Edit tour

Windows Analysis Report
Fattura (4).jar

Overview

General Information

Sample name:	Fattura (4).jar
Analysis ID:	1546101
MD5:	10dc49c6f31e40445f4c2cb3f85a3874
SHA1:	6abea67305935a198d131fa1d7d846394b5a94a1
SHA256:	05ef869849225755852d83ae2a61ed95f35b7a1799f1b10c1bbe2516176dd62d
Tags:	jarSPAM-ITAuser-JAMESWT_MHT
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to query CPU information (cpuid)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Use Short Name Path in Command Line

Suricata IDS alerts with low severity for network traffic

Uses cacls to modify the permissions of files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

cmd.exe (PID: 5604 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -javaagent:"C:\Users\user~1\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\Fattura (4).jar"" >> C:\cmdlinestart.log 2>&1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3800 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

java.exe (PID: 4236 cmdline: "C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -javaagent:"C:\Users\user~1\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\Fattura (4).jar" MD5: 9DAA53BAB2ECB33DC0D9CA51552701FA)

icacls.exe (PID: 5632 cmdline: C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M MD5: 2E49585E4E08565F52090B144062F97E)

conhost.exe (PID: 1396 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Sigma Signatures

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -javaagent:"C:\Users\user~1\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\Fattura (4).jar"" >> C:\cmdlinestart.log 2>&1, CommandLine: C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -javaagent:"C:\Users\user~1\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\Fattura (4).jar"" >> C:\cmdlinestart.log 2>&1, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2104, ProcessCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -javaagent:"C:\Users\user~1\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\Fattura (4).jar"" >> C:\cmdlinestart.log 2>&1, ProcessId: 5604, ProcessName: cmd.exe

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T14:09:40.825576+0100	2022930	1	A Network Trojan was detected	4.245.163.56	443	192.168.2.7	49818	TCP
2024-10-31T14:10:19.788041+0100	2022930	1	A Network Trojan was detected	4.245.163.56	443	192.168.2.7	50065	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Fattura (4).jar

Avira: detected

Multi AV Scanner detection for submitted file

Source: Fattura (4).jar

ReversingLabs: Detection: 31%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 88.7% probability

Source: global traffic

TCP traffic: 192.168.2.7:49726 -> 116.203.56.216:33381

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.7:49818
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.7:50065

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: de4.localto.net

Source: java.exe, 00000002.00000002.2568115869.00000000097F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bugreport.sun.com/bugreport/
Source: java.exe, 00000002.00000002.2568115869.0000000009916000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt
Source: java.exe, 00000002.00000002.2568115869.0000000009916000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2568115869.000000000984F000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2570107892.0000000015119000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: java.exe, 00000002.00000002.2568115869.0000000009916000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2568115869.000000000984F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt
Source: java.exe, 00000002.00000002.2568115869.0000000009916000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2568115869.000000000984F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: java.exe, 00000002.00000002.2568115869.0000000009916000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt
Source: java.exe, 00000002.00000002.2568115869.0000000009916000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2568115869.000000000984F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: java.exe, 00000002.00000002.2568115869.0000000009916000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl
Source: java.exe, 00000002.00000002.2568115869.0000000009916000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2568115869.000000000984F000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2570107892.0000000015119000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: java.exe, 00000002.00000002.2568115869.0000000009916000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl
Source: java.exe, 00000002.00000002.2568115869.0000000009916000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2568115869.000000000984F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: java.exe, 00000002.00000002.2568115869.0000000009916000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl
Source: java.exe, 00000002.00000002.2568115869.0000000009916000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2568115869.000000000984F000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2570107892.0000000015119000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: java.exe, 00000002.00000002.2568115869.0000000009750000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://java.oracle.com/
Source: java.exe, 00000002.00000002.2569806424.0000000014BEB000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2570107892.0000000015180000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2568115869.0000000009A10000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000003.1402843770.0000000014C14000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://null.oracle.com/
Source: java.exe, 00000002.00000002.2568115869.0000000009916000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com
Source: java.exe, 00000002.00000002.2568115869.0000000009916000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2568115869.000000000984F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: java.exe, 00000002.00000002.2568115869.0000000009916000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2568115869.000000000984F000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2570107892.0000000015119000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: java.exe, 00000002.00000002.2568115869.0000000009916000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2568115869.000000000984F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X

Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe

Code function: 2_2_0211F5EB

2_2_0211F5EB

Source: classification engine

Classification label: mal60.winJAR@7/3@1/1

Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3800:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1396:120:WilError_03

Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe

File created: C:\Users\user~1\AppData\Local\Temp\hsperfdata_user

Jump to behavior

Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Fattura (4).jar

ReversingLabs: Detection: 31%

Source: java.exe	String found in binary or memory: 0$h`[Lsun/launcher/LauncherHelper;
Source: java.exe	String found in binary or memory: sun/launcher/
Source: java.exe	String found in binary or memory: $sun/launcher/LauncherHelper$StdArg
Source: java.exe	String found in binary or memory: Hsun/launcher/LauncherHelper$SizePrefix
Source: java.exe	String found in binary or memory: Bsun/launcher/LauncherHelper$ResourceBundleHolder&
Source: java.exe	String found in binary or memory: JLjava/lang/Enum<Lsun/launcher/LauncherHelper;>;
Source: java.exe	String found in binary or memory: Lsun/launcher/LauncherHelper;
Source: java.exe	String found in binary or memory: Q()[Lsun/launcher/LauncherHelper;'
Source: java.exe	String found in binary or memory: (Ljava/lang/String;)Lsun/launcher/LauncherHelper;
Source: java.exe	String found in binary or memory: hq(Ljava/util/List<Lsun/launcher/LauncherHelper$StdArg;>;)[Ljava/lang/String;
Source: java.exe	String found in binary or memory: .in-addr.arpa

Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -javaagent:"C:\Users\user~1\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\Fattura (4).jar"" >> C:\cmdlinestart.log 2>&1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe "C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -javaagent:"C:\Users\user~1\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\Fattura (4).jar"
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
Source: C:\Windows\SysWOW64\icacls.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe "C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -javaagent:"C:\Users\user~1\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\Fattura (4).jar"	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M	Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe	Section loaded: ntmarta.dll	Jump to behavior

Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 2_3_151D27E2 push eax; ret	2_3_151D27E9
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 2_3_151D27E2 push eax; ret	2_3_151D27E9
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 2_2_02123292 push es; retn 0005h	2_2_02123297
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 2_2_02123318 push es; retf	2_2_02123323
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 2_2_021217BE push cs; iretd	2_2_021217BF
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 2_2_0207D8F7 push 00000000h; mov dword ptr [esp], esp	2_2_0207D921
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 2_2_0207A20A push ecx; ret	2_2_0207A21A
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 2_2_0207A21B push ecx; ret	2_2_0207A225
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 2_2_0207BB67 push 00000000h; mov dword ptr [esp], esp	2_2_0207BB8D
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 2_2_0207B3B7 push 00000000h; mov dword ptr [esp], esp	2_2_0207B3DD
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 2_2_0207D8E0 push 00000000h; mov dword ptr [esp], esp	2_2_0207D921
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 2_2_0207B947 push 00000000h; mov dword ptr [esp], esp	2_2_0207B96D
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 2_2_0207C477 push 00000000h; mov dword ptr [esp], esp	2_2_0207C49D

Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe

Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: java.exe, 00000002.00000003.1341647834.0000000014665000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: com/sun/corba/se/impl/util/SUNVMCID.classPK
Source: java.exe, 00000002.00000003.1341647834.0000000014665000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: &com/sun/corba/se/impl/util/SUNVMCID.classPK
Source: java.exe, 00000002.00000002.2561531756.00000000006AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [Ljava/lang/VirtualMachineError;
Source: java.exe, 00000002.00000002.2561531756.00000000006AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllgJ-
Source: java.exe, 00000002.00000003.1341647834.0000000014665000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: org/omg/CORBA/OMGVMCID.classPK
Source: java.exe, 00000002.00000002.2561531756.00000000006AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: cjava/lang/VirtualMachineError
Source: java.exe, 00000002.00000003.1341647834.0000000014665000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: java/lang/VirtualMachineError.classPK

Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe

Code function: 2_2_021192F8 LdrInitializeThunk,LdrInitializeThunk,

2_2_021192F8

Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe

Memory protected: page read and write | page guard

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe "C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -javaagent:"C:\Users\user~1\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\Fattura (4).jar"			Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M			Jump to behavior

Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe

Code function: 2_2_020703C0 cpuid

2_2_020703C0

Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\client\jvm.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\hsperfdata_user\4236 VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\resources.jar VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\rt.jar VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\jsse.jar VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\jce.jar VolumeInformation	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 Services File Permissions Weakness	1 Services File Permissions Weakness	1 Services File Permissions Weakness	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	11 Process Injection	1 Disable or Modify Tools	LSASS Memory	21 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	11 Process Injection	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Fattura (4).jar	32%	ReversingLabs	ByteCode-JAVA.Trojan.Ratty
Fattura (4).jar	100%	Avira	JAVA/Ratty.eaklt

Source	Detection	Scanner	Label
http://java.oracle.com/	0%	URL Reputation	safe
http://null.oracle.com/	0%	URL Reputation	safe
http://bugreport.sun.com/bugreport/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
s-part-0015.t-0009.fb-t-msedge.net	13.107.253.43	true	false		unknown
de4.localto.net	116.203.56.216	true	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://java.oracle.com/	java.exe, 00000002.00000002.2568115869.0000000009750000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://null.oracle.com/	java.exe, 00000002.00000002.2569806424.0000000014BEB000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2570107892.0000000015180000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2568115869.0000000009A10000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000003.1402843770.0000000014C14000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://bugreport.sun.com/bugreport/	java.exe, 00000002.00000002.2568115869.00000000097F7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
116.203.56.216	de4.localto.net	Germany		24940	HETZNER-ASDE	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1546101
Start date and time:	2024-10-31 14:08:15 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsfilecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Java) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Fattura (4).jar
Detection:	MAL
Classification:	mal60.winJAR@7/3@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 57% Number of executed functions: 16 Number of non-executed functions: 3
Cookbook Comments:	Found application associated with file extension: .jar

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): azurefd-t-fb-prod.trafficmanager.net, slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, ctldl.windowsupdate.com, azureedge-t-prod.trafficmanager.net, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: Fattura (4).jar

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0015.t-0009.fb-t-msedge.net	file.exe	Get hash	malicious	IcedID	Browse	13.107.253.43
	XYrLOQoLE4.exe	Get hash	malicious	Unknown	Browse	13.107.253.43
	http://uppholldbcloginn.gitbook.io/us/	Get hash	malicious	HTMLPhisher	Browse	13.107.253.43
	https://oaemk-f29f.hmnaitswiaa.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	13.107.253.43
	https://emails.microsoft.com/dc/e_4JGRIDqcoiTU1HR-giCWWkyCmeORqUCO4pEjpDTddrBVlbCteZJj8QfhFvhzGnrSwkFwZUI8U0ElApY3ruN2moaZlprSDGWrxtrbI1MBxlzIbpGFmlWRXVz-DfjyzMo6DjGJvk2NdT1NgnbRCGzTYRw7PzgS1STErkGqov-2A=/MTU3LUdRRS0zODIAAAGVXrvPPFFO4qk2k5S0WBN6iOmgYzwr15ol9HTLY_vuNwgIljWNKTe4HuyrKAtA0lJBatyTgWI=	Get hash	malicious	HTMLPhisher	Browse	13.107.253.43
	https://jpmchase.secure.virtru.com/start/?c=experiment&t=emailtemplate2019-09&s=cb.fraud.support40jpmorgan.com&p=fa9cd416-f12d-4ca6-9ede-e6b8c83c4a51v=3.0.0&d=https3A2F2Fapi.virtru.com2Fstorage2Fapi2Fpolicies2Ffa9cd416-f12d-4ca6-9ede-e6b8c83c4a512Fdata2Fmetadata&dk=yMl90AuSQMEzRCCwV9qeqdksefzqpu7fga3Wagk8u4I3D__;JSMlJSUlJSUlJSUl!!HkjQSg!0uP8FiMYlk3jO60MGS9hLQK-DpGcqhK4tP28hlMpQJ50EIQ5fdHAiEOfq-YjCoK5Zdcyv2Co3yyd4yCft4FhvBrIEKP9$	Get hash	malicious	Unknown	Browse	13.107.253.43
	Odeme_Takvimi_Ocak-2024.xll	Get hash	malicious	Unknown	Browse	13.107.253.43
	Steel and Metal Coil Inquiry Sheet - Copy.xls	Get hash	malicious	Unknown	Browse	13.107.253.43

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HETZNER-ASDE	ORDER REF_47806798 .exe	Get hash	malicious	XWorm	Browse	176.9.162.125
	http://www.thearchiterra.gr/	Get hash	malicious	Unknown	Browse	5.9.110.184
	http://www.thearchiterra.gr/	Get hash	malicious	Unknown	Browse	5.9.110.184
	http://www.thearchiterra.gr/	Get hash	malicious	Unknown	Browse	5.9.110.184
	http://www.thearchiterra.gr/	Get hash	malicious	Unknown	Browse	5.9.110.184
	Payment&WarantyBonds.exe	Get hash	malicious	FormBook	Browse	144.76.190.39
	https://www.mediafire.com/file/oyfycncwen0a3ue/DSP_Plan_Set.zip/file	Get hash	malicious	Unknown	Browse	148.251.20.70
	Payment&WarantyBonds.exe	Get hash	malicious	FormBook	Browse	144.76.190.39
	wZU2edEGL3.elf	Get hash	malicious	Unknown	Browse	144.79.90.34
	http://199.59.243.227	Get hash	malicious	HTMLPhisher	Browse	188.40.167.81

Process:	C:\Program Files (x86)\Java\jre-1.8\bin\java.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.789207449193898
Encrypted:	false
SSDEEP:	3:oFj4I5vpm4USVnn:oJ5b9n
MD5:	4B92BAFEFF0F52EB8DBFBAE43D4553CB
SHA1:	1DBE47A090A8D7E0C8990A83F37038B5AC51992C
SHA-256:	AC4C0B737B06F3905F91D2F587C5184FB022DF03E39C73FA7D805BAB15FEE995
SHA-512:	D5B008116CA32A392D88091885819414D3A404C09F3F76EED1B9CC2B72A34A177DFEDE652D98230E1163B8A9D3D34D9837D2DF0ABCDB0505606DF9F33C186A20
Malicious:	false
Reputation:	low
Preview:	C:\Program Files (x86)\Java\jre-1.8..1730380161410..

C:\Users\user\AppData\Local\Temp\hsperfdata_user\4236

Download File

Process:	C:\Program Files (x86)\Java\jre-1.8\bin\java.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.304125094378308
Encrypted:	false
SSDEEP:	96:iQxrDb8GupKrsII0/6+h59i1tfgDSGpEH41yo1y:iQR8GAKrsII0/6mEtnFH4w
MD5:	10D54783B0A1CCC8B9640EF847259AFB
SHA1:	CC3B41D5EBAFD9B55F6835ECB1C3E25205E224CC
SHA-256:	63C4984762001B18293AC2C22A2EDB8E6E7AB9E3FA2D8ECAB79BA97D860D9C52
SHA-512:	C88D22AB4F5B52B391780C1493B685557CF3483D6AE46AEE8A63655AB5F7548F586D9DAD5722CF5325E2CCB1CE08BC6608F295B2AFB28C71857133B6B06D4795
Malicious:	false
Reputation:	low
Preview:	.........9.............. .......8...........J...0...sun.rt._sync_Inflations.............8...........J...0...sun.rt._sync_Deflations.............@...........J...8...sun.rt._sync_ContendedLockAttempts..r.......8...........J...0...sun.rt._sync_FutileWakeups..........0...........J...(...sun.rt._sync_Parks..i.......@...........J...8...sun.rt._sync_EmptyNotifications.............8...........J...0...sun.rt._sync_Notifications..\.......8...........J...0...sun.rt._sync_SlowEnter..............8...........J...0...sun.rt._sync_SlowExit...............8...........J...0...sun.rt._sync_SlowNotify.............8...........J...0...sun.rt._sync_SlowNotifyAll..........8...........J...0...sun.rt._sync_FailedSpins............@...........J...8...sun.rt._sync_SuccessfulSpins................8...........J...0...sun.rt._sync_PrivateA...............8...........J...0...sun.rt._sync_PrivateB...............@...........J...8...sun.rt._sync_MonInCirculation...............8...........J...0...sun.rt._sync_MonScavenged...

C:\cmdlinestart.log

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF, LF line terminators, with escape sequences
Category:	modified
Size (bytes):	27158
Entropy (8bit):	5.124325246816176
Encrypted:	false
SSDEEP:	192:B/jcKhOnAnArcKI282i1D1ccKD7OJOJOJOJOkcKR0AS:eKhOnAnAYKYKnOJOJOJOJOXKGAS
MD5:	9BBB3414E252E7520299D530412A396A
SHA1:	E17EF5376E195A5F4977F444C22F6452E89F6E2C
SHA-256:	8248B888E7AABBE14E7AB6E641362AD7305B813CE8DA8BEC7ADC9E4DB21C3B2E
SHA-512:	66005B7E110B31319393185B74F7E430361DD023363DE0460478623109299D7329CB26A9B530420DBF63D197938ACA16EAF6EBE94C0EC94481B4CDD45E243083
Malicious:	false
Reputation:	low
Preview:	[09:09:22] [INFO] > .[32m46 packets registered.[0m..[09:09:22] [INFO] > .[32mConnected.[0m..[09:09:23] [WARN] > .[33mLost connection to server.[0m..[09:09:23] [INFO] > .[32mConnected.[0m..[09:09:24] [WARN] > .[33mLost connection to server.[0m..[09:09:24] [INFO] > .[32mConnected.[0m..[09:09:25] [WARN] > .[33mLost connection to server.[0m..[09:09:25] [INFO] > .[32mConnected.[0m..[09:09:25] [WARN] > .[33mLost connection to server.[0m..[09:09:25] [INFO] > .[32mConnected.[0m..[09:09:26] [WARN] > .[33mLost connection to server.[0m..[09:09:26] [INFO] > .[32mConnected.[0m..[09:09:27] [WARN] > .[33mLost connection to server.[0m..[09:09:27] [INFO] > .[32mConnected.[0m..[09:09:27] [WARN] > .[33mLost connection to server.[0m..[09:09:27] [INFO] > .[32mConnected.[0m..[09:09:28] [WARN] > .[33mLost connection to server.[0m..[09:09:28] [INFO] > .[32mConnected.[0m..[09:09:29] [WARN] > .[33mLost connection to server.[0m..[09:09:29] [INFO] > .[32mConnected.[0m..[09:09:29] [WARN] > .[33mLost connection to

Static File Info

General

File type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Entropy (8bit):	7.943134578015914
TrID:	Java Archive (13504/1) 62.80% ZIP compressed archive (8000/1) 37.20%
File name:	Fattura (4).jar
File size:	727'398 bytes
MD5:	10dc49c6f31e40445f4c2cb3f85a3874
SHA1:	6abea67305935a198d131fa1d7d846394b5a94a1
SHA256:	05ef869849225755852d83ae2a61ed95f35b7a1799f1b10c1bbe2516176dd62d
SHA512:	2440794a359673926a74d222014e39830c5510a5544eabb689f64c4656921401972a51fca195c10ad04097daa804224241813b788619ccd21727fe7e65c05b02
SSDEEP:	12288:KEhnew0vPnx/kpYEqPEL+p5YUdl1Y6FpAo4Dp7MDo2UgefSqtDd84/qA:K8SvoYPM+9l1JFpA/97+eqQhd/qA
TLSH:	0FF402E2BD90A6BCFB03F7350D026D13B90E09F79EDAC82A8D761515C826E0917CE695
File Content Preview:	PK.........XCY............C...IIllIlI/lIlIIlIlIl/IIlIlIlIIl/lIllIlIIlI/lIlIlllIIlIIlllIIllI.class.Xy\|UE..>.....I........ `D.... {.........I@6.D........)q@.K@P.s..G.G.u.qtt.FG...y_.{o..3..?..r..>.]]]U]]]}.....D.[.....0.)....G.~Dr.%......"..=^F.].....,t....

File Icon


Icon Hash:	d08c8e8ea2868a54

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-31T14:09:40.825576+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.245.163.56	443	192.168.2.7	49818	TCP
2024-10-31T14:10:19.788041+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.245.163.56	443	192.168.2.7	50065	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 31, 2024 14:09:23.604382992 CET	49726	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:23.609472036 CET	33381	49726	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:23.609546900 CET	49726	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:24.214148998 CET	33381	49726	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:24.214226007 CET	49726	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:24.220370054 CET	49726	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:24.220808983 CET	49728	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:24.225337029 CET	33381	49726	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:24.225867033 CET	33381	49728	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:24.225951910 CET	49728	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:25.560646057 CET	33381	49728	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:25.560785055 CET	49728	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:25.560874939 CET	33381	49728	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:25.560971975 CET	49728	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:25.560971975 CET	49728	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:25.560990095 CET	33381	49728	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:25.561031103 CET	49728	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:25.561470032 CET	49732	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:25.572038889 CET	33381	49728	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:25.572993994 CET	33381	49732	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:25.573079109 CET	49732	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:26.195292950 CET	33381	49732	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:26.195444107 CET	49732	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:26.195714951 CET	49732	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:26.196192980 CET	49738	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:26.200521946 CET	33381	49732	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:26.200992107 CET	33381	49738	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:26.201081038 CET	49738	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:26.804382086 CET	33381	49738	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:26.804523945 CET	49738	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:26.804941893 CET	49738	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:26.805485010 CET	49739	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:26.809731960 CET	33381	49738	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:26.810328007 CET	33381	49739	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:26.810429096 CET	49739	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:27.521528006 CET	33381	49739	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:27.521676064 CET	49739	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:27.522053003 CET	49739	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:27.522455931 CET	49745	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:27.527906895 CET	33381	49739	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:27.527918100 CET	33381	49745	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:27.528021097 CET	49745	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:28.135879993 CET	33381	49745	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:28.135960102 CET	49745	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:28.136259079 CET	49745	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:28.136778116 CET	49751	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:28.141114950 CET	33381	49745	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:28.141644001 CET	33381	49751	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:28.141732931 CET	49751	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:28.744062901 CET	33381	49751	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:28.744116068 CET	49751	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:28.744335890 CET	49751	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:28.744823933 CET	49752	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:28.749119997 CET	33381	49751	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:28.749947071 CET	33381	49752	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:28.750031948 CET	49752	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:29.352185011 CET	33381	49752	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:29.352256060 CET	49752	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:29.361891985 CET	49752	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:29.366935015 CET	33381	49752	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:29.367810965 CET	49758	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:29.372858047 CET	33381	49758	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:29.372932911 CET	49758	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:29.976510048 CET	33381	49758	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:29.976656914 CET	49758	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:29.983755112 CET	49758	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:29.988260031 CET	49764	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:29.989227057 CET	33381	49758	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:29.993364096 CET	33381	49764	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:29.993472099 CET	49764	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:30.603238106 CET	33381	49764	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:30.603354931 CET	49764	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:30.603786945 CET	49764	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:30.604295969 CET	49765	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:30.608671904 CET	33381	49764	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:30.609220982 CET	33381	49765	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:30.609301090 CET	49765	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:31.211519957 CET	33381	49765	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:31.211683035 CET	49765	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:31.211808920 CET	49765	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:31.212244987 CET	49771	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:31.216635942 CET	33381	49765	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:31.217094898 CET	33381	49771	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:31.217302084 CET	49771	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:32.050179958 CET	33381	49771	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:32.050317049 CET	49771	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:32.050616026 CET	49771	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:32.050769091 CET	33381	49771	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:32.050837994 CET	49771	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:32.051110983 CET	49777	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:32.056483984 CET	33381	49771	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:32.056497097 CET	33381	49777	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:32.056684017 CET	49777	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:32.677292109 CET	33381	49777	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:32.677377939 CET	49777	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:32.679543018 CET	49777	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:32.683734894 CET	49778	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:32.684717894 CET	33381	49777	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:32.688822985 CET	33381	49778	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:32.688900948 CET	49778	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:32.697005987 CET	49778	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:32.702104092 CET	33381	49778	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:32.702197075 CET	49778	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:32.727294922 CET	49779	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:32.732527018 CET	33381	49779	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:32.732620001 CET	49779	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:33.343951941 CET	33381	49779	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:33.344108105 CET	49779	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:33.344294071 CET	49779	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:33.344808102 CET	49785	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:33.349189997 CET	33381	49779	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:33.349805117 CET	33381	49785	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:33.349900007 CET	49785	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:33.979938984 CET	33381	49785	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:33.980004072 CET	49785	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:33.980233908 CET	49785	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:33.980739117 CET	49791	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:33.988214970 CET	33381	49785	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:33.988280058 CET	33381	49791	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:33.988482952 CET	49791	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:34.615781069 CET	33381	49791	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:34.615881920 CET	49791	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:34.616085052 CET	49791	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:34.616496086 CET	49792	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:34.621110916 CET	33381	49791	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:34.621301889 CET	33381	49792	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:34.621428013 CET	49792	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:35.216674089 CET	33381	49792	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:35.216793060 CET	49792	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:35.217058897 CET	49792	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:35.217557907 CET	49798	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:35.222031116 CET	33381	49792	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:35.222481966 CET	33381	49798	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:35.222578049 CET	49798	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:35.846586943 CET	33381	49798	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:35.846668005 CET	49798	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:35.846884966 CET	49798	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:35.847395897 CET	49804	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:35.851613998 CET	33381	49798	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:35.852396011 CET	33381	49804	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:35.852479935 CET	49804	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:36.481916904 CET	33381	49804	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:36.481985092 CET	49804	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:36.482175112 CET	49804	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:36.482626915 CET	49805	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:36.486984968 CET	33381	49804	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:36.487416029 CET	33381	49805	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:36.487500906 CET	49805	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:37.115236998 CET	33381	49805	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:37.115375042 CET	49805	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:37.115547895 CET	49805	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:37.116040945 CET	49811	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:37.120337009 CET	33381	49805	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:37.121249914 CET	33381	49811	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:37.121351004 CET	49811	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:37.726223946 CET	33381	49811	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:37.726491928 CET	49811	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:37.726739883 CET	49811	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:37.727214098 CET	49817	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:37.731667995 CET	33381	49811	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:37.732017994 CET	33381	49817	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:37.732125998 CET	49817	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:38.334522963 CET	33381	49817	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:38.334650993 CET	49817	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:38.334829092 CET	49817	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:38.335347891 CET	49819	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:38.340365887 CET	33381	49817	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:38.340682030 CET	33381	49819	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:38.340749025 CET	49819	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:39.161189079 CET	33381	49819	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:39.161315918 CET	49819	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:39.161504030 CET	49819	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:39.161916018 CET	49826	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:39.162688017 CET	33381	49819	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:39.162760019 CET	49819	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:39.166462898 CET	33381	49819	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:39.166924953 CET	33381	49826	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:39.167009115 CET	49826	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:39.770126104 CET	33381	49826	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:39.770195961 CET	49826	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:39.770442009 CET	49826	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:39.770932913 CET	49833	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:39.775480986 CET	33381	49826	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:39.775996923 CET	33381	49833	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:39.776211977 CET	49833	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:40.378355026 CET	33381	49833	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:40.378453016 CET	49833	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:40.378681898 CET	49833	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:40.379342079 CET	49839	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:40.384155989 CET	33381	49833	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:40.384696960 CET	33381	49839	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:40.384804964 CET	49839	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:40.986758947 CET	33381	49839	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:40.986833096 CET	49839	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:40.987025023 CET	49839	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:40.987493992 CET	49842	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:40.991857052 CET	33381	49839	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:40.992628098 CET	33381	49842	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:40.992758989 CET	49842	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:41.595761061 CET	33381	49842	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:41.599414110 CET	49842	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:41.608460903 CET	49842	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:41.609163046 CET	49848	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:41.613327026 CET	33381	49842	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:41.614088058 CET	33381	49848	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:41.614500046 CET	49848	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:41.694797993 CET	49848	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:41.699872017 CET	33381	49848	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:41.700033903 CET	49848	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:41.704510927 CET	49849	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:41.709455967 CET	33381	49849	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:41.709702015 CET	49849	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:41.714529991 CET	49849	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:41.718286037 CET	49850	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:41.719590902 CET	33381	49849	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:41.719660044 CET	49849	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:41.723433018 CET	33381	49850	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:41.723597050 CET	49850	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:41.728818893 CET	49850	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:41.733956099 CET	33381	49850	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:41.734080076 CET	49850	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:41.736303091 CET	49851	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:41.741396904 CET	33381	49851	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:41.741494894 CET	49851	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:41.750319958 CET	49851	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:41.750785112 CET	49852	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:41.755341053 CET	33381	49851	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:41.755398035 CET	49851	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:41.755650043 CET	33381	49852	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:41.755883932 CET	49852	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:42.358355999 CET	33381	49852	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:42.358422995 CET	49852	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:42.358644962 CET	49852	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:42.359188080 CET	49858	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:42.363604069 CET	33381	49852	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:42.363965034 CET	33381	49858	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:42.364126921 CET	49858	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:42.967552900 CET	33381	49858	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:42.967686892 CET	49858	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:42.967832088 CET	49858	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:42.968262911 CET	49859	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:42.973042011 CET	33381	49858	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:42.973323107 CET	33381	49859	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:42.973417997 CET	49859	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:43.656196117 CET	33381	49859	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:43.656277895 CET	49859	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:43.656486988 CET	49859	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:43.656941891 CET	49865	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:43.661472082 CET	33381	49859	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:43.661851883 CET	33381	49865	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:43.661988020 CET	49865	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:44.355541945 CET	33381	49865	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:44.355601072 CET	49865	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:44.355791092 CET	49865	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:44.356256962 CET	49870	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:44.360924959 CET	33381	49865	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:44.361191988 CET	33381	49870	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:44.361272097 CET	49870	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:45.129913092 CET	33381	49870	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:45.129966021 CET	49870	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:45.130265951 CET	49870	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:45.130764008 CET	49872	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:45.135453939 CET	33381	49870	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:45.136255980 CET	33381	49872	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:45.136327982 CET	49872	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:45.743299007 CET	33381	49872	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:45.743417025 CET	49872	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:45.743613958 CET	49872	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:45.744132042 CET	49878	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:45.748436928 CET	33381	49872	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:45.748980999 CET	33381	49878	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:45.749336004 CET	49878	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:46.362303972 CET	33381	49878	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:46.362442017 CET	49878	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:46.362688065 CET	49878	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:46.363229990 CET	49884	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:46.367786884 CET	33381	49878	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:46.368067026 CET	33381	49884	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:46.368186951 CET	49884	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:46.976212025 CET	33381	49884	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:46.976305962 CET	49884	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:46.976569891 CET	49884	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:46.976924896 CET	49888	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:46.981471062 CET	33381	49884	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:46.981885910 CET	33381	49888	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:46.981970072 CET	49888	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:47.586093903 CET	33381	49888	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:47.586172104 CET	49888	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:47.586560011 CET	49888	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:47.587151051 CET	49891	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:47.591414928 CET	33381	49888	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:47.592408895 CET	33381	49891	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:47.592550039 CET	49891	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:48.201966047 CET	33381	49891	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:48.202086926 CET	49891	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:48.202336073 CET	49891	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:48.202867985 CET	49897	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:48.207206964 CET	33381	49891	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:48.207889080 CET	33381	49897	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:48.207981110 CET	49897	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:48.811933041 CET	33381	49897	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:48.812014103 CET	49897	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:48.812228918 CET	49897	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:48.812700033 CET	49901	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:48.816996098 CET	33381	49897	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:48.817517042 CET	33381	49901	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:48.817604065 CET	49901	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:49.447714090 CET	33381	49901	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:49.447869062 CET	49901	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:49.448098898 CET	49901	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:49.448612928 CET	49904	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:49.452868938 CET	33381	49901	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:49.453691006 CET	33381	49904	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:49.453809977 CET	49904	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:50.055041075 CET	33381	49904	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:50.055201054 CET	49904	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:50.055449963 CET	49904	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:50.056016922 CET	49910	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:50.060349941 CET	33381	49904	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:50.061043978 CET	33381	49910	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:50.061144114 CET	49910	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:50.688107967 CET	33381	49910	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:50.688241959 CET	49910	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:50.688466072 CET	49910	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:50.688996077 CET	49915	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:50.693383932 CET	33381	49910	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:50.693754911 CET	33381	49915	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:50.693850040 CET	49915	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:51.297086954 CET	33381	49915	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:51.297250986 CET	49915	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:51.297434092 CET	49915	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:51.297919989 CET	49917	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:51.302290916 CET	33381	49915	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:51.302710056 CET	33381	49917	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:51.302891970 CET	49917	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:51.912664890 CET	33381	49917	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:51.912853956 CET	49917	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:51.913042068 CET	49917	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:51.913528919 CET	49923	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:51.917783976 CET	33381	49917	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:51.918370962 CET	33381	49923	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:51.918467045 CET	49923	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:52.527231932 CET	33381	49923	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:52.527306080 CET	49923	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:52.527484894 CET	49923	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:52.527961969 CET	49924	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:52.533010960 CET	33381	49923	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:52.533524990 CET	33381	49924	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:52.533610106 CET	49924	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:53.139271021 CET	33381	49924	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:53.143445015 CET	49924	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:53.143639088 CET	49924	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:53.144121885 CET	49930	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:53.149523973 CET	33381	49924	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:53.149538040 CET	33381	49930	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:53.149689913 CET	49930	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:53.758644104 CET	33381	49930	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:53.758900881 CET	49930	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:53.758900881 CET	49930	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:53.760351896 CET	49936	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:53.764703035 CET	33381	49930	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:53.766587019 CET	33381	49936	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:53.766659021 CET	49936	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:54.363732100 CET	33381	49936	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:54.363791943 CET	49936	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:54.363985062 CET	49936	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:54.364418983 CET	49937	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:54.368930101 CET	33381	49936	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:54.369427919 CET	33381	49937	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:54.369498014 CET	49937	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:54.972225904 CET	33381	49937	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:54.972392082 CET	49937	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:54.976346970 CET	49937	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:54.977195024 CET	49943	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:54.981419086 CET	33381	49937	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:54.982089996 CET	33381	49943	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:54.982181072 CET	49943	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:55.583679914 CET	33381	49943	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:55.583755016 CET	49943	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:55.583949089 CET	49943	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:55.584507942 CET	49949	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:55.588814974 CET	33381	49943	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:55.589334011 CET	33381	49949	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:55.589410067 CET	49949	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:56.202069998 CET	33381	49949	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:56.202127934 CET	49949	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:56.205744982 CET	49949	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:56.210072994 CET	49950	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:56.217828989 CET	33381	49949	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:56.223300934 CET	33381	49950	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:56.223454952 CET	49950	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:56.223659039 CET	49950	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:56.230988026 CET	33381	49950	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:56.233375072 CET	33381	49950	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:56.233463049 CET	49950	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:56.245731115 CET	49951	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:56.251831055 CET	33381	49951	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:56.251914024 CET	49951	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:57.588813066 CET	33381	49951	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:57.588912964 CET	49951	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:57.589023113 CET	33381	49951	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:57.589081049 CET	49951	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:57.589092970 CET	33381	49951	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:57.589127064 CET	49951	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:57.589334011 CET	49951	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:57.589888096 CET	49956	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:57.598340034 CET	33381	49951	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:57.598393917 CET	33381	49956	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:57.598470926 CET	49956	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:58.225358009 CET	33381	49956	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:58.225522041 CET	49956	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:58.225790024 CET	49956	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:58.226367950 CET	49962	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:58.230834007 CET	33381	49956	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:58.231254101 CET	33381	49962	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:58.231338978 CET	49962	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:58.837660074 CET	33381	49962	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:58.837754011 CET	49962	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:58.838069916 CET	49962	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:58.838596106 CET	49966	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:58.842914104 CET	33381	49962	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:58.843607903 CET	33381	49966	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:58.843686104 CET	49966	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:59.441576004 CET	33381	49966	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:59.441710949 CET	49966	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:59.441956997 CET	49966	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:59.442429066 CET	49970	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:09:59.446855068 CET	33381	49966	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:59.447354078 CET	33381	49970	116.203.56.216	192.168.2.7
Oct 31, 2024 14:09:59.447448015 CET	49970	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:00.057625055 CET	33381	49970	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:00.057830095 CET	49970	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:00.058074951 CET	49970	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:00.058558941 CET	49975	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:00.062910080 CET	33381	49970	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:00.063348055 CET	33381	49975	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:00.063426018 CET	49975	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:00.673470974 CET	33381	49975	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:00.673540115 CET	49975	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:00.673819065 CET	49975	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:00.674477100 CET	49979	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:00.678596973 CET	33381	49975	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:00.679331064 CET	33381	49979	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:00.679408073 CET	49979	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:01.289381027 CET	33381	49979	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:01.289518118 CET	49979	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:01.289712906 CET	49979	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:01.290268898 CET	49983	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:01.294528008 CET	33381	49979	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:01.295433998 CET	33381	49983	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:01.295542955 CET	49983	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:01.901153088 CET	33381	49983	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:01.901294947 CET	49983	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:01.901499033 CET	49983	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:01.901948929 CET	49986	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:01.906574011 CET	33381	49983	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:01.907089949 CET	33381	49986	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:01.907172918 CET	49986	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:02.724966049 CET	33381	49986	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:02.725025892 CET	49986	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:02.725296974 CET	49986	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:02.725678921 CET	33381	49986	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:02.725737095 CET	49986	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:02.725862026 CET	49992	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:02.730685949 CET	33381	49986	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:02.731051922 CET	33381	49992	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:02.731146097 CET	49992	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:03.333997011 CET	33381	49992	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:03.334095001 CET	49992	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:03.334270000 CET	49992	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:03.334662914 CET	49997	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:03.339081049 CET	33381	49992	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:03.339544058 CET	33381	49997	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:03.339616060 CET	49997	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:03.942251921 CET	33381	49997	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:03.942374945 CET	49997	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:03.942573071 CET	49997	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:03.943025112 CET	50001	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:03.948635101 CET	33381	49997	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:03.949235916 CET	33381	50001	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:03.949704885 CET	50001	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:04.559418917 CET	33381	50001	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:04.559506893 CET	50001	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:04.562741041 CET	50001	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:04.562742949 CET	50005	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:04.567481995 CET	33381	50001	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:04.567564011 CET	33381	50005	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:04.567643881 CET	50005	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:05.169492960 CET	33381	50005	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:05.169740915 CET	50005	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:05.169787884 CET	50005	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:05.170228958 CET	50010	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:05.175021887 CET	33381	50005	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:05.175307035 CET	33381	50010	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:05.175386906 CET	50010	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:05.823019028 CET	33381	50010	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:05.823101997 CET	50010	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:05.823338985 CET	50010	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:05.823791027 CET	50015	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:05.828267097 CET	33381	50010	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:05.828835964 CET	33381	50015	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:05.828918934 CET	50015	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:06.438055038 CET	33381	50015	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:06.438205957 CET	50015	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:06.438424110 CET	50015	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:06.438920975 CET	50018	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:06.443175077 CET	33381	50015	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:06.443730116 CET	33381	50018	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:06.443821907 CET	50018	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:07.058248043 CET	33381	50018	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:07.058454037 CET	50018	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:07.058646917 CET	50018	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:07.059066057 CET	50023	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:07.063391924 CET	33381	50018	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:07.063844919 CET	33381	50023	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:07.063922882 CET	50023	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:07.678446054 CET	33381	50023	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:07.678518057 CET	50023	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:07.678862095 CET	50023	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:07.679593086 CET	50027	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:07.684094906 CET	33381	50023	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:07.684428930 CET	33381	50027	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:07.684514999 CET	50027	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:08.287398100 CET	33381	50027	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:08.287549973 CET	50027	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:08.287764072 CET	50027	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:08.288275003 CET	50031	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:08.293179035 CET	33381	50027	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:08.293261051 CET	33381	50031	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:08.293359041 CET	50031	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:08.902571917 CET	33381	50031	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:08.902858973 CET	50031	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:08.902945995 CET	50031	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:08.903484106 CET	50036	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:08.908644915 CET	33381	50031	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:08.909183979 CET	33381	50036	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:08.909279108 CET	50036	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:09.503782988 CET	33381	50036	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:09.503885031 CET	50036	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:09.504106998 CET	50036	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:09.504599094 CET	50040	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:09.508865118 CET	33381	50036	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:09.509391069 CET	33381	50040	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:09.509485960 CET	50040	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:10.139353991 CET	33381	50040	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:10.143394947 CET	50040	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:10.143395901 CET	50040	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:10.143405914 CET	50044	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:10.148365021 CET	33381	50040	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:10.148380041 CET	33381	50044	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:10.148477077 CET	50044	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:10.749212980 CET	33381	50044	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:10.749293089 CET	50044	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:10.749697924 CET	50044	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:10.750798941 CET	50049	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:10.754950047 CET	33381	50044	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:10.755642891 CET	33381	50049	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:10.755728006 CET	50049	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:11.358458996 CET	33381	50049	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:11.358524084 CET	50049	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:11.358776093 CET	50049	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:11.359622002 CET	50053	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:11.365974903 CET	33381	50049	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:11.365989923 CET	33381	50053	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:11.366080046 CET	50053	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:11.967694044 CET	33381	50053	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:11.967900038 CET	50053	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:11.968023062 CET	50053	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:11.968461037 CET	50055	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:11.972898960 CET	33381	50053	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:11.973453999 CET	33381	50055	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:11.973541975 CET	50055	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:12.570190907 CET	33381	50055	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:12.570302963 CET	50055	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:12.570522070 CET	50055	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:12.571016073 CET	50056	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:12.575309038 CET	33381	50055	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:12.575907946 CET	33381	50056	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:12.576020956 CET	50056	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:13.195765972 CET	33381	50056	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:13.195949078 CET	50056	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:13.197251081 CET	50056	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:13.197921038 CET	50057	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:13.202120066 CET	33381	50056	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:13.203083992 CET	33381	50057	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:13.203190088 CET	50057	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:13.835378885 CET	33381	50057	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:13.835505009 CET	50057	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:13.835736990 CET	50057	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:13.837215900 CET	50058	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:13.840811968 CET	33381	50057	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:13.842439890 CET	33381	50058	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:13.842565060 CET	50058	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:14.472664118 CET	33381	50058	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:14.472804070 CET	50058	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:14.473031044 CET	50058	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:14.474337101 CET	50059	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:14.477855921 CET	33381	50058	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:14.479224920 CET	33381	50059	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:14.479335070 CET	50059	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:15.082272053 CET	33381	50059	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:15.082360983 CET	50059	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:15.082566977 CET	50059	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:15.083085060 CET	50060	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:15.088140011 CET	33381	50059	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:15.088571072 CET	33381	50060	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:15.088664055 CET	50060	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:16.310957909 CET	33381	50060	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:16.311012030 CET	33381	50060	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:16.311069012 CET	33381	50060	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:16.311228037 CET	50060	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:16.311228037 CET	50060	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:16.311228037 CET	50060	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:16.311331034 CET	50060	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:16.311805010 CET	50061	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:16.320494890 CET	33381	50060	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:16.320524931 CET	33381	50061	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:16.320709944 CET	50061	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:16.917994976 CET	33381	50061	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:16.918252945 CET	50061	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:16.918487072 CET	50061	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:16.919013977 CET	50062	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:16.923327923 CET	33381	50061	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:16.923841000 CET	33381	50062	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:16.924066067 CET	50062	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:17.524821997 CET	33381	50062	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:17.525078058 CET	50062	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:17.525147915 CET	50062	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:17.525623083 CET	50063	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:17.529938936 CET	33381	50062	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:17.530509949 CET	33381	50063	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:17.530606985 CET	50063	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:18.140789032 CET	33381	50063	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:18.140970945 CET	50063	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:18.141247034 CET	50063	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:18.141621113 CET	50064	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:18.146003008 CET	33381	50063	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:18.146586895 CET	33381	50064	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:18.146677017 CET	50064	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:18.754584074 CET	33381	50064	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:18.754713058 CET	50064	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:18.754946947 CET	50064	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:18.755431890 CET	50066	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:18.759999037 CET	33381	50064	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:18.760252953 CET	33381	50066	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:18.760335922 CET	50066	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:19.369740009 CET	33381	50066	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:19.369829893 CET	50066	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:19.370018959 CET	50066	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:19.370459080 CET	50067	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:19.375098944 CET	33381	50066	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:19.375912905 CET	33381	50067	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:19.376005888 CET	50067	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:19.978327036 CET	33381	50067	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:19.978393078 CET	50067	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:19.978759050 CET	50067	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:19.979234934 CET	50068	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:19.983606100 CET	33381	50067	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:19.984335899 CET	33381	50068	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:19.984411001 CET	50068	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:20.589030027 CET	33381	50068	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:20.589104891 CET	50068	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:20.589410067 CET	50068	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:20.589854956 CET	50069	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:20.594445944 CET	33381	50068	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:20.594907999 CET	33381	50069	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:20.594995022 CET	50069	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:22.240338087 CET	33381	50069	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:22.240514040 CET	50069	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:22.240546942 CET	33381	50069	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:22.240593910 CET	50069	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:22.240715981 CET	50069	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:22.240837097 CET	33381	50069	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:22.240880013 CET	50069	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:22.240988016 CET	33381	50069	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:22.241019964 CET	50069	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:22.241251945 CET	50070	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:22.245500088 CET	33381	50069	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:22.250763893 CET	33381	50070	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:22.250879049 CET	50070	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:22.860019922 CET	33381	50070	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:22.860090971 CET	50070	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:22.860280991 CET	50070	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:22.860727072 CET	50071	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:22.865071058 CET	33381	50070	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:22.865462065 CET	33381	50071	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:22.865535021 CET	50071	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:23.462366104 CET	33381	50071	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:23.462449074 CET	50071	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:23.462690115 CET	50071	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:23.463344097 CET	50072	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:23.467616081 CET	33381	50071	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:23.468306065 CET	33381	50072	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:23.468396902 CET	50072	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:24.070552111 CET	33381	50072	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:24.070662022 CET	50072	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:24.070875883 CET	50072	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:24.072032928 CET	50073	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:24.076006889 CET	33381	50072	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:24.076899052 CET	33381	50073	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:24.076983929 CET	50073	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:24.681454897 CET	33381	50073	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:24.681710005 CET	50073	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:24.681834936 CET	50073	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:24.682298899 CET	50074	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:24.686888933 CET	33381	50073	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:24.687375069 CET	33381	50074	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:24.687464952 CET	50074	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:25.283951998 CET	33381	50074	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:25.284074068 CET	50074	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:25.284301996 CET	50074	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:25.284813881 CET	50075	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:25.289163113 CET	33381	50074	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:25.290750027 CET	33381	50075	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:25.290858030 CET	50075	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:25.899868965 CET	33381	50075	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:25.900253057 CET	50075	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:25.900253057 CET	50075	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:25.901382923 CET	50076	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:25.905224085 CET	33381	50075	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:25.906438112 CET	33381	50076	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:25.906577110 CET	50076	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:26.509012938 CET	33381	50076	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:26.509166002 CET	50076	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:26.509413004 CET	50076	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:26.509958982 CET	50077	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:26.514175892 CET	33381	50076	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:26.515057087 CET	33381	50077	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:26.515146971 CET	50077	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:27.631675005 CET	33381	50077	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:27.631829977 CET	50077	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:27.631839991 CET	33381	50077	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:27.631894112 CET	50077	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:27.632003069 CET	33381	50077	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:27.632045031 CET	50077	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:27.634064913 CET	50077	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:27.634556055 CET	50078	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:27.641248941 CET	33381	50077	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:27.641259909 CET	33381	50078	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:27.641376019 CET	50078	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:28.248775005 CET	33381	50078	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:28.248862028 CET	50078	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:28.250623941 CET	50078	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:28.255083084 CET	50079	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:28.255800009 CET	33381	50078	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:28.260673046 CET	33381	50079	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:28.260772943 CET	50079	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:28.867237091 CET	33381	50079	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:28.867408991 CET	50079	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:28.867608070 CET	50079	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:28.868154049 CET	50080	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:28.872864962 CET	33381	50079	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:28.873337030 CET	33381	50080	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:28.873421907 CET	50080	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:29.475250006 CET	33381	50080	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:29.475518942 CET	50080	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:29.475711107 CET	50080	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:29.476253033 CET	50081	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:29.480571985 CET	33381	50080	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:29.481447935 CET	33381	50081	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:29.481543064 CET	50081	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:30.085764885 CET	33381	50081	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:30.085927963 CET	50081	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:30.086203098 CET	50081	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:30.086738110 CET	50082	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:30.093223095 CET	33381	50081	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:30.094305038 CET	33381	50082	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:30.094419956 CET	50082	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:30.698561907 CET	33381	50082	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:30.698734999 CET	50082	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:30.743469954 CET	50082	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:30.744029045 CET	50083	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:30.748518944 CET	33381	50082	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:30.748989105 CET	33381	50083	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:30.749084949 CET	50083	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:31.351528883 CET	33381	50083	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:31.351686954 CET	50083	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:31.351948023 CET	50083	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:31.352596998 CET	50084	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:31.356894016 CET	33381	50083	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:31.357557058 CET	33381	50084	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:31.357642889 CET	50084	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:31.963330984 CET	33381	50084	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:31.963500023 CET	50084	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:31.963641882 CET	50084	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:31.964164019 CET	50085	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:31.968472004 CET	33381	50084	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:31.968959093 CET	33381	50085	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:31.969053030 CET	50085	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:32.577949047 CET	33381	50085	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:32.578026056 CET	50085	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:32.578201056 CET	50085	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:32.578821898 CET	50086	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:32.583221912 CET	33381	50085	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:32.584042072 CET	33381	50086	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:32.584198952 CET	50086	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:33.201128006 CET	33381	50086	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:33.201303005 CET	50086	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:33.201462984 CET	50086	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:33.202035904 CET	50087	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:33.207667112 CET	33381	50086	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:33.207691908 CET	33381	50087	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:33.207791090 CET	50087	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:33.812635899 CET	33381	50087	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:33.812807083 CET	50087	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:33.813071966 CET	50087	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:33.813625097 CET	50088	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:33.818305016 CET	33381	50087	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:33.818417072 CET	33381	50088	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:33.818785906 CET	50088	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:34.657741070 CET	33381	50088	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:34.657924891 CET	50088	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:34.658009052 CET	33381	50088	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:34.658057928 CET	50088	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:34.658134937 CET	50088	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:34.658725023 CET	50089	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:34.667639971 CET	33381	50088	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:34.667824984 CET	33381	50089	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:34.668407917 CET	50089	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:35.271143913 CET	33381	50089	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:35.271330118 CET	50089	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:35.271527052 CET	50089	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:35.272118092 CET	50090	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:35.276433945 CET	33381	50089	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:35.276962042 CET	33381	50090	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:35.277055979 CET	50090	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:35.884903908 CET	33381	50090	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:35.885061979 CET	50090	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:35.885277987 CET	50090	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:35.885788918 CET	50091	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:35.890122890 CET	33381	50090	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:35.891057014 CET	33381	50091	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:35.891292095 CET	50091	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:36.499628067 CET	33381	50091	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:36.499851942 CET	50091	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:36.499999046 CET	50091	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:36.500503063 CET	50092	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:36.504786015 CET	33381	50091	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:36.505667925 CET	33381	50092	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:36.505837917 CET	50092	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:37.110625029 CET	33381	50092	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:37.110723019 CET	50092	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:37.110987902 CET	50092	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:37.111568928 CET	50093	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:37.116374969 CET	33381	50092	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:37.117117882 CET	33381	50093	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:37.117225885 CET	50093	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:37.717900991 CET	33381	50093	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:37.718063116 CET	50093	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:37.718266964 CET	50093	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:37.718765020 CET	50094	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:37.723236084 CET	33381	50093	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:37.724230051 CET	33381	50094	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:37.724319935 CET	50094	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:38.333502054 CET	33381	50094	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:38.333657980 CET	50094	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:38.333834887 CET	50094	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:38.334352970 CET	50095	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:38.339221001 CET	33381	50094	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:38.339235067 CET	33381	50095	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:38.339366913 CET	50095	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:38.950331926 CET	33381	50095	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:38.950515032 CET	50095	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:38.951111078 CET	50095	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:38.951685905 CET	50096	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:38.955888987 CET	33381	50095	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:38.956542015 CET	33381	50096	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:38.956635952 CET	50096	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:39.558695078 CET	33381	50096	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:39.558880091 CET	50096	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:39.570694923 CET	50096	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:39.571255922 CET	50097	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:39.575813055 CET	33381	50096	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:39.576086998 CET	33381	50097	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:39.576198101 CET	50097	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:39.606273890 CET	50097	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:39.607988119 CET	50098	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:39.611251116 CET	33381	50097	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:39.611326933 CET	50097	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:39.612854004 CET	33381	50098	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:39.612961054 CET	50098	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:39.613492966 CET	50098	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:39.615351915 CET	50099	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:39.619257927 CET	33381	50098	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:39.620204926 CET	33381	50099	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:39.620282888 CET	50099	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:39.620290041 CET	50098	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:39.620822906 CET	50099	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:39.623827934 CET	50100	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:39.625735998 CET	33381	50099	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:39.625791073 CET	50099	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:39.628703117 CET	33381	50100	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:39.628772974 CET	50100	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:39.630320072 CET	50100	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:39.635745049 CET	33381	50100	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:39.635816097 CET	50100	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:39.640678883 CET	50101	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:39.645569086 CET	33381	50101	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:39.645668030 CET	50101	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:39.654334068 CET	50101	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:39.659841061 CET	33381	50101	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:39.659928083 CET	50101	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:39.663616896 CET	50102	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:39.668540001 CET	33381	50102	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:39.668613911 CET	50102	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:40.276597023 CET	33381	50102	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:40.276921988 CET	50102	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:40.277214050 CET	50102	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:40.277822971 CET	50103	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:40.282069921 CET	33381	50102	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:40.282668114 CET	33381	50103	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:40.282815933 CET	50103	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:40.884887934 CET	33381	50103	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:40.885150909 CET	50103	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:40.885351896 CET	50103	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:40.885979891 CET	50104	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:40.890115023 CET	33381	50103	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:40.890973091 CET	33381	50104	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:40.891119003 CET	50104	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:41.503506899 CET	33381	50104	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:41.503653049 CET	50104	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:41.509147882 CET	50104	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:41.509798050 CET	50105	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:41.514048100 CET	33381	50104	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:41.514700890 CET	33381	50105	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:41.514802933 CET	50105	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:42.120929956 CET	33381	50105	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:42.121181011 CET	50105	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:42.121459007 CET	50105	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:42.122581959 CET	50106	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:42.127012968 CET	33381	50105	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:42.127479076 CET	33381	50106	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:42.127562046 CET	50106	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:42.757149935 CET	33381	50106	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:42.757396936 CET	50106	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:42.757638931 CET	50106	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:42.758091927 CET	50107	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:42.762649059 CET	33381	50106	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:42.763114929 CET	33381	50107	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:42.763277054 CET	50107	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:43.359110117 CET	33381	50107	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:43.359236956 CET	50107	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:43.359400034 CET	50107	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:43.359941959 CET	50108	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:43.364510059 CET	33381	50107	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:43.364906073 CET	33381	50108	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:43.365010977 CET	50108	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:43.966095924 CET	33381	50108	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:43.966172934 CET	50108	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:43.966427088 CET	50108	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:43.966937065 CET	50109	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:43.971213102 CET	33381	50108	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:43.971817017 CET	33381	50109	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:43.971915960 CET	50109	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:44.581501961 CET	33381	50109	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:44.581726074 CET	50109	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:44.581907034 CET	50109	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:44.582562923 CET	50110	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:44.586807966 CET	33381	50109	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:44.587625980 CET	33381	50110	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:44.587735891 CET	50110	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:45.206494093 CET	33381	50110	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:45.206630945 CET	50110	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:45.206814051 CET	50110	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:45.207276106 CET	50111	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:45.211673021 CET	33381	50110	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:45.212388039 CET	33381	50111	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:45.212491989 CET	50111	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:45.822227955 CET	33381	50111	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:45.822359085 CET	50111	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:45.822503090 CET	50111	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:45.822962046 CET	50112	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:45.827212095 CET	33381	50111	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:45.827773094 CET	33381	50112	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:45.827909946 CET	50112	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:46.439410925 CET	33381	50112	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:46.439771891 CET	50112	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:46.439771891 CET	50112	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:46.440216064 CET	50113	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:46.444768906 CET	33381	50112	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:46.445323944 CET	33381	50113	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:46.445415974 CET	50113	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:47.054718018 CET	33381	50113	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:47.054833889 CET	50113	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:47.055037022 CET	50113	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:47.055552006 CET	50114	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:47.059928894 CET	33381	50113	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:47.061095953 CET	33381	50114	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:47.061189890 CET	50114	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:47.855468035 CET	33381	50114	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:47.855637074 CET	50114	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:47.856106997 CET	50114	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:47.856692076 CET	50115	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:47.865901947 CET	33381	50114	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:47.866343021 CET	33381	50115	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:47.866453886 CET	50115	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:48.471710920 CET	33381	50115	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:48.471853971 CET	50115	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:48.472069979 CET	50115	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:48.472589970 CET	50116	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:48.477147102 CET	33381	50115	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:48.477443933 CET	33381	50116	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:48.477523088 CET	50116	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:49.079401016 CET	33381	50116	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:49.079577923 CET	50116	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:49.079760075 CET	50116	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:49.080363035 CET	50117	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:49.084728956 CET	33381	50116	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:49.085314989 CET	33381	50117	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:49.085412025 CET	50117	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:49.706264019 CET	33381	50117	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:49.706414938 CET	50117	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:49.706629038 CET	50117	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:49.707149982 CET	50118	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:49.711401939 CET	33381	50117	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:49.712025881 CET	33381	50118	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:49.712129116 CET	50118	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:50.314706087 CET	33381	50118	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:50.314944983 CET	50118	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:50.315046072 CET	50118	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:50.315592051 CET	50119	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:50.323451042 CET	33381	50118	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:50.323472023 CET	33381	50119	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:50.323623896 CET	50119	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:50.931166887 CET	33381	50119	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:50.931257963 CET	50119	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:50.931447983 CET	50119	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:50.931910992 CET	50120	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:50.936300039 CET	33381	50119	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:50.936697960 CET	33381	50120	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:50.936770916 CET	50120	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:51.570525885 CET	33381	50120	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:51.570591927 CET	50120	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:51.570769072 CET	50120	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:51.571201086 CET	50121	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:51.575783968 CET	33381	50120	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:51.576193094 CET	33381	50121	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:51.576277971 CET	50121	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:52.205143929 CET	33381	50121	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:52.205305099 CET	50121	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:52.205602884 CET	50121	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:52.206254959 CET	50122	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:52.210578918 CET	33381	50121	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:52.211107016 CET	33381	50122	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:52.211190939 CET	50122	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:52.816385984 CET	33381	50122	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:52.816621065 CET	50122	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:52.816844940 CET	50122	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:52.817395926 CET	50123	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:52.822988033 CET	33381	50122	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:52.823873043 CET	33381	50123	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:52.823956966 CET	50123	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:53.446902990 CET	33381	50123	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:53.446994066 CET	50123	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:53.447360039 CET	50123	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:53.447945118 CET	50124	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:53.452214003 CET	33381	50123	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:53.452872992 CET	33381	50124	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:53.452970028 CET	50124	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:54.061574936 CET	33381	50124	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:54.061646938 CET	50124	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:54.065016985 CET	50124	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:54.065500021 CET	50125	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:54.069834948 CET	33381	50124	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:54.070254087 CET	33381	50125	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:54.070318937 CET	50125	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:54.682049990 CET	33381	50125	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:54.682128906 CET	50125	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:54.682363987 CET	50125	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:54.683634996 CET	50126	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:54.687352896 CET	33381	50125	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:54.688568115 CET	33381	50126	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:54.688657999 CET	50126	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:55.298849106 CET	33381	50126	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:55.299097061 CET	50126	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:55.299323082 CET	50126	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:55.304182053 CET	33381	50126	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:55.305437088 CET	50127	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:55.310370922 CET	33381	50127	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:55.310516119 CET	50127	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:55.922812939 CET	33381	50127	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:55.923070908 CET	50127	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:55.923135042 CET	50127	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:55.923616886 CET	50128	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:55.928673029 CET	33381	50127	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:55.928688049 CET	33381	50128	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:55.928796053 CET	50128	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:56.538853884 CET	33381	50128	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:56.538959980 CET	50128	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:56.539235115 CET	50128	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:56.539714098 CET	50129	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:56.544411898 CET	33381	50128	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:56.545211077 CET	33381	50129	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:56.545304060 CET	50129	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:57.154140949 CET	33381	50129	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:57.154269934 CET	50129	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:57.154467106 CET	50129	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:57.154947996 CET	50130	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:57.159377098 CET	33381	50129	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:57.159818888 CET	33381	50130	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:57.159905910 CET	50130	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:57.900994062 CET	33381	50130	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:57.901261091 CET	50130	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:57.901516914 CET	50130	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:57.902206898 CET	50131	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:57.910315990 CET	33381	50130	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:57.910351038 CET	33381	50131	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:57.910449028 CET	50131	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:58.514588118 CET	33381	50131	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:58.514719009 CET	50131	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:58.514920950 CET	50131	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:58.515434980 CET	50132	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:58.519783974 CET	33381	50131	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:58.520322084 CET	33381	50132	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:58.520410061 CET	50132	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:59.122621059 CET	33381	50132	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:59.122781038 CET	50132	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:59.122950077 CET	50132	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:59.124317884 CET	50133	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:59.127844095 CET	33381	50132	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:59.129352093 CET	33381	50133	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:59.129467010 CET	50133	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:59.727662086 CET	33381	50133	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:59.727761984 CET	50133	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:59.727930069 CET	50133	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:59.728516102 CET	50134	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:10:59.733007908 CET	33381	50133	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:59.733620882 CET	33381	50134	116.203.56.216	192.168.2.7
Oct 31, 2024 14:10:59.733740091 CET	50134	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:00.336282015 CET	33381	50134	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:00.336394072 CET	50134	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:00.336549044 CET	50134	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:00.337086916 CET	50135	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:00.341536045 CET	33381	50134	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:00.342022896 CET	33381	50135	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:00.342097998 CET	50135	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:01.622175932 CET	33381	50135	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:01.622267962 CET	33381	50135	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:01.622325897 CET	33381	50135	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:01.622373104 CET	50135	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:01.622407913 CET	50135	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:01.622543097 CET	50135	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:01.622612000 CET	50135	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:01.623193979 CET	50136	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:01.876966000 CET	33381	50135	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:01.877094030 CET	50135	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:01.934951067 CET	50135	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:02.126091957 CET	33381	50135	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:02.126117945 CET	33381	50136	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:02.126271963 CET	50136	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:02.126425028 CET	33381	50135	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:02.126482964 CET	50135	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:02.729978085 CET	33381	50136	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:02.730150938 CET	50136	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:02.730422020 CET	50136	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:02.731071949 CET	50137	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:02.735172987 CET	33381	50136	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:02.736084938 CET	33381	50137	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:02.736180067 CET	50137	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:03.335370064 CET	33381	50137	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:03.335448980 CET	50137	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:03.337985039 CET	50137	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:03.338445902 CET	50138	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:03.343355894 CET	33381	50137	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:03.343890905 CET	33381	50138	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:03.343974113 CET	50138	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:03.348402977 CET	50138	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:03.354449987 CET	33381	50138	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:03.354515076 CET	50138	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:03.400537968 CET	50139	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:03.405461073 CET	33381	50139	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:03.405566931 CET	50139	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:04.001988888 CET	33381	50139	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:04.002223969 CET	50139	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:04.002435923 CET	50139	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:04.003036022 CET	50140	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:04.007947922 CET	33381	50139	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:04.007980108 CET	33381	50140	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:04.008152962 CET	50140	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:04.618964911 CET	33381	50140	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:04.619016886 CET	50140	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:04.619246006 CET	50140	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:04.619729996 CET	50141	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:04.625011921 CET	33381	50140	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:04.625494003 CET	33381	50141	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:04.625561953 CET	50141	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:05.236509085 CET	33381	50141	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:05.236823082 CET	50141	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:05.236823082 CET	50141	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:05.237299919 CET	50142	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:05.241625071 CET	33381	50141	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:05.242259979 CET	33381	50142	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:05.242335081 CET	50142	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:05.844264030 CET	33381	50142	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:05.844322920 CET	50142	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:05.844517946 CET	50142	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:05.844965935 CET	50143	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:05.849432945 CET	33381	50142	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:05.849721909 CET	33381	50143	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:05.849792957 CET	50143	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:06.622250080 CET	33381	50143	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:06.622405052 CET	50143	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:06.622895956 CET	50143	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:06.623925924 CET	50144	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:06.632481098 CET	33381	50143	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:06.632503033 CET	33381	50144	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:06.632679939 CET	50144	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:07.242403984 CET	33381	50144	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:07.242482901 CET	50144	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:07.242670059 CET	50144	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:07.243129015 CET	50145	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:07.248383999 CET	33381	50144	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:07.248658895 CET	33381	50145	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:07.248788118 CET	50145	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:07.852705956 CET	33381	50145	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:07.852770090 CET	50145	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:07.852991104 CET	50145	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:07.853462934 CET	50146	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:07.857806921 CET	33381	50145	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:07.858242035 CET	33381	50146	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:07.858311892 CET	50146	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:08.460027933 CET	33381	50146	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:08.460167885 CET	50146	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:08.460377932 CET	50146	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:08.460870028 CET	50147	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:08.465241909 CET	33381	50146	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:08.465723038 CET	33381	50147	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:08.465807915 CET	50147	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:09.068552971 CET	33381	50147	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:09.068675041 CET	50147	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:09.068892956 CET	50147	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:09.069420099 CET	50148	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:09.074067116 CET	33381	50147	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:09.074421883 CET	33381	50148	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:09.074835062 CET	50148	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:09.877079010 CET	33381	50148	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:09.877196074 CET	50148	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:09.877473116 CET	50148	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:09.878052950 CET	50149	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:09.882922888 CET	33381	50148	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:09.883436918 CET	33381	50149	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:09.883549929 CET	50149	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:10.489335060 CET	33381	50149	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:10.489527941 CET	50149	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:10.489803076 CET	50149	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:10.490436077 CET	50150	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:10.494817972 CET	33381	50149	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:10.495371103 CET	33381	50150	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:10.495543003 CET	50150	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:11.108402967 CET	33381	50150	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:11.108530998 CET	50150	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:11.108755112 CET	50150	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:11.109220028 CET	50151	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:11.115123987 CET	33381	50150	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:11.115139961 CET	33381	50151	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:11.115241051 CET	50151	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:11.713002920 CET	33381	50151	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:11.713145971 CET	50151	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:11.713346004 CET	50151	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:11.713859081 CET	50152	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:11.718440056 CET	33381	50151	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:11.718831062 CET	33381	50152	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:11.719046116 CET	50152	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:12.343919992 CET	33381	50152	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:12.344145060 CET	50152	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:12.344305038 CET	50152	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:12.344727993 CET	50153	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:12.350181103 CET	33381	50152	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:12.350198984 CET	33381	50153	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:12.350317955 CET	50153	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:12.962116957 CET	33381	50153	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:12.962302923 CET	50153	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:12.962493896 CET	50153	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:12.962980032 CET	50154	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:12.967489004 CET	33381	50153	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:12.967953920 CET	33381	50154	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:12.968049049 CET	50154	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:13.567965031 CET	33381	50154	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:13.568099976 CET	50154	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:13.568289042 CET	50154	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:13.568813086 CET	50155	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:13.573240042 CET	33381	50154	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:13.573653936 CET	33381	50155	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:13.573750973 CET	50155	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:14.169104099 CET	33381	50155	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:14.169166088 CET	50155	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:14.169384956 CET	50155	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:14.169961929 CET	50156	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:14.174387932 CET	33381	50155	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:14.174748898 CET	33381	50156	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:14.174910069 CET	50156	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:14.175965071 CET	50156	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:14.186650991 CET	33381	50156	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:14.209738970 CET	33381	50156	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:14.209877014 CET	50156	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:14.222301006 CET	50157	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:14.227217913 CET	33381	50157	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:14.227319002 CET	50157	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:14.839091063 CET	33381	50157	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:14.839169979 CET	50157	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:14.839364052 CET	50157	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:14.839807987 CET	50158	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:14.844259024 CET	33381	50157	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:14.844815016 CET	33381	50158	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:14.845040083 CET	50158	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:15.453651905 CET	33381	50158	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:15.453725100 CET	50158	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:15.453923941 CET	50158	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:15.454384089 CET	50159	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:15.459589005 CET	33381	50158	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:15.459625006 CET	33381	50159	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:15.459717035 CET	50159	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:16.057008982 CET	33381	50159	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:16.057566881 CET	50159	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:16.057756901 CET	50159	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:16.058418036 CET	50160	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:16.062802076 CET	33381	50159	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:16.063393116 CET	33381	50160	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:16.063488960 CET	50160	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:16.695622921 CET	33381	50160	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:16.695744991 CET	50160	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:16.697592974 CET	50160	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:16.701987028 CET	50161	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:16.702583075 CET	33381	50160	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:16.707082033 CET	33381	50161	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:16.707155943 CET	50161	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:17.318944931 CET	33381	50161	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:17.319080114 CET	50161	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:17.319283962 CET	50161	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:17.319700956 CET	50162	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:17.324402094 CET	33381	50161	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:17.324537992 CET	33381	50162	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:17.324619055 CET	50162	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:17.934760094 CET	33381	50162	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:17.934925079 CET	50162	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:17.935431004 CET	50162	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:17.935977936 CET	50163	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:17.941344976 CET	33381	50162	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:17.941473007 CET	33381	50163	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:17.941596031 CET	50163	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:18.567955017 CET	33381	50163	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:18.568114996 CET	50163	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:18.568360090 CET	50163	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:18.568835974 CET	50164	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:18.573596001 CET	33381	50163	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:18.574027061 CET	33381	50164	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:18.574119091 CET	50164	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:19.169794083 CET	33381	50164	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:19.169866085 CET	50164	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:19.170044899 CET	50164	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:19.170485973 CET	50165	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:19.174993992 CET	33381	50164	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:19.175354958 CET	33381	50165	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:19.175447941 CET	50165	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:19.777829885 CET	33381	50165	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:19.778014898 CET	50165	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:19.778238058 CET	50165	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:19.778799057 CET	50166	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:19.784080982 CET	33381	50165	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:19.784554005 CET	33381	50166	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:19.784693003 CET	50166	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:20.465097904 CET	33381	50166	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:20.465234041 CET	50166	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:20.465406895 CET	50166	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:20.465888977 CET	50167	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:20.470307112 CET	33381	50166	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:20.470812082 CET	33381	50167	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:20.470886946 CET	50167	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:21.075123072 CET	33381	50167	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:21.075227976 CET	50167	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:21.075493097 CET	50167	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:21.075962067 CET	50168	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:21.080359936 CET	33381	50167	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:21.080847979 CET	33381	50168	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:21.081080914 CET	50168	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:21.697134018 CET	33381	50168	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:21.697221041 CET	50168	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:21.697410107 CET	50168	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:21.697884083 CET	50169	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:21.702363968 CET	33381	50168	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:21.702855110 CET	33381	50169	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:21.702949047 CET	50169	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:22.315310955 CET	33381	50169	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:22.315453053 CET	50169	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:22.315643072 CET	50169	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:22.316119909 CET	50170	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:22.320647001 CET	33381	50169	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:22.320987940 CET	33381	50170	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:22.321065903 CET	50170	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:22.924653053 CET	33381	50170	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:22.924741983 CET	50170	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:22.924913883 CET	50170	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:22.925359011 CET	50171	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:22.931634903 CET	33381	50170	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:22.932468891 CET	33381	50171	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:22.932693958 CET	50171	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:23.534949064 CET	33381	50171	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:23.535023928 CET	50171	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:24.484105110 CET	50171	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:24.485095024 CET	50172	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:24.489392042 CET	33381	50171	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:24.489989996 CET	33381	50172	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:24.490055084 CET	50172	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:25.085127115 CET	33381	50172	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:25.086597919 CET	50172	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:25.086741924 CET	50172	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:25.087256908 CET	50173	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:25.091979027 CET	33381	50172	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:25.092407942 CET	33381	50173	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:25.092540979 CET	50173	33381	192.168.2.7	116.203.56.216
Oct 31, 2024 14:11:25.692682028 CET	33381	50173	116.203.56.216	192.168.2.7
Oct 31, 2024 14:11:25.692759991 CET	50173	33381	192.168.2.7	116.203.56.216

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 31, 2024 14:09:23.570120096 CET	51117	53	192.168.2.7	1.1.1.1
Oct 31, 2024 14:09:23.587243080 CET	53	51117	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 31, 2024 14:09:23.570120096 CET	192.168.2.7	1.1.1.1	0x3f4b	Standard query (0)	de4.localto.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 31, 2024 14:09:18.921169043 CET	1.1.1.1	192.168.2.7	0x569c	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	azurefd-t-fb-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 14:09:18.921169043 CET	1.1.1.1	192.168.2.7	0x569c	No error (0)	dual.s-part-0015.t-0009.fb-t-msedge.net	s-part-0015.t-0009.fb-t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 14:09:18.921169043 CET	1.1.1.1	192.168.2.7	0x569c	No error (0)	s-part-0015.t-0009.fb-t-msedge.net		13.107.253.43	A (IP address)	IN (0x0001)	false
Oct 31, 2024 14:09:23.587243080 CET	1.1.1.1	192.168.2.7	0x3f4b	No error (0)	de4.localto.net		116.203.56.216	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	09:09:20
Start date:	31/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -javaagent:"C:\Users\user~1\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\Fattura (4).jar"" >> C:\cmdlinestart.log 2>&1
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	09:09:20
Start date:	31/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	09:09:20
Start date:	31/10/2024
Path:	C:\Program Files (x86)\Java\jre-1.8\bin\java.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -javaagent:"C:\Users\user~1\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\Fattura (4).jar"
Imagebase:	0x970000
File size:	257'664 bytes
MD5 hash:	9DAA53BAB2ECB33DC0D9CA51552701FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	09:09:21
Start date:	31/10/2024
Path:	C:\Windows\SysWOW64\icacls.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
Imagebase:	0x320000
File size:	29'696 bytes
MD5 hash:	2E49585E4E08565F52090B144062F97E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	09:09:21
Start date:	31/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 02070672 Relevance: 1.6, APIs: 1, Instructions: 57
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 020706D5

Memory Dump Source

Source File: 00000002.00000002.2561884848.0000000002070000.00000040.00000800.00020000.00000000.sdmp, Offset: 02070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2070000_java.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 151713bb07c3c00d6574bbb1e05c262c6b80d72af62b8584b729957c88c5d713
Instruction ID: 9501b38676d8bc66263d54485048b92ee632a6bc70acfb25590d1b33b4bb8880
Opcode Fuzzy Hash: 151713bb07c3c00d6574bbb1e05c262c6b80d72af62b8584b729957c88c5d713
Instruction Fuzzy Hash: ED1179B2C0022B8FCF24DF48C5915AEB3B2FB88314B168626DC65A3741D334A920DF94

Function 0207066F Relevance: 1.6, APIs: 1, Instructions: 50
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 020706D5

Memory Dump Source

Source File: 00000002.00000002.2561884848.0000000002070000.00000040.00000800.00020000.00000000.sdmp, Offset: 02070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2070000_java.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 772162a5a143f15449faf5b944e7dfbba1c87f0a0a86335fbeec8a179e9812c9
Instruction ID: 5a25f47d9f1283d2f1311b445bf2505af3a553719a02d65a8ffce1c2e828f06d
Opcode Fuzzy Hash: 772162a5a143f15449faf5b944e7dfbba1c87f0a0a86335fbeec8a179e9812c9
Instruction Fuzzy Hash: 97115A76D0022A8FCF25DF88C5915AEB7B2FB88314F06466AEC64A7341D334AD60DF95

Function 0207D8F7 Relevance: 1.5, Strings: 1, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

`p:m, xrefs: 0207DAC5

Memory Dump Source

Source File: 00000002.00000002.2561884848.0000000002072000.00000040.00000800.00020000.00000000.sdmp, Offset: 02072000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2072000_java.jbxd

Similarity

API ID:
String ID: `p:m
API String ID: 0-1480164307
Opcode ID: cd001fae73cbdea0b04a74e279a001662876fd77d6fe1cd656a1727f2b5587c3
Instruction ID: b52874a1c38fb6049b0d33595182ed2ef31e1d420b1af4b441a8cef8671ef152
Opcode Fuzzy Hash: cd001fae73cbdea0b04a74e279a001662876fd77d6fe1cd656a1727f2b5587c3
Instruction Fuzzy Hash: A4A198B5A04702EFDB1ADF24C494BAAFBB1FF49314F18819DD91A4B381C734A840DBA5

Function 0207D8E0 Relevance: 1.4, Strings: 1, Instructions: 160
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

`p:m, xrefs: 0207DAC5

Memory Dump Source

Source File: 00000002.00000002.2561884848.0000000002072000.00000040.00000800.00020000.00000000.sdmp, Offset: 02072000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2072000_java.jbxd

Similarity

API ID:
String ID: `p:m
API String ID: 0-1480164307
Opcode ID: d8eaee7da4d32652eda7b37b71b2b40ba12badda5c6714ebb6a4f9f3a31ad7d9
Instruction ID: 69214e9b234750622ff43790ba264bb4e480dcd811ee84b6a77311fa0cbc66f8
Opcode Fuzzy Hash: d8eaee7da4d32652eda7b37b71b2b40ba12badda5c6714ebb6a4f9f3a31ad7d9
Instruction Fuzzy Hash: 6C61A971A04702EFDB19CF20C894BAAFBB1FF49714F18819DD91A4B381C774A851DB95

Function 020AC2F0 Relevance: .4, Instructions: 367
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.2561884848.00000000020AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 020AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_20aa000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 809c13d9f3e1725c590f14902046f180a04075c240114426d3f9c25fbd704ec1
Instruction ID: ffd6ce5cce39fe00c8be5031c3cf3030f25f9cc48beae04edc5d08d9a51e2e48
Opcode Fuzzy Hash: 809c13d9f3e1725c590f14902046f180a04075c240114426d3f9c25fbd704ec1
Instruction Fuzzy Hash: 16D1C0B28097C09FF3629BA488623E5BFF0FF56314F46449AD4C88B653D7390859CB96

Function 020AC2A7 Relevance: .3, Instructions: 310
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.2561884848.00000000020AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 020AA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_20aa000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07cecebac4e3aca10e923adcd4b9f1c612cdb74e1037be2188310f7e29693f7e
Instruction ID: d0c9417a48bdb6382bec2165a99f27f07d71d3b1d1f0f0c9a481b1ba4a178e6a
Opcode Fuzzy Hash: 07cecebac4e3aca10e923adcd4b9f1c612cdb74e1037be2188310f7e29693f7e
Instruction Fuzzy Hash: F5B1AFB2808B80DFF3629B6494663E5BFF0FF56314F06459AC4C88B653D7391855CB86

Function 0214BCD0 Relevance: .3, Instructions: 255
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.2561884848.0000000002114000.00000040.00000800.00020000.00000000.sdmp, Offset: 02114000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2114000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e01e5c7cfae101c579c3a8d950a5143939110612c0db0dcb6290c3d7204121b
Instruction ID: dda24209e206ff55720321f2a29777567544622503ab71a1ec5e46dfa7b713a9
Opcode Fuzzy Hash: 4e01e5c7cfae101c579c3a8d950a5143939110612c0db0dcb6290c3d7204121b
Instruction Fuzzy Hash: 75A13B75A496008FC715CF28C58071AB3F2FBC9318F29896DE99D9B350DB36E942CB81

Function 021FE0F7 Relevance: .1, Instructions: 81
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.2561884848.0000000002114000.00000040.00000800.00020000.00000000.sdmp, Offset: 02114000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2114000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbb450053dd81dcc466c4f2d3ebb36de6ac99c3856eb1cd90daa3e739c4f6e18
Instruction ID: 293b8ee033daff9a6ba2bf042d2137aef116b0255fa044185f0046651b92f392
Opcode Fuzzy Hash: fbb450053dd81dcc466c4f2d3ebb36de6ac99c3856eb1cd90daa3e739c4f6e18
Instruction Fuzzy Hash: 6631F3B0949745EFE719CF21C5083A9FBB4FF42308F09429DD9A8977A1D738A914CB81

Function 02084CCD Relevance: .0, Instructions: 22
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.2561884848.0000000002072000.00000040.00000800.00020000.00000000.sdmp, Offset: 02072000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2072000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95c0322438a0583141f079bd9c260a2ef17b218e0ee7d9af93cadd757aa99fbb
Instruction ID: 6f93a531184736eabfe19862d0d3a5d461426feb299e239cffd69618432d71ab
Opcode Fuzzy Hash: 95c0322438a0583141f079bd9c260a2ef17b218e0ee7d9af93cadd757aa99fbb
Instruction Fuzzy Hash: 9DF0BCB5900A06EBEB158F21C0047EAF7B4FB88704F04420AD42C53210C3787429CBD0

Function 02084B78 Relevance: .0, Instructions: 21
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.2561884848.0000000002072000.00000040.00000800.00020000.00000000.sdmp, Offset: 02072000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2072000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef3cffe668e927e2dd8019263675412437cd2eee7b4180d0e6220a444dfbbc89
Instruction ID: 6b03825e75675788b0ab91356fdf6f161395e441164b27139110143e90c3e84a
Opcode Fuzzy Hash: ef3cffe668e927e2dd8019263675412437cd2eee7b4180d0e6220a444dfbbc89
Instruction Fuzzy Hash: 1BF07FB5904A06EBDB158F61C0047DAFBB4FB88714F15421AD92C57350D77874658BC0

Function 0207EC1C Relevance: .0, Instructions: 20
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.2561884848.0000000002072000.00000040.00000800.00020000.00000000.sdmp, Offset: 02072000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2072000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f8a39306d27b6905be8d3169092c1aada55f6b4790c0d6eee651711ea14fb29
Instruction ID: 051fe5dd93156f5cf1e11ce2910b35577505d6eb91b342c8d5f85b6613c53f6d
Opcode Fuzzy Hash: 3f8a39306d27b6905be8d3169092c1aada55f6b4790c0d6eee651711ea14fb29
Instruction Fuzzy Hash: 68F09BB6A04B06EBDB69CF61C0047DAFBB4BB88718F15421AD52C67350D778B469CBC0

Function 0207DA35 Relevance: .0, Instructions: 18
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.2561884848.0000000002072000.00000040.00000800.00020000.00000000.sdmp, Offset: 02072000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2072000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04bda085156c47ac28c70fb86c31dc21023996528fa28fa776aca2d30cbb2edc
Instruction ID: 2597ec99a1cfd0418e8974ad4ee0d7b3595ab6ddfbe4acea2b9f42e18d54b5f4
Opcode Fuzzy Hash: 04bda085156c47ac28c70fb86c31dc21023996528fa28fa776aca2d30cbb2edc
Instruction Fuzzy Hash: 0FF0CAB6D00A0AABDB258F61C0047DAFBB5BB88714F19421AC52C63320E378B465CBC0

Function 020849AA Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2561884848.0000000002072000.00000040.00000800.00020000.00000000.sdmp, Offset: 02072000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2072000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e237e9b5f754b7be057a30e6d25b02822c55b0ff3f7f15055528fec94288ced5
Instruction ID: c7c3b5f2104bb691413dc55922cc29a1ab508a4e6f975276d0c5d7c2d79b78af
Opcode Fuzzy Hash: e237e9b5f754b7be057a30e6d25b02822c55b0ff3f7f15055528fec94288ced5
Instruction Fuzzy Hash: 07F0C2B6D00A06ABDB25CF61C0047CAFBB4BB88B14F15421AC52C67310D3787465CBC0

Function 0207DE6E Relevance: .0, Instructions: 18
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.2561884848.0000000002072000.00000040.00000800.00020000.00000000.sdmp, Offset: 02072000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2072000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8866b69d5af65bd25d71b3fcd395bf3ee53d5790cdc29b3fffd39913dc4ae2b0
Instruction ID: 26dea0d6ec7ebee5c871094fbe2d236a404317c022aba24910256d631fc20cdf
Opcode Fuzzy Hash: 8866b69d5af65bd25d71b3fcd395bf3ee53d5790cdc29b3fffd39913dc4ae2b0
Instruction Fuzzy Hash: 55F0CAB6D00A0AABDB258F61C1047CAFBB5BB88714F19421AC52CA3320C778B965CBC0

Function 02083C76 Relevance: .0, Instructions: 18
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.2561884848.0000000002072000.00000040.00000800.00020000.00000000.sdmp, Offset: 02072000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2072000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 955bf099e2f4ffa77a4d76f61091bd2c3b078e78df53d0f5725c8f8df40818d7
Instruction ID: 768f0d094883521573595a9f837c8da7b1cb42f8c7dd7f283350c664b9ff4802
Opcode Fuzzy Hash: 955bf099e2f4ffa77a4d76f61091bd2c3b078e78df53d0f5725c8f8df40818d7
Instruction Fuzzy Hash: ADF0CAB6D00A0AABDB658FA1C0047CAFBB4BB88714F19421AC52CA7320D378B465CFC0

Function 020845E9 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2561884848.0000000002072000.00000040.00000800.00020000.00000000.sdmp, Offset: 02072000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2072000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d64fdb3682093be0bbb212d4edbf529b556e31f9abb44e8240220c743814e000
Instruction ID: 34aa623889a986f6ffcd25e3b181b83d09eac941d929dcf5b6cfec6d4a372855
Opcode Fuzzy Hash: d64fdb3682093be0bbb212d4edbf529b556e31f9abb44e8240220c743814e000
Instruction Fuzzy Hash: 1CF0CAB6D00A0AABDB258F61C1047CAFBB5BB88724F19421AC52C63320D3B8B465CBC0

Non-executed Functions

Function 021192F8 Relevance: 1.4, Strings: 1, Instructions: 157COMMON

Download Yara Rule

Strings

8c{, xrefs: 02119407

Memory Dump Source

Source File: 00000002.00000002.2561884848.0000000002114000.00000040.00000800.00020000.00000000.sdmp, Offset: 02114000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2114000_java.jbxd

Similarity

API ID:
String ID: 8c{
API String ID: 0-3948765874
Opcode ID: 2de0d15f136d5856378c010bd019893300835a1e4844882e895494bc05a11760
Instruction ID: 48eba1dd1a3e812a65dc45794aeac788c91669613a9344beca64c5e28bd73fe0
Opcode Fuzzy Hash: 2de0d15f136d5856378c010bd019893300835a1e4844882e895494bc05a11760
Instruction Fuzzy Hash: 8951C0B050D3819FD7168F3488657A9BFF0AF07308F0985EAD8988B293D3345459CB92

Function 0211F5EB Relevance: .3, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2561884848.0000000002114000.00000040.00000800.00020000.00000000.sdmp, Offset: 02114000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2114000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06f7d325a8c13468e446be86fff3268ab083dc74c0bcbdcb924dfe33755c77fa
Instruction ID: 4eabced380e7b8049e4f5153ebcf9b5952be2df650cf1bb2f0916b04225a2b4f
Opcode Fuzzy Hash: 06f7d325a8c13468e446be86fff3268ab083dc74c0bcbdcb924dfe33755c77fa
Instruction Fuzzy Hash: 41B14E71948301CFC714DF14D0D072AB7E2BB88314F698A7DE8995BB95D775E882CB82

Function 020703C0 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2561884848.0000000002070000.00000040.00000800.00020000.00000000.sdmp, Offset: 02070000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2070000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a012a9fb5cf5d9e1554885d89a3030425dd9bcc3e3bcfa4e280c99466c7885fc
Instruction ID: 09c751045aec8b2461b4f46f78812491aa942621d277b7178be5a0862c312026
Opcode Fuzzy Hash: a012a9fb5cf5d9e1554885d89a3030425dd9bcc3e3bcfa4e280c99466c7885fc
Instruction Fuzzy Hash: 662117BA9042568FDB358F188C403D9B7E6FB08314F21892EDEC9E7710D3346A898B54

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the binaries used by services. Adversaries may use flaws in the permissions of Windows services to replace the binary that is executed upon service start. These service processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Process: Process Creation, Service: Service Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Fattura (4).jar

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Oracle\Java\.oracle_jre_usage\b5820291038aa69c.timestamp

C:\Users\user\AppData\Local\Temp\hsperfdata_user\4236

C:\cmdlinestart.log

Static File Info

General

File Icon

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: cmd.exePID: 5604, Parent PID: 2104

General

Chronological Activities

Analysis Process: conhost.exePID: 3800, Parent PID: 5604

General

Windows Analysis Report
Fattura (4).jar

Function 02070672 Relevance: 1.6, APIs: 1, Instructions: 57
libraryCOMMON

Function 0207066F Relevance: 1.6, APIs: 1, Instructions: 50
libraryCOMMON

Function 0207D8F7 Relevance: 1.5, Strings: 1, Instructions: 223
COMMON

Function 0207D8E0 Relevance: 1.4, Strings: 1, Instructions: 160
COMMON

Function 020AC2F0 Relevance: .4, Instructions: 367
COMMON

Function 020AC2A7 Relevance: .3, Instructions: 310
COMMON

Function 0214BCD0 Relevance: .3, Instructions: 255
COMMON

Function 021FE0F7 Relevance: .1, Instructions: 81
COMMON

Function 02084CCD Relevance: .0, Instructions: 22
COMMON

Function 02084B78 Relevance: .0, Instructions: 21
COMMON

Function 0207EC1C Relevance: .0, Instructions: 20
COMMON

Function 0207DA35 Relevance: .0, Instructions: 18
COMMON

Function 0207DE6E Relevance: .0, Instructions: 18
COMMON

Function 02083C76 Relevance: .0, Instructions: 18
COMMON