.297432899 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.300046921 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:18.305341959 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.305397034 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:18.305408955 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.305453062 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:18.307028055 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.307956934 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:18.308070898 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.308125019 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:18.310019016 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:18.310472012 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:18.316268921 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.357928991 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.418895960 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.422123909 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:18.422631979 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.422766924 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:18.425357103 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:18.427598953 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.430835009 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.430924892 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.433057070 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.433103085 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:18.433743000 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:18.433798075 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.435401917 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:18.435935974 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:18.441211939 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.485080004 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.545170069 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.548433065 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:18.553977013 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.554275036 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.557054996 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:18.557835102 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.557902098 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:18.560200930 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:18.560380936 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.560436964 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:18.560463905 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.560523033 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:18.560636044 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.563642979 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:18.564589977 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:18.565515995 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.569926023 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.671499014 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.675008059 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:18.680242062 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.683221102 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:18.683406115 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.683470964 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:18.685837984 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:18.689413071 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.689436913 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.689517021 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:18.689522982 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.692230940 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:18.692342997 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:18.697618008 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.741286039 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.798875093 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.805378914 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:18.810508966 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.810761929 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.813000917 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.813065052 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:18.813165903 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:18.815399885 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.815853119 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.815906048 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:18.819876909 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:18.820508957 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:18.822000027 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:18.825458050 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.827414036 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.932499886 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.936043978 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:18.936064005 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.936113119 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:18.938139915 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:18.943028927 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.944194078 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.944263935 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:18.945018053 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:18.945775032 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.946120024 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:18.947740078 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:18.951544046 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:18.997072935 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.067028999 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.067645073 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.067711115 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:19.071140051 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:19.071830988 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:19.076680899 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.077203989 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.077821970 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.077840090 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.077883959 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:19.077927113 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.078361988 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.078401089 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:19.079962015 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:19.081163883 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:19.082457066 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:19.086616993 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.133069992 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.196435928 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.196450949 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.196515083 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:19.197559118 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.206546068 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.206614017 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:19.209017992 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.209052086 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.209090948 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:19.210074902 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.259289980 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:19.259289980 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:19.264846087 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.264911890 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.299336910 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:19.299546003 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:19.300697088 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:19.304966927 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.306087017 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.323683023 CEST	49676	443	192.168.2.8	52.182.143.211
Oct 24, 2024 18:17:19.385762930 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.385802031 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.385874987 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:19.386145115 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.407582045 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:19.408719063 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:19.413049936 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.414376020 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.424462080 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.424956083 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.425034046 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:19.425573111 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.425837040 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.425873041 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:19.430109978 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:19.431744099 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:19.433626890 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:19.437160015 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.481158972 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.530391932 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.532222986 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.532270908 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:19.535165071 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:19.537749052 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:19.540535927 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.543447971 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.553292990 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.553303957 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.553347111 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:19.554997921 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.555738926 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:19.557516098 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.557557106 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:19.557668924 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.557830095 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:19.564697027 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:19.565915108 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:19.570125103 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.617223024 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.658449888 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.661226988 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.663537025 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:19.687433958 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.689310074 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.689431906 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.689508915 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:19.829526901 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:19.831549883 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:19.833811998 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:19.835616112 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.835639000 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:19.836808920 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.837178946 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:19.839251041 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.840998888 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.842576027 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.957174063 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.957200050 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.957684994 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:19.959078074 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.960254908 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:19.961656094 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.961716890 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:19.961734056 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.961745977 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.961787939 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:19.962517023 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:19.963939905 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.964006901 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.964018106 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.964073896 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:19.965739012 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.968417883 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.968950033 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:19.969767094 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:19.971003056 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:19.975892067 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:19.976814985 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:20.088268042 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:20.090845108 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:20.090886116 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:20.090897083 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:20.091026068 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:20.091026068 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:20.091712952 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:20.093791962 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:20.095002890 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:20.095094919 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:20.095096111 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:20.095108032 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:20.095150948 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:20.095168114 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:20.095174074 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:20.095283985 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:20.097002029 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:20.101584911 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:20.101809978 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:20.102778912 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:20.103204966 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:20.109061956 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:20.222372055 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:20.222388029 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:20.222495079 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:20.222498894 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:20.226723909 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:20.227286100 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:20.227360010 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:20.227416039 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:20.227426052 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:20.227464914 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:20.589538097 CEST	49671	443	192.168.2.8	204.79.197.203
Oct 24, 2024 18:17:20.917480946 CEST	49677	80	192.168.2.8	192.229.211.108
Oct 24, 2024 18:17:24.955012083 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:24.956619024 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:24.958573103 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:24.962271929 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:24.962287903 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:24.964016914 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:25.082874060 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:25.082895041 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:25.082954884 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:25.083029032 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:25.085117102 CEST	443	49705	13.107.246.45	192.168.2.8
Oct 24, 2024 18:17:25.085175037 CEST	49705	443	192.168.2.8	13.107.246.45
Oct 24, 2024 18:17:27.456861973 CEST	49673	443	192.168.2.8	23.206.229.226
Oct 24, 2024 18:17:27.769324064 CEST	49672	443	192.168.2.8	23.206.229.226
Oct 24, 2024 18:17:28.938266039 CEST	49676	443	192.168.2.8	52.182.143.211
Oct 24, 2024 18:17:29.287910938 CEST	49713	443	192.168.2.8	110.4.45.233
Oct 24, 2024 18:17:29.287950993 CEST	443	49713	110.4.45.233	192.168.2.8
Oct 24, 2024 18:17:29.288028002 CEST	49713	443	192.168.2.8	110.4.45.233
Oct 24, 2024 18:17:29.288321972 CEST	49714	443	192.168.2.8	110.4.45.233
Oct 24, 2024 18:17:29.288373947 CEST	443	49714	110.4.45.233	192.168.2.8
Oct 24, 2024 18:17:29.288420916 CEST	49714	443	192.168.2.8	110.4.45.233
Oct 24, 2024 18:17:29.288676977 CEST	49714	443	192.168.2.8	110.4.45.233
Oct 24, 2024 18:17:29.288696051 CEST	443	49714	110.4.45.233	192.168.2.8
Oct 24, 2024 18:17:29.288851976 CEST	49713	443	192.168.2.8	110.4.45.233
Oct 24, 2024 18:17:29.288873911 CEST	443	49713	110.4.45.233	192.168.2.8
Oct 24, 2024 18:17:29.497412920 CEST	443	49703	23.206.229.226	192.168.2.8
Oct 24, 2024 18:17:29.497561932 CEST	49703	443	192.168.2.8	23.206.229.226
Oct 24, 2024 18:17:30.624667883 CEST	49715	443	192.168.2.8	142.250.184.228
Oct 24, 2024 18:17:30.624742031 CEST	443	49715	142.250.184.228	192.168.2.8
Oct 24, 2024 18:17:30.624828100 CEST	49715	443	192.168.2.8	142.250.184.228
Oct 24, 2024 18:17:30.625080109 CEST	49715	443	192.168.2.8	142.250.184.228
Oct 24, 2024 18:17:30.625097990 CEST	443	49715	142.250.184.228	192.168.2.8
Oct 24, 2024 18:17:30.705990076 CEST	443	49714	110.4.45.233	192.168.2.8
Oct 24, 2024 18:17:30.706659079 CEST	49714	443	192.168.2.8	110.4.45.233
Oct 24, 2024 18:17:30.706692934 CEST	443	49714	110.4.45.233	192.168.2.8
Oct 24, 2024 18:17:30.707814932 CEST	443	49714	110.4.45.233	192.168.2.8
Oct 24, 2024 18:17:30.707879066 CEST	49714	443	192.168.2.8	110.4.45.233
Oct 24, 2024 18:17:30.709247112 CEST	49714	443	192.168.2.8	110.4.45.233
Oct 24, 2024 18:17:30.709340096 CEST	443	49714	110.4.45.233	192.168.2.8
Oct 24, 2024 18:17:30.709611893 CEST	49714	443	192.168.2.8	110.4.45.233
Oct 24, 2024 18:17:30.709620953 CEST	443	49714	110.4.45.233	192.168.2.8
Oct 24, 2024 18:17:30.727340937 CEST	443	49713	110.4.45.233	192.168.2.8
Oct 24, 2024 18:17:30.727598906 CEST	49713	443	192.168.2.8	110.4.45.233
Oct 24, 2024 18:17:30.727616072 CEST	443	49713	110.4.45.233	192.168.2.8
Oct 24, 2024 18:17:30.729420900 CEST	443	49713	110.4.45.233	192.168.2.8
Oct 24, 2024 18:17:30.729490995 CEST	49713	443	192.168.2.8	110.4.45.233
Oct 24, 2024 18:17:30.729816914 CEST	49713	443	192.168.2.8	110.4.45.233
Oct 24, 2024 18:17:30.729906082 CEST	443	49713	110.4.45.233	192.168.2.8
Oct 24, 2024 18:17:30.755012989 CEST	49714	443	192.168.2.8	110.4.45.233
Oct 24, 2024 18:17:30.779126883 CEST	49713	443	192.168.2.8	110.4.45.233
Oct 24, 2024 18:17:30.779149055 CEST	443	49713	110.4.45.233	192.168.2.8
Oct 24, 2024 18:17:30.820204020 CEST	49713	443	192.168.2.8	110.4.45.233
Oct 24, 2024 18:17:31.287719011 CEST	443	49714	110.4.45.233	192.168.2.8
Oct 24, 2024 18:17:31.298934937 CEST	443	49714	110.4.45.233	192.168.2.8
Oct 24, 2024 18:17:31.299520969 CEST	49714	443	192.168.2.8	110.4.45.233
Oct 24, 2024 18:17:31.489495039 CEST	443	49715	142.250.184.228	192.168.2.8
Oct 24, 2024 18:17:31.521775007 CEST	49715	443	192.168.2.8	142.250.184.228
Oct 24, 2024 18:17:31.521826982 CEST	443	49715	142.250.184.228	192.168.2.8
Oct 24, 2024 18:17:31.522739887 CEST	49714	443	192.168.2.8	110.4.45.233
Oct 24, 2024 18:17:31.522785902 CEST	443	49714	110.4.45.233	192.168.2.8
Oct 24, 2024 18:17:31.522871971 CEST	443	49715	142.250.184.228	192.168.2.8
Oct 24, 2024 18:17:31.522937059 CEST	49715	443	192.168.2.8	142.250.184.228
Oct 24, 2024 18:17:31.532459974 CEST	49715	443	192.168.2.8	142.250.184.228
Oct 24, 2024 18:17:31.532548904 CEST	443	49715	142.250.184.228	192.168.2.8
Oct 24, 2024 18:17:31.544073105 CEST	49677	80	192.168.2.8	192.229.211.108
Oct 24, 2024 18:17:31.554896116 CEST	49716	443	192.168.2.8	184.28.90.27
Oct 24, 2024 18:17:31.554934978 CEST	443	49716	184.28.90.27	192.168.2.8
Oct 24, 2024 18:17:31.555006027 CEST	49716	443	192.168.2.8	184.28.90.27
Oct 24, 2024 18:17:31.557344913 CEST	49716	443	192.168.2.8	184.28.90.27
Oct 24, 2024 18:17:31.557360888 CEST	443	49716	184.28.90.27	192.168.2.8
Oct 24, 2024 18:17:31.575162888 CEST	49715	443	192.168.2.8	142.250.184.228
Oct 24, 2024 18:17:31.575187922 CEST	443	49715	142.250.184.228	192.168.2.8
Oct 24, 2024 18:17:31.621854067 CEST	49715	443	192.168.2.8	142.250.184.228
Oct 24, 2024 18:17:32.420047998 CEST	443	49716	184.28.90.27	192.168.2.8
Oct 24, 2024 18:17:32.420172930 CEST	49716	443	192.168.2.8	184.28.90.27
Oct 24, 2024 18:17:32.422491074 CEST	49716	443	192.168.2.8	184.28.90.27
Oct 24, 2024 18:17:32.422501087 CEST	443	49716	184.28.90.27	192.168.2.8
Oct 24, 2024 18:17:32.422848940 CEST	443	49716	184.28.90.27	192.168.2.8
Oct 24, 2024 18:17:32.458292007 CEST	49716	443	192.168.2.8	184.28.90.27
Oct 24, 2024 18:17:32.499342918 CEST	443	49716	184.28.90.27	192.168.2.8
Oct 24, 2024 18:17:32.703238964 CEST	443	49716	184.28.90.27	192.168.2.8
Oct 24, 2024 18:17:32.703532934 CEST	49716	443	192.168.2.8	184.28.90.27
Oct 24, 2024 18:17:32.703532934 CEST	49716	443	192.168.2.8	184.28.90.27
Oct 24, 2024 18:17:32.703574896 CEST	443	49716	184.28.90.27	192.168.2.8
Oct 24, 2024 18:17:32.703773022 CEST	443	49716	184.28.90.27	192.168.2.8
Oct 24, 2024 18:17:32.703813076 CEST	443	49716	184.28.90.27	192.168.2.8
Oct 24, 2024 18:17:32.705231905 CEST	49716	443	192.168.2.8	184.28.90.27
Oct 24, 2024 18:17:32.741583109 CEST	49717	443	192.168.2.8	184.28.90.27
Oct 24, 2024 18:17:32.741678953 CEST	443	49717	184.28.90.27	192.168.2.8
Oct 24, 2024 18:17:32.742052078 CEST	49717	443	192.168.2.8	184.28.90.27
Oct 24, 2024 18:17:32.742052078 CEST	49717	443	192.168.2.8	184.28.90.27
Oct 24, 2024 18:17:32.742141008 CEST	443	49717	184.28.90.27	192.168.2.8
Oct 24, 2024 18:17:33.585135937 CEST	443	49717	184.28.90.27	192.168.2.8
Oct 24, 2024 18:17:33.585388899 CEST	49717	443	192.168.2.8	184.28.90.27
Oct 24, 2024 18:17:33.586596012 CEST	49717	443	192.168.2.8	184.28.90.27
Oct 24, 2024 18:17:33.586638927 CEST	443	49717	184.28.90.27	192.168.2.8
Oct 24, 2024 18:17:33.586888075 CEST	443	49717	184.28.90.27	192.168.2.8
Oct 24, 2024 18:17:33.587776899 CEST	49717	443	192.168.2.8	184.28.90.27
Oct 24, 2024 18:17:33.631339073 CEST	443	49717	184.28.90.27	192.168.2.8
Oct 24, 2024 18:17:33.831681013 CEST	443	49717	184.28.90.27	192.168.2.8
Oct 24, 2024 18:17:33.831763983 CEST	443	49717	184.28.90.27	192.168.2.8
Oct 24, 2024 18:17:33.831828117 CEST	49717	443	192.168.2.8	184.28.90.27
Oct 24, 2024 18:17:33.850166082 CEST	49717	443	192.168.2.8	184.28.90.27
Oct 24, 2024 18:17:33.850209951 CEST	443	49717	184.28.90.27	192.168.2.8
Oct 24, 2024 18:17:33.850229979 CEST	49717	443	192.168.2.8	184.28.90.27
Oct 24, 2024 18:17:33.850239038 CEST	443	49717	184.28.90.27	192.168.2.8
Oct 24, 2024 18:17:38.099019051 CEST	49718	443	192.168.2.8	20.109.210.53
Oct 24, 2024 18:17:38.099067926 CEST	443	49718	20.109.210.53	192.168.2.8
Oct 24, 2024 18:17:38.099335909 CEST	49718	443	192.168.2.8	20.109.210.53
Oct 24, 2024 18:17:38.122189999 CEST	49718	443	192.168.2.8	20.109.210.53
Oct 24, 2024 18:17:38.122220039 CEST	443	49718	20.109.210.53	192.168.2.8
Oct 24, 2024 18:17:38.988157034 CEST	443	49718	20.109.210.53	192.168.2.8
Oct 24, 2024 18:17:38.988238096 CEST	49718	443	192.168.2.8	20.109.210.53
Oct 24, 2024 18:17:38.989964008 CEST	49718	443	192.168.2.8	20.109.210.53
Oct 24, 2024 18:17:38.989972115 CEST	443	49718	20.109.210.53	192.168.2.8
Oct 24, 2024 18:17:38.990259886 CEST	443	49718	20.109.210.53	192.168.2.8
Oct 24, 2024 18:17:39.033778906 CEST	49718	443	192.168.2.8	20.109.210.53
Oct 24, 2024 18:17:39.053430080 CEST	49718	443	192.168.2.8	20.109.210.53
Oct 24, 2024 18:17:39.099333048 CEST	443	49718	20.109.210.53	192.168.2.8
Oct 24, 2024 18:17:39.320663929 CEST	443	49718	20.109.210.53	192.168.2.8
Oct 24, 2024 18:17:39.320699930 CEST	443	49718	20.109.210.53	192.168.2.8
Oct 24, 2024 18:17:39.320708990 CEST	443	49718	20.109.210.53	192.168.2.8
Oct 24, 2024 18:17:39.320730925 CEST	443	49718	20.109.210.53	192.168.2.8
Oct 24, 2024 18:17:39.320769072 CEST	443	49718	20.109.210.53	192.168.2.8
Oct 24, 2024 18:17:39.320779085 CEST	49718	443	192.168.2.8	20.109.210.53
Oct 24, 2024 18:17:39.320797920 CEST	443	49718	20.109.210.53	192.168.2.8
Oct 24, 2024 18:17:39.320835114 CEST	49718	443	192.168.2.8	20.109.210.53
Oct 24, 2024 18:17:39.320858002 CEST	49718	443	192.168.2.8	20.109.210.53
Oct 24, 2024 18:17:39.321573973 CEST	443	49718	20.109.210.53	192.168.2.8
Oct 24, 2024 18:17:39.321665049 CEST	49718	443	192.168.2.8	20.109.210.53
Oct 24, 2024 18:17:39.321670055 CEST	443	49718	20.109.210.53	192.168.2.8
Oct 24, 2024 18:17:39.321681976 CEST	443	49718	20.109.210.53	192.168.2.8
Oct 24, 2024 18:17:39.321742058 CEST	49718	443	192.168.2.8	20.109.210.53
Oct 24, 2024 18:17:39.331859112 CEST	49718	443	192.168.2.8	20.109.210.53
Oct 24, 2024 18:17:39.331876993 CEST	443	49718	20.109.210.53	192.168.2.8
Oct 24, 2024 18:17:39.331886053 CEST	49718	443	192.168.2.8	20.109.210.53
Oct 24, 2024 18:17:39.331891060 CEST	443	49718	20.109.210.53	192.168.2.8
Oct 24, 2024 18:17:41.489753008 CEST	443	49715	142.250.184.228	192.168.2.8
Oct 24, 2024 18:17:41.489886999 CEST	443	49715	142.250.184.228	192.168.2.8
Oct 24, 2024 18:17:41.490031958 CEST	49715	443	192.168.2.8	142.250.184.228
Oct 24, 2024 18:17:42.928093910 CEST	49715	443	192.168.2.8	142.250.184.228
Oct 24, 2024 18:17:42.928188086 CEST	443	49715	142.250.184.228	192.168.2.8
Oct 24, 2024 18:17:50.745604038 CEST	443	49713	110.4.45.233	192.168.2.8
Oct 24, 2024 18:17:50.745686054 CEST	443	49713	110.4.45.233	192.168.2.8
Oct 24, 2024 18:17:50.745775938 CEST	49713	443	192.168.2.8	110.4.45.233
Oct 24, 2024 18:17:50.930622101 CEST	49713	443	192.168.2.8	110.4.45.233
Oct 24, 2024 18:17:50.930653095 CEST	443	49713	110.4.45.233	192.168.2.8
Oct 24, 2024 18:18:10.437195063 CEST	49704	80	192.168.2.8	93.184.221.240
Oct 24, 2024 18:18:10.444350958 CEST	80	49704	93.184.221.240	192.168.2.8
Oct 24, 2024 18:18:10.445072889 CEST	49704	80	192.168.2.8	93.184.221.240
Oct 24, 2024 18:18:15.729927063 CEST	49720	443	192.168.2.8	20.109.210.53
Oct 24, 2024 18:18:15.729979992 CEST	443	49720	20.109.210.53	192.168.2.8
Oct 24, 2024 18:18:15.730129957 CEST	49720	443	192.168.2.8	20.109.210.53
Oct 24, 2024 18:18:15.730530977 CEST	49720	443	192.168.2.8	20.109.210.53
Oct 24, 2024 18:18:15.730542898 CEST	443	49720	20.109.210.53	192.168.2.8
Oct 24, 2024 18:18:16.535232067 CEST	443	49720	20.109.210.53	192.168.2.8
Oct 24, 2024 18:18:16.535310030 CEST	49720	443	192.168.2.8	20.109.210.53
Oct 24, 2024 18:18:16.537049055 CEST	49720	443	192.168.2.8	20.109.210.53
Oct 24, 2024 18:18:16.537065983 CEST	443	49720	20.109.210.53	192.168.2.8
Oct 24, 2024 18:18:16.537450075 CEST	443	49720	20.109.210.53	192.168.2.8
Oct 24, 2024 18:18:16.539830923 CEST	49720	443	192.168.2.8	20.109.210.53
Oct 24, 2024 18:18:16.583359003 CEST	443	49720	20.109.210.53	192.168.2.8
Oct 24, 2024 18:18:16.804244041 CEST	443	49720	20.109.210.53	192.168.2.8
Oct 24, 2024 18:18:16.804271936 CEST	443	49720	20.109.210.53	192.168.2.8
Oct 24, 2024 18:18:16.804286957 CEST	443	49720	20.109.210.53	192.168.2.8
Oct 24, 2024 18:18:16.804327965 CEST	49720	443	192.168.2.8	20.109.210.53
Oct 24, 2024 18:18:16.804346085 CEST	443	49720	20.109.210.53	192.168.2.8
Oct 24, 2024 18:18:16.804367065 CEST	49720	443	192.168.2.8	20.109.210.53
Oct 24, 2024 18:18:16.804392099 CEST	49720	443	192.168.2.8	20.109.210.53
Oct 24, 2024 18:18:16.920375109 CEST	443	49720	20.109.210.53	192.168.2.8
Oct 24, 2024 18:18:16.920454025 CEST	49720	443	192.168.2.8	20.109.210.53
Oct 24, 2024 18:18:16.920453072 CEST	443	49720	20.109.210.53	192.168.2.8
Oct 24, 2024 18:18:16.920484066 CEST	443	49720	20.109.210.53	192.168.2.8
Oct 24, 2024 18:18:16.920495987 CEST	443	49720	20.109.210.53	192.168.2.8
Oct 24, 2024 18:18:16.920511961 CEST	49720	443	192.168.2.8	20.109.210.53
Oct 24, 2024 18:18:16.920536995 CEST	49720	443	192.168.2.8	20.109.210.53
Oct 24, 2024 18:18:16.920627117 CEST	49720	443	192.168.2.8	20.109.210.53
Oct 24, 2024 18:18:16.920640945 CEST	443	49720	20.109.210.53	192.168.2.8
Oct 24, 2024 18:18:16.920659065 CEST	49720	443	192.168.2.8	20.109.210.53
Oct 24, 2024 18:18:16.920664072 CEST	443	49720	20.109.210.53	192.168.2.8
Oct 24, 2024 18:18:30.676450968 CEST	49722	443	192.168.2.8	142.250.184.228
Oct 24, 2024 18:18:30.676558018 CEST	443	49722	142.250.184.228	192.168.2.8
Oct 24, 2024 18:18:30.676628113 CEST	49722	443	192.168.2.8	142.250.184.228
Oct 24, 2024 18:18:30.676883936 CEST	49722	443	192.168.2.8	142.250.184.228
Oct 24, 2024 18:18:30.676917076 CEST	443	49722	142.250.184.228	192.168.2.8
Oct 24, 2024 18:18:31.531399965 CEST	443	49722	142.250.184.228	192.168.2.8
Oct 24, 2024 18:18:31.531769991 CEST	49722	443	192.168.2.8	142.250.184.228
Oct 24, 2024 18:18:31.531800985 CEST	443	49722	142.250.184.228	192.168.2.8
Oct 24, 2024 18:18:31.532979012 CEST	443	49722	142.250.184.228	192.168.2.8
Oct 24, 2024 18:18:31.533405066 CEST	49722	443	192.168.2.8	142.250.184.228
Oct 24, 2024 18:18:31.533597946 CEST	443	49722	142.250.184.228	192.168.2.8
Oct 24, 2024 18:18:31.580646038 CEST	49722	443	192.168.2.8	142.250.184.228
Oct 24, 2024 18:18:41.522835970 CEST	443	49722	142.250.184.228	192.168.2.8
Oct 24, 2024 18:18:41.522910118 CEST	443	49722	142.250.184.228	192.168.2.8
Oct 24, 2024 18:18:41.522984982 CEST	49722	443	192.168.2.8	142.250.184.228
Oct 24, 2024 18:18:42.928380966 CEST	49722	443	192.168.2.8	142.250.184.228
Oct 24, 2024 18:18:42.928420067 CEST	443	49722	142.250.184.228	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 24, 2024 18:17:26.726599932 CEST	53	51626	1.1.1.1	192.168.2.8
Oct 24, 2024 18:17:26.726735115 CEST	53	53641	1.1.1.1	192.168.2.8
Oct 24, 2024 18:17:28.016091108 CEST	53	60034	1.1.1.1	192.168.2.8
Oct 24, 2024 18:17:29.030774117 CEST	53643	53	192.168.2.8	1.1.1.1
Oct 24, 2024 18:17:29.031157970 CEST	54329	53	192.168.2.8	1.1.1.1
Oct 24, 2024 18:17:29.287066936 CEST	53	54329	1.1.1.1	192.168.2.8
Oct 24, 2024 18:17:29.287296057 CEST	53	53643	1.1.1.1	192.168.2.8
Oct 24, 2024 18:17:30.614394903 CEST	60094	53	192.168.2.8	1.1.1.1
Oct 24, 2024 18:17:30.614502907 CEST	49341	53	192.168.2.8	1.1.1.1
Oct 24, 2024 18:17:30.622170925 CEST	53	49341	1.1.1.1	192.168.2.8
Oct 24, 2024 18:17:30.622705936 CEST	53	60094	1.1.1.1	192.168.2.8
Oct 24, 2024 18:17:44.982543945 CEST	53	57169	1.1.1.1	192.168.2.8
Oct 24, 2024 18:18:03.871587038 CEST	53	63208	1.1.1.1	192.168.2.8
Oct 24, 2024 18:18:09.748677015 CEST	138	138	192.168.2.8	192.168.2.255
Oct 24, 2024 18:18:25.893277884 CEST	53	58947	1.1.1.1	192.168.2.8
Oct 24, 2024 18:18:27.087853909 CEST	53	54323	1.1.1.1	192.168.2.8

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Oct 24, 2024 18:17:26.749394894 CEST	192.168.2.8	1.1.1.1	c237	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 24, 2024 18:17:29.030774117 CEST	192.168.2.8	1.1.1.1	0x9a35	Standard query (0)	tankumar.com.my	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:17:29.031157970 CEST	192.168.2.8	1.1.1.1	0x7a64	Standard query (0)	tankumar.com.my	65	IN (0x0001)	false
Oct 24, 2024 18:17:30.614394903 CEST	192.168.2.8	1.1.1.1	0x1d4d	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:17:30.614502907 CEST	192.168.2.8	1.1.1.1	0x5f98	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 24, 2024 18:17:29.287296057 CEST	1.1.1.1	192.168.2.8	0x9a35	No error (0)	tankumar.com.my	110.4.45.233	A (IP address)	IN (0x0001)	false
Oct 24, 2024 18:17:30.622170925 CEST	1.1.1.1	192.168.2.8	0x5f98	No error (0)	www.google.com		65	IN (0x0001)	false
Oct 24, 2024 18:17:30.622705936 CEST	1.1.1.1	192.168.2.8	0x1d4d	No error (0)	www.google.com	142.250.184.228	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

tankumar.com.my

fs.microsoft.com

slscr.update.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49714	110.4.45.233	443	6496	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 16:17:30 UTC	716	OUT	GET /ri2Ps3Rharddy9bFe5nk17lFe5yx0qai2Prss3RWO3pFe5dy9s3RWO3BM2 HTTP/1.1 Host: tankumar.com.my Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-24 16:17:31 UTC	406	IN	HTTP/1.1 302 Found Date: Thu, 24 Oct 2024 16:17:30 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Location: hhttps://docusign.hparmer.com/?organisation=airscope.com&dse=cmljaGFyZC5iZW50bGV5QGFpcnNjb3BlLmNvbQ==#/common/authorize?document=0.85991446853611-0ff1-0.53880688759443&auth=10.17580711104712-0.3254881749514 Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2024-10-24 16:17:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49716	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 16:17:32 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-24 16:17:32 UTC	465	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF67) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=1698 Date: Thu, 24 Oct 2024 16:17:32 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49717	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 16:17:33 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-24 16:17:33 UTC	513	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=1636 Date: Thu, 24 Oct 2024 16:17:33 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-24 16:17:33 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49718	20.109.210.53	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 16:17:39 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=T4f3UfVw36CouvC&MD=Tz6pSezy HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-24 16:17:39 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 5d16a5db-1f9c-4ce6-85e7-0d9e18f8a0f4 MS-RequestId: 7738dd99-770e-42ce-ac47-b9be419e81bf MS-CV: 0AIdKht6n02thvNz.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 24 Oct 2024 16:17:38 GMT Connection: close Content-Length: 24490
2024-10-24 16:17:39 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-24 16:17:39 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49720	20.109.210.53	443

Timestamp	Bytes transferred	Direction	Data
2024-10-24 16:18:16 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=T4f3UfVw36CouvC&MD=Tz6pSezy HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-24 16:18:16 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 8dc8096c-d8f3-4ae9-9877-8b74d69dd260 MS-RequestId: cea72ecd-90ef-4382-b9de-a1671e38ea17 MS-CV: rVSufzjZY0K7R6L9.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 24 Oct 2024 16:18:16 GMT Connection: close Content-Length: 30005
2024-10-24 16:18:16 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-10-24 16:18:16 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: chrome.exePID: 2672, Parent PID: 180

General

Target ID:	0
Start time:	12:17:20
Start date:	24/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 6496, Parent PID: 2672

General

Target ID:	2
Start time:	12:17:25
Start date:	24/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=2124,i,56603392817245158,780581492459507991,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 6776, Parent PID: 180

General

Target ID:	3
Start time:	12:17:28
Start date:	24/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://tankumar.com.my/ri2Ps3Rharddy9bFe5nk17lFe5yx0qai2Prss3RWO3pFe5dy9s3RWO3BM2"
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://tankumar.com.my/ri2Ps3Rharddy9bFe5nk17lFe5yx0qai2Prss3RWO3pFe5dy9s3RWO3BM2

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 2672, Parent PID: 180

General

Chronological Activities

Analysis Process: chrome.exePID: 6496, Parent PID: 2672

General

Chronological Activities

Analysis Process: chrome.exePID: 6776, Parent PID: 180

General

Chronological Activities

Windows Analysis Report
https://tankumar.com.my/ri2Ps3Rharddy9bFe5nk17lFe5yx0qai2Prss3RWO3pFe5dy9s3RWO3BM2